Client floors often have extra rules: restricted entry, no phones, and visitor logs the client may ask to see. Access card systems record who entered which floor and when. Night-shift transport and guard vendors also hold staff data.
The first four things to sort out
Put notices at gates, camera points and client floor entries.
Set retention for CCTV footage, badge logs and visitor registers.
Limit who can view footage and badge reports.
Check guard, CCTV and access card vendor contracts.
A worked example
Facilities and physical security department
A client asks for its floor's visitor log
Day 1A client asks who visited its dedicated floor last month.
Day 2Facilities finds paper registers with visitors' phone numbers.
Week 2Visitor entry moves to a system with set retention.
AfterOld registers are shredded with a record.
Evidence kept
Client request
Register extract
Shredding record
Visitor logs on client floors need the same care as client data.
What others in the sector usually do. Many facilities teams start by moving visitor registers from paper to a system with automatic deletion.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
IT services and consulting
Production data copied to laptops or test environments; Shared client credentials in team chats; Sub-contractors working under your client access
BPO and contact centre
Card numbers spoken on recorded calls; Phones and paper on the floor; Outbound calls without consent checks for Indian customers
Global capability centre
Indian customer data mixed into global data sets; Global HR systems hosted abroad; Intra-group agreements that predate DPDP
SaaS and software products
Support staff browsing customer tenants; Analytics on customer data beyond the contract; Deletion that does not reach backups
Managed services, data centres and cloud
Privileged admin access across many clients; Subscriber records kept with no access limits; Backups of client systems held for years
6 questions the Facilities and physical security department asks, answered in full
Short answer: Yes, with notice, limits and a deletion period
All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.
From your seat: Facilities and physical security department. Notices, retention and viewing rights.
Their data is your responsibility when you decide why and how it is used, for example gate passes, attendance, biometrics and safety records. The agency holds payroll and personal files, so your contract with the agency must cover how it protects that data.
From your seat: Facilities and physical security department. Guard and housekeeping staff data.
Example in IT and ITeS
Contractors and consultants placed through agencies need the same access rules as staff.
What the law says
Section 7(i) covers employment purposes. Section 8(1) and 8(2) make you responsible for processors such as manpower agencies working on your behalf. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6
Steps
List what you hold about contract workers: ID copies, photos, biometrics, attendance, medical fitness.
Decide who is the Data Fiduciary for each item: you or the agency.
Put data terms in every manpower contract.
Give a short notice in the workers' language at the gate or induction.
Short answer: Yes, every vendor that touches personal data
You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.
From your seat: Facilities and physical security department. Security agency contracts.
Example in IT and ITeS
Sub-contractors working on client data need the same terms you signed with the client.
Short answer: For the legal or business period, then erase
Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.
From your seat: Facilities and physical security department. Visitor registers and footage periods.
Example in IT and ITeS
Candidates, employees, alumni, and client data at project end.
What the law says
Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.
Evidence to keep
Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates
Common mistakes
'Keep everything forever' because storage is cheap
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Facilities and physical security department. A lost register is a breach.
Example in IT and ITeS
If client data is involved, the client contract sets your first deadline, often a few hours.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Short answer: Yes, at every point where you collect data
A notice must tell people, in plain words, what data you collect, why, how they can withdraw consent, how they can use their rights and how they can complain to the Data Protection Board. It has to stand on its own, separate from long terms and conditions, and be shown at the point where data is collected.
From your seat: Facilities and physical security department. Notice at the gate.
Example in IT and ITeS
Your careers page, candidate portal, employee onboarding and website forms need notices. For client data, the client gives the notice.
What the law says
Section 5 and Rule 3 ask for a notice that can be understood on its own, with an itemised list of the data and the purpose for each item. Data you already hold from before the Act also needs a notice, as soon as reasonably practicable. Section 5 · Rule 3 · Section 6 · Sections 11–14 · Rule 14
Steps
List every point where personal data comes in: forms, apps, counters, calls, emails, partner feeds.
Write one short notice per collection point, with the data items and purpose side by side.
Add how to withdraw consent, how to make a request and the DPO or contact person's details.
Offer the notice in English and in the languages your client customers actually use.
Keep each version with the date it went live.
Evidence to keep
Screenshots or copies of the notice at each collection point, with dates
Notice version history
Translations, where used
Common mistakes
Hiding the notice inside terms and conditions
One notice for everything, with no link between data items and purposes
Forgetting old data collected before the Act
The sections you will use most
Section 5 · Rule 3: Notice. Candidate portals, employee onboarding and your own website forms need notices. For client data, the client normally gives the notice.
Section 8(5) · Rule 6: Security safeguards. Remote access to client systems, laptops and ticketing tools need control, monitoring and one-year logs.
Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to NIC or NPL time servers. Data centres, VPS, cloud and VPN providers keep specified subscriber information for five years.
Breach handling must meet the six-hour CERT-In clock and the DPDP report to the Board. Subscriber records need DPDP-level protection.
CERT-In
DPDP Act, Section 17(1)(d)
Processing of data of people outside India, under a contract with a party outside India, is exempt from most of the Act.
Tag each data set by where the people live. The exemption does not cover Indian staff or Indian customers.
MeitY
IT Act, Section 43A and SPDI Rules, 2011
Reasonable security practices for sensitive personal data, until Section 43A is omitted on 13 May 2027.
Your current ISO 27001 practices meet these today; DPDP Rule 6 takes over from May 2027.
Commercial calls and SMS to Indian numbers must follow registration and preference rules.
Outbound campaigns for Indian clients need both DPDP consent and TRAI compliance.
TRAI
Labour Codes (in force from 21 November 2025)
The four labour codes replaced older labour laws, including registers and records employers must keep.
Set retention for staff records against the new codes and state rules.
Ministry of Labour
Client contracts and foreign laws (for example GDPR for EU clients)
Clients often bind you to their own country's law through contracts and standard clauses.
These are contract duties, not Indian law, but you must meet them alongside DPDP.
Contract
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
