(1) The Authority shall ensure the security and confidentiality of the data in Jan-Aadhaar Resident Data Repository.
(2) Without prejudice to the generality of sub-section (1), the Authority shall-
(a) adopt and implement appropriate technical and organisational security measures;
(b) ensure that the agencies, consultants, advisors or other persons appointed or engaged for performing any function of the Authority under this Act, have in place appropriate technical and organisational security measures for the information; and
(c) ensure that the agreements or arrangements entered into with such agencies, consultants, advisors or other persons, impose obligations equivalent to those imposed on the Authority under this Act, and require such agencies, consultants, advisors or other persons to act only on instructions from the Authority.
(3) Save as otherwise provided in this Act, the Authority or any of its officers or other employees or any agency that maintains the Jan-Aadhaar Resident Data Repository shall not, whether during his service or thereafter, reveal any information stored in the Jan-Aadhaar Resident Data Repository or authentication record to anyone except in accordance with any law for the time being in force: Provided that any information of Jan-Aadhaar card holder stored in the Jan-Aadhaar Resident Data Repository may be revealed to such holder on a request made by him in the manner specified in regulations.
(4) The provisions of Chapter VI of the Central Act shall mutatis mutandis apply to Protection of Information under this Act.