is treated as confidential by the data fiduciary or data processor, it shall not disclose such information unless required as per law, or where it is required to carry out its function under clause (w) of sub-section (2). 61. Codes of Practice.— (1) The Authority shall issue codes of practice in accordance with this section to promote good practices of data protection and facilitate compliance with the obligations under this Act. (2) Notwithstanding sub-section (1), the Authority may also approve,and issue codes of practice submittedby an industry or trade association, an association representing the interest of data principals, any sectoral regulator or statutory authority, or any departments or ministries of the Central or State Government. (3) The Authority shall ensure transparency while approving or issuing any code of practice under this section in accordance with sub-section (4). (4) A code of practice, whether under sub-section (1) or sub-section (2), shall not be issued unless the Authority has undertaken a requisite consultation process with relevant sectoral regulators and stakeholders including the public and has followed the procedure for issuance of such code of practice, as may be prescribed. (5) A code of practice issued under this section shall not derogate fromthe provisions of this Actor any applicable law. (6) Without prejudice to sub-sections (1) or (2), or any other provision of this Act, the Authority may issue codes of practice in respect of the following matters— (a) (b) (c) (d) (e) (f) (g) (h) (i) (j) requirements for notice undersection 8 of this Act including any model forms or guidance relating to notice; measures for ensuring quality of personal data processed under section 9 of this Act; measures pertaining to the retention of personal data under section 10 of this Act; conditions for valid consent under section 12 of this Act; processing of personal data under section 15 of this Act; activities where processing of personal data may be undertaken undersection 17; processing of sensitive personal data underChapter IV of this Act; processing of personal data under any other ground for processing, including processing of personal data of children and development of appropriate ageverification mechanisms under section 23 and mechanisms for processing personal data on the basis of consent of users incapable of providing valid consent under this Act; exercise of any right by data principals under Chapter VI of this Act; the standards and means by which a data principal may avail the right to data portability under section 26 of this Act; 35