Section 5: Collection of information

Q: What does Section 5 of The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (TITRR) deal with?

Section 5 TITRR pertains to "Collection of information". It is part of the The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, a legislation enacted by the Parliament of India. Section 5 of The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (TITRR) governs collection of information. As verified on 19 May 2026.

Q: Is Section 5 TITRR still in force?

Yes, Section 5 of the The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 is currently in force across the Republic of India.

Q: What is धारा 5 TITRR?

धारा 5 TITRR is the Devanagari Hindi reference for Section 5 of the The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. Section 5 of The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (TITRR) governs collection of information. As verified on 19 May 2026.

Q: What is Dhara 5 TITRR?

Dhara 5 TITRR is the Roman Hindi reference for Section 5 of the The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. "Dhara" means "Section" in Hindi. Section 5 of The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (TITRR) governs collection of information. As verified on 19 May 2026.

Q: How to cite Section 5 of The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011?

Cite as: "Section 5, The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (TITRR)" in legal briefs. For academic writing, use the BlueBook format: The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, § 5 (India).

Law on Tips Editorial Board

(1)

Body corporate or any person on its behalf shall obtain consent in writing through letter or fax or email from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.

(2)

Body corporate or any person on its behalf shall not collect sensitive personal data or information unless -

(a) the information is collected for a lawful purpose connected with a function or activity of the body corporate or any person on its behalf; and

(b) the collection of the sensitive personal data or information is considered necessary for that purpose.

(3)

While collecting information directly from the person concerned, the body corporate or any person on its behalf shall take such steps as are, in the circumstances, reasonable to ensure that the person concerned is having the knowledge of -

(a) the fact that the information is being collected;

(b) the purpose for which the information is being collected;

(c) the intended recipients of the information; and

(d) the name and address of -

(4)

Body corporate or any person on its behalf holding sensitive personal data or information shall not retain that information for longer than is required for the purposes for which the information may lawfully be used or is otherwise required under any other law for the time being in force.

(5)

The information collected shall be used for the purpose for which it has been collected.

(6)

Body corporate or any person on its behalf shall permit the providers of information, as and when requested by them, to review the information they had provided and ensure that any personal information or sensitive personal data or information found to be inaccurate or deficient shall be corrected or amended as feasible:

provided that a body corporate shall not be responsible for the authenticity of the personal information or sensitive personal data or information supplied by the provider of information to such body corporate or any other person acting on behalf of such body corporate.

(7)

Body corporate or any person on its behalf shall, prior to the collection of information including sensitive personal data or information, provider an option to the provider of the information to not to provide the data or information sought to be collected. The provider of information shall, at any time while availing the services or otherwise; also have an option to withdrawal its consent given earlier to the body corporate. Such withdrawal of the consent shall be sent in writing to the body corporate. In the case of provider of information not providing or later on withdrawing his consent, the body corporate shall have the option not to provide goods or services for which the said information was sought.

(8)

Body corporate or any person on its behalf shall keep the information secure as provided in rule 8.

(9)

Body corporate shall address any discrepancies and grievances of their provider of the information with respect to processing of information in a time bound manner. For this purpose, the body corporate shall designate a Grievance Officer and publish his name and contact details on its website. The Grievance Officer shall redress the grievances of provider of information expeditiously but within one month from the date of receipt of grievance.