DPDP for Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Factories hold more personal data than most people think: large workforces and contract labour, gate passes, biometrics, medical checks, dealers and distributors, and in some industries, consumers and farmers. Most of it is collected at the gate, the medical centre and the dealer counter, not in head office. DPDP does not change your safety or labour duties. It asks you to know what you hold about each person, keep it safe, use it only for the reason it was collected, and answer when someone asks.

Open the interactive tool for this sector

Types of organisation

• Chemicals and petrochemicalsChemical plants keep health surveillance records for workers in hazardous processes, emergency contact lists, driver records for hazardous goods transport, and sometimes lists of nearby residents for emergency plans. Safety law asks for many of these records. DPDP asks who can see them and how long they stay.
• FertilisersSubsidised fertiliser is sold to farmers through PoS devices at retailers, with Aadhaar-based farmer authentication, and subsidy is released to companies on the basis of actual sales captured in iFMS. Companies also run farmer meetings, soil testing and agronomy apps that collect farmer data. Keep the scheme data and your own farmer data apart.
• Automotive and auto componentsVehicle makers receive buyer data from dealers for warranty and recalls, and connected vehicles send location and driving data. Plants run large contract workforces.
• FMCG and consumer goodsContests, sampling and retailer loyalty apps bring in consumer and shopkeeper data, often through agencies. Some contests reach children, where parent consent and no targeting apply.
• Steel, metals and miningPlants run townships, hospitals and schools, and very large contract workforces. Each township service is its own set of records.
• Cement and building materialsMason and contractor loyalty schemes collect bank details for rewards; truck drivers' data flows through logistics partners.
• Textiles and apparelGlobal buyers' social audits review worker files, and hostels hold residents' details. Indian workers' data stays under full DPDP duties even when an overseas buyer asks for it.
• Food processing and dairyProcurement apps record farmer names, bank accounts and supply; consumer complaints carry contact details.

Whose data you hold

• Employees and contract workers
• Workers in hazardous processes and their medical records
• Dealers, distributors, retailers, masons and mechanics
• Farmers (fertilisers, food and dairy)
• Consumers who register products, warranties or connected vehicles
• Visitors, drivers and CCTV at plants
• Nearby residents in emergency plans

Read it from your seat

• DPO / Privacy leadIn manufacturing, most personal data sits at plants, depots and dealer networks, far from where policies are written.
• CISO / Security headYou protect office IT, plant systems and a long tail of small systems at gates, canteens and medical centres.
• CIO / IT headYour systems span the ERP, HRMS, dealer portals, loyalty apps and sometimes connected products.
• CEO / MDYour plants run on people: employees, contract workers, drivers, dealers and, in some businesses, farmers.
• DirectorYou oversee a business whose personal data sits mostly at plants and with partners.
• HR headYou hold records for employees and, through agencies, for contract workers who may outnumber them.
• Legal & complianceYour documents decide who is responsible when agencies, dealers, vendors and government systems share data.
• Operations headPlant operations, depots and dispatch are where gate passes, driver records and shift rosters are made every day.
• Plant head / factory managerAs plant head, you run the gate, the medical centre, the canteen and often a hostel or township.
• Chief risk officerData protection joins safety, labour and supply chain risk in your register.
• Internal audit headInternal audit in manufacturing already tests safety, labour and plant controls. DPDP adds new things to test at each plant: notices at the gate, access to medical records, agency data terms and deletion after exit.
• CFO / Finance headDPDP reaches finance in manufacturing through wage and bank data, loyalty payouts, contractor bills and, in fertilisers, subsidy work.
• Company secretaryYou prepare the papers the Board of Directors and its audit and risk committees see. DPDP should appear there with evidence, next to the safety and labour compliance items you already report.
• Chief compliance officerYour compliance calendar already carries the Labour Codes, the OSH Code, the chemical rules and, in fertilisers, the Fertiliser (Control) Order. DPDP adds duties owed to each worker, dealer, farmer and consumer.
• CTO / Engineering headYour teams build and connect the systems that carry personal data: HRMS, gate and biometric systems, plant systems, dealer portals and, in some businesses, connected products.
• Data and analytics headAnalytics in manufacturing uses attendance, safety, dealer sales, loyalty and, in some businesses, farmer and vehicle data. DPDP asks whether each use fits the purpose people were told.
• Product headEvery loyalty app, agronomy app, warranty registration and connected-product app is a collection point. The notice and consent screens are now part of the product.
• Marketing head (CMO)Marketing in manufacturing runs dealer, mason and mechanic loyalty schemes, contests, and in fertilisers and dairy, farmer meetings and crop or animal advisory.

By department

• IT
• Administration
• HR
• Finance
• Marketing
• Customer service
• Legal
• Procurement
• Internal audit
• Information security / SOC
• Sales
• Data and analytics
• Software engineering
• Facilities and physical security
• Training and L&D
• Records and archives

Questions specific to this sector

• Contract workers, gate passes and biometrics: who is responsible for their data?
• Worker medical records in hazardous processes: who may see them and how long do we keep them?
• Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?
• Dealer, retailer, mason and mechanic loyalty programmes: what do we need?
• Connected vehicles and product registration: what can we do with the data?
• Emergency plans with contact lists shared with authorities: is that allowed?

Templates

Notice, request log, retention schedule, vendor clause and breach notice for manufacturing.

Rules that sit alongside DPDP