Appellate Tribunal for Electricity

This policy applies to personal information processed through the APTEL E-Filing Portal, including information provided during registration, authentication, filing-related activities and requests for technical assistance.

Information contained in case records or documents submitted as part of legal proceedings may also be subject to applicable laws, Tribunal procedures, record-management requirements and disclosure obligations.

Depending on the portal services used, the information processed may include:

• Identity and contact information: Name, email address, telephone number, postal address and other details requested for registration or communication.
• Account information: Login identifier, account preferences, verification records and account-related details. Passwords should be protected using appropriate security controls.
• Filing and case information: Case references, party details, representative details, filing particulars and information included in documents submitted by users.
• Technical information: Information such as IP address, browser type, access timestamps, error records and security logs, where collected by the portal infrastructure.
• Support communications: Details provided when reporting technical issues, requesting assistance or submitting feedback.

Only information required for specified and lawful purposes should be collected. The categories listed above must be adjusted to reflect the information the portal actually collects.

Personal information may be processed, as applicable, for the following purposes:

• Creating, verifying and managing user accounts.
• Providing access to available e-filing services.
• Processing filing information and related documents.
• Communicating filing-related notifications or service updates.
• Responding to user queries and technical support requests.
• Maintaining system integrity, security and audit records.
• Detecting and investigating suspected misuse or unauthorised access.
• Complying with applicable legal, regulatory and official requirements.

Personal information should not be used for unrelated purposes unless permitted or required by applicable law.

Personal information shall be processed on a lawful basis applicable to the relevant activity under Indian law, including the Digital Personal Data Protection Act, 2023 and the rules and provisions in force, where applicable.

Depending on the service and legal requirements, processing may be necessary for a user-requested service, compliance with a legal obligation, the performance of an authorised public function or another lawful basis recognised by applicable legislation.

Where consent is required, it should be obtained in the manner prescribed by applicable law. The applicable notice and consent mechanism must reflect the portal's actual processing activities.

Personal information shall not be disclosed indiscriminately. It may be shared, where necessary and legally permitted, with authorised recipients for legitimate administrative, legal, operational or security purposes.

• Authorised officers or personnel responsible for administering the relevant Tribunal or portal services.
• Government departments, public authorities or competent bodies where disclosure is authorised or required by law.
• Approved technology, hosting or support service providers acting under appropriate contractual and security controls.
• Courts, tribunals, investigative authorities or other lawful recipients where disclosure is required by applicable law.

Information contained in judicial or tribunal records may be subject to specific access, inspection, publication and disclosure rules. Such information shall be handled in accordance with the applicable framework.

Appropriate technical and organisational measures should be implemented to protect personal information against unauthorised access, disclosure, alteration, loss or misuse, in accordance with applicable security requirements.

• Access controls and role-based permissions, where implemented.
• Secure authentication and protection of account credentials.
• Appropriate protection of information during transmission and storage.
• Monitoring and logging of relevant security events, where configured.
• Incident handling and response procedures.
• Periodic review of security controls and authorised access.

No method of electronic transmission or storage can be represented as completely secure. Users should also protect their credentials and use trusted devices and networks.

Personal information should be retained only for as long as necessary for the purpose for which it is processed, or for the period required under applicable law, Tribunal record-retention schedules, audit requirements or lawful directions.

When information is no longer required and retention is not otherwise mandated, it should be securely deleted, anonymised or disposed of in accordance with the applicable retention and disposal procedures.

Filing documents and official records may be subject to separate statutory or archival retention requirements.

The portal may use session cookies or similar technical mechanisms where necessary to maintain a user's session, support authentication, protect account access or enable essential functionality.

Any analytics, preference or other non-essential cookies should be disclosed according to the portal's actual implementation and applicable requirements. Users may manage cookies through their browser settings, although disabling essential cookies may affect some portal functions.

The final published policy should identify the cookies actually used by the portal and their purposes.

The portal may rely on authorised infrastructure or service providers for hosting, security, communication or technical support, where applicable. Any access to personal information by such providers should be governed by appropriate authorisation, safeguards and applicable legal requirements.

The portal may also link to external websites. When users leave the portal, the privacy policy of the external website may apply. Users should review that website's privacy notice before providing personal information.

Individuals may have rights concerning their personal data under applicable law, subject to the relevant conditions, exceptions and procedures.

• Request information about personal data processed, where a right to such information applies.
• Seek correction or updating of inaccurate or incomplete personal information, as applicable.
• Request erasure where legally available and where retention is not required by law.
• Withdraw consent where processing relies on consent, subject to applicable law.
• Submit a grievance or privacy-related request through the designated channel.

Requests concerning official case records, filed documents or information required to be retained under law may be subject to specific procedures and legal restrictions. Requests will be handled in accordance with applicable law and the portal's approved procedures.

Where personal data relating to children is processed, the portal's handling of such information must comply with applicable legal requirements, including any requirements relating to parental consent, verification or permitted exceptions.

The portal's actual registration and filing procedures should specify any additional requirements applicable to users or parties who are minors.

Suspected or confirmed incidents involving unauthorised access, disclosure, loss or compromise of personal information should be handled through the applicable incident-response and reporting procedures.

Notifications to affected individuals or competent authorities shall be made where and as required by applicable law and prescribed directions.

This policy may be reviewed and updated to reflect changes in applicable law, portal functionality, data-handling practices or government requirements. Revised versions should be published on the portal with the applicable review or effective date.

Users are encouraged to review the published policy periodically.

Users who have questions about this Privacy Policy or wish to raise a privacy-related concern should contact the designated portal authority through the official contact or grievance channel.

The final published policy should identify the authorised privacy contact or Grievance Officer, where applicable, together with verified contact details and the prescribed process for submitting and tracking a request.