india
Do Indian companies need a written letter before registering a user?
<p>The first link <a href="https://www.google.com/search?client=firefox-b-m&amp;q=2011+meity+it+act&amp;oq=2011+meity+it+act" rel="nofollow noreferrer">act</a> here leads to a PDF where it seems the honourable authorities have prescribed letter consent for processing sensitive personal information like passwords . Now every account should have a password which the company generates or takes from user . Does this mean they need written consent from the people ?</p>

<p>The document <a href="http://meity.gov.in/writereaddata/files/GSR3_10511%281%29.pdf" rel="nofollow noreferrer">Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.(G.S.R. 313(E))</a> dated: 11th April, 2011 and commencing:</p>
<blockquote>
<p>G.S.R. 313(E).—In exercise of the powers conferred by clause (ob) of sub-section (2) of section 87 read with section 43A of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes the following rules ...</p>
</blockquote>
<p>and occupying pages 7-11 of the linked PDF seems to be a rule modifying the Indian IT Act so as to impose information handling practices. It seems to be not unlike the GDPR or CCPA, althoguh different in detail. It requires consent for the collection and retention of personal information, requires that collection not be excessive, and requires that individuals be able to see what information a company holds about that person, and in many cases have it deleted.</p>
<p>Specifically, Rule 5 (1) provides that:</p>
<blockquote>
<p>Body corporate or any person on its behalf shall obtain consent in writing through letter or Fax or email from the provider of the sensitive personal data or information regarding purpose of usage before collection of such information.</p>
</blockquote>
<p>(A &quot;body corporate&quot; appears to be simply a company or business firm.)</p>
<p>&quot;sensitive personal data&quot; is defined in rule 3 to be any of a list of nine kinds of information, of which the first is a password.</p>
<p>Rule 5 (7) provides that:</p>
<blockquote>
<p>Body corporate or any person on its behalf shall, prior to the collection of information including sensitive personal data or information, provide an option to the provider of the information to not to provide the data or information sought to be collected. The provider of information shall, at any time while availing the services or otherwise, also have an option to withdraw its consent given earlier to the body corporate. Such withdrawal of the consent shall be sent in writing to the body corporate.</p>
</blockquote>
<p>It is not clear to me whether &quot;letter or Fax or email from the provider&quot; [from the information provider (aka the Data Subject)] could include a message automatically sent when a person using a web site clicks a button clearly indicating consent to collection of such information. It certainly does not require a letter mailed in the post. The provisions of sub-rule (7) clearly contemplate collection of information online as long as there is active consent and an option to withdraw consent.</p>
<p>I find it hard to imagine that a separate, manual, communication mu8st be sent in advance under rule 5 (1), and that does not seem to be how this rule has been enforced over the past 10 years.  I think that &quot;through letter or Fax or email&quot; is being interpreted to include positive written consent through a web site. But I cannot find a cite of a law or rule explicitly saying as much, and I do not know Indian law very well, so I could be mistaken.</p>
<p><strong>Additional info</strong>:</p>
<p>The <a href="https://www.meity.gov.in/writereaddata/files.PressNote_25811.pdf" rel="nofollow noreferrer">Press note</a> &quot;Clarification on Information Technology (Reasonable security practices and
procedures and sensitive personal data or information) Rules, 2011 under section 43A of the Information Technology Act, 2000&quot; dated 24-August-2011 17:03 IST says:</p>
<blockquote>
<p>...  in Rule 5(1) consent includes consent given by any mode of electronic communication.</p>
</blockquote>
<p>This seems to dispose of any suggestion that a separate letter or email is required, and permits the user to indicate consent though a button, checkbox, or other online interaction, as long as it is clear what consent this will be giving.</p>
