Rule 12
12. Additional obligations of Significant Data Fiduciary.—
(1) A Significant Data Fiduciary shall, once in every period of twelve months from the date on which it is notified as such or is included in the class of Data Fiduciaries notified as such, undertake a Data Protection Impact Assessment and an audit to ensure effective observance of the provisions of this Act and the rules made thereunder.
(2) A Significant Data Fiduciary shall cause the person carrying out the Data Protection Impact Assessment and audit to furnish to the Board a report containing significant observations in the Data Protection Impact Assessment and audit.
(3) A
Significant Data Fiduciary shall observe due diligence to verify that
algorithmic software deployed by it for hosting, display, uploading,
modification, publishing, transmission, storage, updating or sharing of
personal data processed by it are not likely to pose a risk to the rights of
Data Principals.
(4) A Significant Data Fiduciary shall undertake measures to
ensure that personal data specified by the Central Government on the basis of
the recommendations of a committee constituted by it is processed subject to
the restriction that the personal data and the traffic data pertaining to its
flow is not transferred outside the territory of India.