white_paper_on_data_protection_in_india_171127_final_v2

person who processes personal information for a responsible party on the basis of a contract)
processes personal data, such operator is also bound to establish and maintain adequate
security measures. 695
Finally, in the event that the responsible party believes that the personal data of an individual
has been accessed or acquired by an unauthorised party, then the responsible party must
inform the Information Regulator. The responsible party must also notify the individual as
soon as reasonably possible after the discovery of the data breach, and also take steps to
restore the integrity of the responsible party‘s information system. 696
Australia
Although the Privacy Act does not have a specific provision relating to accountability
principle, the Privacy Act addresses this topic by way of the APPs under the said Act. For
instance, APP 1 mandates open and transparent management of personal information. As per
this principle, an APP entity must take reasonable steps to ensure the implementation of
privacy practices and systems within the entity, which would ensure compliance with other
data protection obligations under the Privacy Act. 697 Additionally, the said principles also
provide that any entity holding personal information relating to an individual, must also take
reasonable steps to protect this information from misuse, interference, loss, unauthorised
access, modification or disclosure. 698
Entities which come under the scope of the Privacy Act also have an additional obligation to
destroy or de-identify personal information which is no longer required by an entity for any
purpose. 699 The Privacy Act additionally mandates certain obligations on entities transferring
personal information to overseas recipients. APP 8 provides that these entities must take
reasonable steps to ensure that cross-border transfers do not breach any of the obligations set
out under the Privacy Act and the APPs. 700 A breach of a privacy principle is said to occur
when any activity of an entity is contrary to or inconsistent with the provisions set out under
any of the APPs. 701
Further, the OAIC has issued a ―Guide to securing personal information‖, which provides
some guidance as to the reasonable steps which entities are required to take in order to protect
personal information in their control from misuse, interference, loss, unauthorised access,
modification or disclosure. It also provides guidance on the reasonable steps which entities
695 Section 21(1), POPI Act.
696 Section 22, POPI Act.
697 APP 1, Privacy Act.
698 APP 11, Privacy Act.
699 APP 11, Privacy Act.
700 APP 8, Privacy Act.
701 Section 6A, Privacy Act.
153