business india encryption
Use of encryption and storage of personal information on website based in India
<p>I want to launch a website that stores users' personal information, encrypts user passwords, and uses SSL for secure transmission. Do I require an license to launch the website? If yes, how do I obtain a license in India? I don't have a registered office and am hosting my website on a third-party server.</p>

<p>No. You do not require any license for this. Section 43 A of the Information technology Act explicitly provides that</p>

<blockquote>
  <p>Where a body corporate, possessing, dealing or handling any sensitive
  personal data or information in a computer resource which it owns,
  controls or operates, is negligent in implementing and maintaining
  reasonable security practices and procedures and thereby causes
  wrongful loss or wrongful gain to any person, such body corporate
  shall be liable to pay damages by way of compensation to the person so
  affected</p>
</blockquote>

<p>So you could literally just purchase a domain+hosting and start collecting data. However, you should use sufficient security to prevent it from being hacked because that would be punishable as outlined by Section 72 A which states:</p>

<blockquote>
  <p>Punishment for disclosure of information in breach of lawful contract.
  -Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while
  providing services under the terms of lawful contract, has secured
  access to any material containing personal information about another
  person, with the intent to cause or knowing that he is likely to cause
  wrongful loss or wrongful gain discloses, without the consent of the
  person concerned, or in breach of a lawful contract, such material to
  any other person, shall be punished with imprisonment for a term which
  may extend to three years, or with fine which may extend to five lakh
  rupees, or with both</p>
</blockquote>

<p>Certain data are treated differently such as credit and debit card details, sensitive data, etc. So I would recommend you to read the <a href="http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf" rel="nofollow">Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011</a> to know your liabilities.</p>
