India passes data privacy rules.

• Position: PRIVACY - Legislation - Brief article

India's new privacy legislation, Information Technology Rules 2011, requires organizations in India and their intermediaries to obtain written consent from customers before using their personal data.

The law says "consent" can take the form of an e-mail, fax, or letter prior to the collection of personal data. Similar to the proposed European Union online privacy legislation, the law gives Indian consumers the right to review personal data being collected about them and amend any inaccuracies.

Organizations also must get consent from an individual before transferring sensitive personal data. The organization transferring data must ensure the receiver maintains the same privacy standards, according to the legislation.

The law also requires organizations to maintain a system for disputes and resolving issues that arise from the handling, processing, and use of sensitive personal data. If an organization has mishandled an individual's personal data or failed to maintain an adequate privacy policy, then it must provide compensation. The law...