11. Accountability.— (1) The data fiduciary shall be responsible for complying with all obligations set out in this Act in respect of any processing undertaken by it or on its behalf. (2) The data fiduciary should be able to demonstrate that any processing undertaken by it or on its behalf is in accordance with the provisions of this Act. CHAPTER III GROUNDS FOR PROCESSING OF PERSONAL DATA 12. Processing of personal data on the basis of consent.— (1) Personal data may be processed on the basis of the consent of the data principal, given no later than at the commencement of the processing. (2) For the consent of the data principal to be valid, it must be— (a) (b) (c) (d) (e) free, having regard to whether it meets the standard under section 14 of the Indian Contract Act, 1872 (9 of 1872); informed, having regard to whether the data principal has been provided with the information required under section 8; specific, having regard to whether the data principal can determine the scope of consent in respect of the purposes of processing; clear, having regard to whether it is indicated through an affirmative action that is meaningful in a given context; and capable of being withdrawn, having regard to whether the ease of such withdrawal is comparable to the ease with which consent may be given. (3) The data fiduciary shall not make the provision of any goods or services or the quality thereof, the performance of any contract, or the enjoyment of any legal right or claim, conditional on consent to processing of any personal data not necessary for that purpose. (4) The data fiduciaryshall bear the burden of proof to establish that consent has been given by the data principal for processing of personal data in accordance with sub-section (2). (5) Where the data principal withdraws consent for the processing of any personal data necessary for the performance of a contract to which the data principal is a party, all legal consequences for the effects of such withdrawal shall be borne by the data principal. 9