A. That the rules apply to data subjects located outside of India.

B. That the rules apply to persons or companies collecting sensitive data within India.

C. That the data processor must provide notice to the data subject before data is processed.

D. That sensitive personal data or information includes passwords, financial information, medical records, and