Section 5(3) in The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
(3)While collecting information directly from the person concerned, the body corporate or any person on its behalf shall take such steps as are, in the circumstances, reasonable to ensure that the person concerned is having the knowledge of -(a)the fact that the information is being collected;(b)the purpose for which the information is being collected;(c)the intended recipients of the information; and(d)the name and address of -(i)the agency that is collecting the information; and(ii)the agency that will retain the information.
