Other duties

(1) An information utility shall- (a) provide services to a user based on its explicit consent; (b) guarantee protection of the rights of users; (c) establish adequate procedures and facilities to ensure that its records are protected against loss or destruction; 47 Substituted by Notification No. IBBI/2021-22/GN/REG072 dated 13th April, 2021 (w.e.f. 13-04-2021). Prior to substitution, it stood as under: - “(1) A user shall expeditiously update the information submitted by it to an information utility.”. 48 Substituted by Notification No. IBBI/2026-27/GN/REG146, dated 01st June, 2026 (w.e.f. 02-06-2026). Before substitution, the words stood as under: “Form C of the Schedule”.

(d) adopt secure systems for information flows; (e) protect its data processing systems against unauthorised access, alteration, destruction, disclosure or dissemination of information; and (f) transfer all the information submitted by a user, and stored with it to another information utility on the request of the user. (2) An information utility shall not- (a) outsource the provision of core services to a third-party service provider; (b) use the information stored with it for any purpose other than providing services under these Regulations, without the prior approval of the Board; (c) seek data or details of users except as required for the provision of the services under these Regulations.