"An information provider is a person, who provides information to a body corporate and, under these rules, has certain rights over sensitive personal information. Such information cannot be collected without the provider

An information provider is a person who provides information to the body corporate and under these rules, he has certain rights over the sensitive personal information, this information cannot be collected without the providers' consent and he or she has the right to abstain from giving consent and can withdraw the consent by writing to the body corporate. Privacy Policy Rule 4 requires a body corporate to provide a privacy policy on their website, which is easily accessible, provides for the type and purpose of personal, sensitive personal information collected and used, and reasonable security practices and procedures. Consent Rule 5 requires that prior to the collection of sensitive personal data, the body corporate must obtain consent, either in writing or through fax regarding the purpose of usage before collection of such information. Collection Limitation Rule 5 (2) requires that a body corporate should only collect sensitive personal data if it is connected to a lawful purpose and is considered necessary for that purpose. Notice Rule 5(3) requires that while collecting information directly from an individual, the body corporate must provide the following information: The fact that information is being collected The purpose for which the information is being collected The intended recipients of the information. The name and address of the agency that is collecting the information The name and address of the agency that will retain the information Retention Limitation Rule 5(4) requires that body corporate must retain sensitive personal data only for as long as it takes to fulfil the stated purpose or otherwise required under law. Purpose Limitation Rule 5(5) requires that information must be used for the purpose that it was collected for. Right to Access and Correct Rule 5(6) requires a body corporate to provide individuals with the ability to review the information they have provided and access and correct their personal or sensitive personal information. Right to 'Opt Out' and Withdraw Consent Rule 5(7) requires that the individual must be provided with the option of 'opting out' of providing data or information sought by the body corporate. Also, they must have the right to withdraw consent at any point of time. Grievance Officer Rule 5(9) requires that body corporate must designate a grievance officer for redressal of grievances, details of which must be posted on the body corporate's website and grievances must be addressed within a month of receipt. Disclosure with Consent, Prohibition on Publishing and Further Disclosure Rule 6 requires that body corporate must have consent before disclosing sensitive personal data to any third person or party, except in the case with Government agencies for the purpose of verification of identity, prevention, detection, investigation, on receipt of a written request. Also, the body corporate or any person on its behalf shall not publish the sensitive personal information and the third party receiving the sensitive personal information from body corporate or any person on its behalf shall not disclose it further. Requirements for Transfer of Sensitive Personal Data Rule 7 requires that body corporate may transfer sensitive personal data into another jurisdiction only if the country ensures the same level of protection and may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer. Security of Information Rule 8 requires that the body corporate must secure information in accordance with the ISO 27001 standard or any other best practices notified by Central Government, which must be audited annually or when the body corporate undertakes a significant up gradation of its process and computer resource.