**Summary:**
In response to Lok Sabha Unstarred Question No. 3608, addressed on August 11, 2025, regarding data privacy and customer information protection, the Ministry of Corporate Affairs provided the following information.
(a & b) As of the stated date, the Ministry has not conducted inspections of books of accounts nor issued advisories to companies incorporated in Tamil Nadu concerning data privacy and protection of consumer information under the Companies Act, 2013.
(c) The Securities and Exchange Board of India (SEBI) Listing Obligations and Disclosure Requirements Regulations, 2015 (LODR Regulations) mandates that listed entities maintain corporate governance structures and ensure adequate disclosures of material events, including those relating to cybersecurity and data privacy. Regulation 27 of the LODR Regulations, 2015, requires listed entities to submit a quarterly compliance report on corporate governance to recognized stock exchanges, including details of cybersecurity incidents, breaches, or loss of data or documents. This report must be signed by the compliance officer or the chief executive officer of the listed entity.
Key Entities Referenced
Companies Act, 2013: A law in India that regulates companies.
Tamil Nadu: A state in India where inspections and advisories related to data privacy were inquired about.
Dr. T Sumathy Alias Thamizhachi Thangapandian: Member of Parliament who raised the question about data privacy.
Ministry of Corporate Affairs: The government ministry responsible for corporate affairs.
Shri Harsh Malhotra: Minister of State in the Ministry of Corporate Affairs; Minister of State in the Ministry of Road Transport and Highways, who provided the answer to the question.
SEBI Listing Obligations and Disclosure Requirements Regulations, 2015: Regulations that mandates listed entities to maintain corporate governance structures and ensure adequate disclosures of material events.
LODR Regulations: An abbreviation for SEBI Listing Obligations and Disclosure Requirements Regulations, 2015.
Sravana 20, 1947 Saka: The date according to the Saka calendar, corresponding to August 11, 2025.
GOVERNMENT OF INDIA
MINISTRY OF CORPORATE AFFAIRS
LOK SABHA
UN-STARRED QUESTION NO. 3608
ANSWERED ON Monday, August 11, 2025
Sravana 20, 1947 (Saka)
DATA PRIVACY AND PROTECTION OF CUSTOMERS
3608. Dr. T Sumathy Alias Thamizhachi Thangapandian
Will the Minister of CORPORATE AFFAIRS be pleased to state:
(a) whether the Government has conducted any inspections or issued
advisories to companies in Tamil Nadu regarding data privacy and
protection of customer information in the light of recent major data
leaks by large fintech, e-commerce, or health institutions;
(b) if so, the details thereof and the number of companies in the region
found non-compliant with statutory disclosure obligations under the
Companies Act, 2013; and
(c) the steps taken by the Government to strengthen compliance
reporting requirements for listed companies to ensure the timely
disclosure of data breaches and privacy risks
ANSWER
Minister of State in the Ministry of Corporate Affairs; Minister of State
in the Ministry of Road Transport and Highways.
(Shri Harsh Malhotra)
(a) to (b): Inspection of Books of Accounts have not been conducted
nor any advisory issued under the Companies Act, 2013 on data
privacy and for protection of consumer information of the Companies
incorporated in Tamil Nadu, by this Ministry.
(c): SEBI (Listing Obligations and Disclosure Requirements)
Regulations, 2015 (“LODR Regulations”), mandates listed entities to
maintain corporate governance structures and ensure adequate
disclosures of material events, including those relating to
cybersecurity and data privacy. Regulation 27 of the LODR
Regulations 2015, requires listed entities to submit a report as
follows:(i) To the recognised stock exchange(s), a quarterly compliance
report on corporate governance in the format and within the
timelines, as may be specified by the Board from time to time.
(ii) Details of cyber security incidents or breaches or loss of data or
documents shall be disclosed along with the report mentioned in
clause (a) of sub-regulation (2).
(iii) The report mentioned in clause (a) of sub-regulation (2) shall be
signed either by the compliance officer or the chief executive officer
of the listed entity.
*******