Schedule [ See rule 5(2) and 15 ]

The standards for processing of personal data by the State and its instrumentalities under clause (b) of section 7 and the standards for processing of personal data necessary for the purposes specified in clause (b) of sub-section (2) of section 17.

Implementation of appropriate technical and organisational measures to ensure effective compliance with the following in accordance with the law applicable to the processing of personal data, i.e.--

• (a) the processing is carried out lawfully;
• (b) the processing is carried out for the uses specified in clause (b) of section 7 of the Act or for the purposes specified in clause (b) of sub-section (2) of section 17 of the Act, as the case may be;
• (c) the processing is limited to such personal data that is necessary for achieving such uses or such purposes, as the case may be;
• (d) the processing is carried out while taking reasonable efforts to ensure the accuracy of the personal data;
• (e) the personal data is retained for as long as necessary to achieve such uses or such purposes, as the case may be, or for compliance with any law;
• (f) appropriate security measures are in place to protect personal data in the possession or control of the data fiduciary, including in relation to any processing carried out by it or by a data processor on its behalf; (d) where the processing is carried out under clause (b) of section 7 of the Act, it is carried out after giving notice thereof to the data principal, and
  • (i) providing the business contact information of a person who is able to respond to questions about the processing of the personal data of the data principal on behalf of the data trustee;
  • (ii) specifying the specific communication link for accessing such data trustee’s website or app, or both, and details of other means, if any, using which such data principal can exercise his/her rights under the Act; and
  • d (iii) is done in a manner consistent with such other standards that may be applicable to the processing of such personal data under the policy issued by the Central Government or any law for the time being in force; and (h) the responsibility of the person who, alone or together with other individuals, determines the purposes and means of the processing of personal data for the effective compliance with these standards