Legal Risks in IIM Tiruchirappalli’s Terms & Conditions: A Case Study in Privacy and Compliance | Erayaha

## When Privacy Promises Fall Short: Legal Risks in IIM Tiruchirappalli’s Terms & Conditions

Imagine a scenario where a single ambiguous clause exposes an institution to regulatory fines exceeding ₹20 crore under India’s Data Protection Bill or international frameworks like GDPR. Our analysis of IIM Tiruchirappalli’s Terms & Conditions reveals several such risks—ranging from unclear data sharing permissions to vague consent mechanisms—that could result in significant financial and reputational harm.

1. Ambiguous Data Sharing with Third Parties The current terms state that personal information may be revealed to employees, agents, consultants, and others at the institute’s discretion. This broad language creates a loophole for unauthorized data sharing, potentially violating Section 5 of the Indian IT Act and GDPR Article 28. The lack of explicit user consent or defined categories of recipients could result in regulatory penalties and loss of user trust.

Legal Analysis

high Risk

Removed

Added

IIM Tiruchirappalli may reveal the collecteddisclose personal information only to its employees, agents, or consultants and others who require access for the IIM Tiruchirappalli decides need to knowspecified purposes stated at the informationtime of collection, and only after ensuring appropriate confidentiality agreements are in place. Disclosure to any other third party shall require explicit user consent, except where required by law.

Legal Explanation

The original clause is overly broad and lacks specificity regarding who may access personal data and for what purposes. The revision limits disclosure, mandates confidentiality, and introduces user consent, aligning with Indian IT Act and GDPR requirements.

2. Discretionary Disclosure to Law Enforcement and Courts The policy allows information disclosure to law enforcement, courts, and others based on the institute’s discretion. Without a clear legal threshold or due process, this exposes the institution to legal challenges for unlawful disclosure and potential damages claims. Under Indian law and GDPR, disclosures must be justified, necessary, and proportionate.

Legal Analysis

critical Risk

Removed

Added

The institute may also divulge thedisclose personal information to third parties, including law enforcement officials, or courts only upon receipt of a valid legal order or statutory request, and others based on its discretionwill notify the affected individual unless prohibited by law.

Legal Explanation

The original clause grants excessive discretion for disclosure, risking unlawful or disproportionate release of personal data. The revision ensures disclosures are legally justified and transparent, reducing liability.

3. Vague Consent Mechanism for Online Forms The terms state that submitting a form implies consent for data storage and use. However, this implicit consent may not satisfy explicit consent requirements under the Indian Data Protection Bill or GDPR Article 7. Failure to obtain clear, informed consent can result in fines up to 4% of annual turnover or ₹15 crore, whichever is higher.

Legal Analysis

high Risk

Removed

Added

By filling out and submitting the form, you are understood to have consented toprovide explicit consent for IIM Tiruchirappalli storingto store and using theuse your information solely for the stated purposes for which it has been provided. You may withdraw your consent at any time by contacting the institute, in accordance with applicable data protection laws.

Legal Explanation

The original clause relies on implied consent, which may not meet the explicit consent standard required by Indian and international privacy laws. The revision clarifies consent and introduces withdrawal rights.

4. Incomplete Data Protection Commitments While the policy promises to protect information from loss or misuse, it lacks specifics on security measures, breach notification, or user rights. This omission can undermine enforceability and expose the institution to liability in the event of a data breach, as required by Section 43A of the IT Act and GDPR Articles 33-34.

Legal Analysis

high Risk

Removed

Added

Any information provided to IIM Tiruchirappalli will be protected from lossthrough industry-standard security measures, misuseincluding encryption, unauthorized access or disclosurecontrols, alterationand regular audits. In the event of a data breach, or destructionaffected individuals will be notified promptly as required by law.

Legal Explanation

The original clause lacks detail on security practices and breach response, making it difficult to enforce and potentially non-compliant with IT Act Section 43A and GDPR. The revision introduces concrete obligations.

Conclusion: Proactive Legal Safeguards for Institutional Trust Our examination shows that even well-intentioned privacy policies can harbor costly loopholes. By clarifying data sharing, tightening consent protocols, and specifying security commitments, IIM Tiruchirappalli can mitigate regulatory risk and strengthen stakeholder confidence.

What would a major data breach or regulatory investigation cost your institution?
Are your current terms robust enough to withstand legal scrutiny?
How often do you review your contracts for evolving compliance standards?

This analysis is for educational purposes only and does not constitute legal advice. For actual legal guidance, consult with a licensed attorney. This assessment is based on publicly available information and professional legal analysis. See erayaha.ai’s terms of service for liability limitations.