DPDP for the CEO / MD in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Your plants run on people: employees, contract workers, drivers, dealers and, in some businesses, farmers.

Written for: CEO / MD, Manufacturing. Open this seat in the interactive tool

What is different here

The work is spread across many sites and partners, not one big system. Most spend goes on contracts with agencies and vendors, gate and attendance systems, and training supervisors. In chemicals and fertilisers, health records and farmer data are where trust matters most.

The first four things to sort out

Name one accountable person for DPDP across plants, with a budget line.
Ask for the list of agencies and vendors holding worker and dealer data.
Ask how worker health records are protected.
Review progress every month with evidence, plant by plant.

A worked example

CEO / MD

The MD asks where worker data really sits

Month 1Each plant lists who holds worker data: HR, the gate, the medical centre, the canteen and 22 agencies.
Month 2A standard data schedule goes to every agency. Four cannot show basic security.
Month 4Two agencies improve, two are replaced at renewal.
Each quarterDPO / Management review agency coverage plant by plant.

Evidence kept

Plant data lists
Signed schedules
Quarterly note

Most worker data sits outside HR; find it first.

What others in the sector usually do. Most manufacturers are linking DPDP checks to their existing safety and compliance reviews at plants.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

What a good answer from management sounds like

Question to ask	A good answer sounds like	Effort and time
Contract workers, gate passes and biometrics: who is responsible for their data?	“Every contract worker gets a notice at enrolment. Agencies sign our data schedule. Templates and photos are deleted within a month of exit, and the logs show it.”	Medium · 8 to 12 weeks across plants
Worker medical records in hazardous processes: who may see them and how long do we keep them?	“Health records stay with the medical team, with named access and logs. HR sees only fitness notes. Workers can see their own records, and contract workers' records are held the same way.”	Medium · 6 to 10 weeks
Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?	“We have a written view on our role in the scheme. Scheme data is used only for supply and subsidy. Our own farmer apps have a notice and consent, and dealers are told not to keep Aadhaar copies.”	Light to medium · 4 to 8 weeks
Do we need a DPO?	“We have named an accountable person with a deputy, published the contact, and that person reports to management every month.”	Light · 2 to 4 weeks
How much effort and time will it take to be ready by 13 May 2027?	“We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.”	Programme · six to nine months
Something has gone wrong. What happens in the first 72 hours?	“We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.”	Medium · 4 to 8 weeks, then a yearly drill
What must a vendor contract say about personal data?	“Our top vendors have data terms with a short incident-notice time, and we review them every year.”	Medium · 8 to 16 weeks for the top vendors
Could we be a Significant Data Fiduciary?	“We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.”	Medium if you are a likely candidate
Can we send offers to past customers and leads?	“Marketing runs only on separate consent. Lead lists are checked, and stop requests take effect within a day.”	Light to medium · 4 to 8 weeks

9 questions the CEO / MD asks, answered in full

Contract workers, gate passes and biometrics: who is responsible for their data?

Short answer: You are, for data used at your plant; agencies act for you under contract

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

What the law says

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

What a good answer from management sounds like: “Every contract worker gets a notice at enrolment. Agencies sign our data schedule. Templates and photos are deleted within a month of exit, and the logs show it.” Effort and time: Medium · 8 to 12 weeks across plants.

Steps

List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
Remove what the gate and the Labour Codes do not need.
Give a short notice in the worker's language at enrolment.
Add a data schedule to every agency and contractor contract.
Delete templates and photos at exit; keep only the registers the law requires.

Evidence to keep

Enrolment field list with reasons
Notice in local languages
Signed agency data schedules
Exit deletion log

Common mistakes

Agencies keeping their own copies of Aadhaar cards
Templates of workers who left years ago
Worker lists shared with contractors on chat groups

Worker medical records in hazardous processes: who may see them and how long do we keep them?

Short answer: The worker, the medical team and inspectors; others get only the fitness decision

Under the OSH Code, workers in hazardous processes have pre-employment, periodic and post-exposure medical examinations, and their health records are mandatory and accessible to the worker and to inspectors. Keep these records with the medical centre or occupational health team. HR and supervisors need only the fitness decision. Keep the records for the period the Code and state rules prescribe, then destroy them with a log.

What the law says

Section 7 covers duties under law and purposes of employment, so examinations need no consent. Section 8(5) needs strong safeguards. Section 11 lets the worker ask for a summary. Section 7 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14 · Section 8(1)–(2)

What a good answer from management sounds like: “Health records stay with the medical team, with named access and logs. HR sees only fitness notes. Workers can see their own records, and contract workers' records are held the same way.” Effort and time: Medium · 6 to 10 weeks.

Steps

List where health records sit: medical centre, outsourced clinic, HR files, contractor files.
Move all results to the medical team; give HR a fit, unfit or restricted note.
Restrict access by name and log every opening.
Give workers a simple way to see their own record.
Set retention from the Code and state rules and destroy on schedule.

Evidence to keep

Record location list
Access list and logs
Fitness note format
Retention schedule and destruction log

Common mistakes

Blood and lung test results in HR personal files
Outsourced clinic keeping records with no contract
Contract workers' results held only by the agency

Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?

Short answer: The scheme flow is the government's; your own farmer programmes are yours

Subsidised fertiliser is sold through PoS devices at retailers, with Aadhaar-based farmer authentication on iFMS, a government platform built by NIC for the Department of Fertilizers. The scheme decides why farmer identity is collected in that flow. Your company sees sales data from it and supplies the retailers. Treat any farmer-level data you see as personal data, use it only for supply and subsidy work, and never for marketing. For your own farmer meetings, soil testing and agronomy apps, you are the Data Fiduciary with full duties. Get a written legal view on your role.

What the law says

Section 4 needs a lawful basis for each use. Section 6 needs consent for your own programmes. Section 8(1) and 8(5) apply to any data your staff, dealers or vendors handle for you. Section 4 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 5 · Rule 3

What a good answer from management sounds like: “We have a written view on our role in the scheme. Scheme data is used only for supply and subsidy. Our own farmer apps have a notice and consent, and dealers are told not to keep Aadhaar copies.” Effort and time: Light to medium · 4 to 8 weeks.

Steps

Write down which farmer data you see from the scheme, and which you collect yourself.
Limit company dashboards and exports to what supply and subsidy work needs.
Remind dealers and retailers not to keep Aadhaar copies or note numbers in registers.
Give a notice and ask consent in your own farmer apps and meetings.
Keep scheme data and marketing data apart in your systems.

Evidence to keep

Written role view
Dashboard access list
Dealer circular
Farmer app notice and consent records

Common mistakes

Using scheme purchase data to target offers
Retailers keeping Aadhaar photocopies
Farmer meeting registers kept for ever

Do we need a DPO?

Short answer: Not required by law unless notified as an SDF, but name one person

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

From your seat: CEO / MD. The person you name needs your visible backing. Give the role a budget line and ask for a short report every month.

Example in Manufacturing

Name one DPO across plants, with a contact person at each plant.

What the law says

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “We have named an accountable person with a deputy, published the contact, and that person reports to management every month.” Effort and time: Light · 2 to 4 weeks.

Steps

Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Review the role if you are notified as an SDF.

Evidence to keep

Appointment letter
Published contact
Monthly report

Common mistakes

Giving the job to IT as a side task
A contact email nobody reads
No authority to make changes

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: CEO / MD. Treat it as a nine-month programme with one owner. The cost is mostly people's time and some system changes, not a single tool.

Example in Manufacturing

Many sites and partners make the work wide, not deep. Start with one pilot plant.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

What a good answer from management sounds like: “We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.” Effort and time: Programme · six to nine months.

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: CEO / MD. You will be the public face if something goes wrong. Know who calls you, at what hour, and who speaks to customers and the media.

Example in Manufacturing

A stolen gate server or a lost medical register is a breach. CERT-In's six hours and the DPDP steps may both apply.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.” Effort and time: Medium · 4 to 8 weeks, then a yearly drill.

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: CEO / MD. Ask for the top ten vendors by personal data held. If the list takes weeks to produce, that is the first gap.

Example in Manufacturing

Manpower agencies, contractors, canteen and medical centre operators, transporters, loyalty and telematics vendors.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

What a good answer from management sounds like: “Our top vendors have data terms with a short incident-notice time, and we review them every year.” Effort and time: Medium · 8 to 16 weeks for the top vendors.

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: CEO / MD. Ask management for a short note on whether you could be notified, and what it would take to be ready.

Example in Manufacturing

Most manufacturers are unlikely candidates, but large consumer and connected-vehicle businesses should prepare.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

What a good answer from management sounds like: “We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.” Effort and time: Medium if you are a likely candidate.

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Can we send offers to past customers and leads?

Short answer: Only with separate consent and an easy way to stop

Marketing needs consent that is separate and specific, unless the person clearly expects it from the relationship. Bought or scraped lead lists are risky because you cannot show consent. Every message should carry an easy way to stop.

From your seat: CEO / MD. Growth teams feel this first. Back the rule that marketing runs only on clear consent; it protects the brand.

Example in Manufacturing

Never use fertiliser scheme purchase data or dealer KYC for offers.

What the law says

Section 6 sets the consent standard. Section 5 needs a notice. Section 9 bars targeted advertising at children. Section 6 · Section 5 · Rule 3 · Section 9 · Rules 10, 12

What a good answer from management sounds like: “Marketing runs only on separate consent. Lead lists are checked, and stop requests take effect within a day.” Effort and time: Light to medium · 4 to 8 weeks.

Steps

Separate service messages from marketing messages.
Ask marketing consent separately, with a clear action.
Stop using bought lists unless the seller can show consent for you.
Add an easy stop option to every message.
Respect the telecom preference rules for calls and SMS.

Evidence to keep

Marketing consent records
Lead source records
Stop requests and their handling

Common mistakes

Treating account sign-up as marketing consent
Agency lists with no consent proof
A stop option that does not work

The sections you will use most

Section 4: When you may process data.
Section 8(1)–(2): Responsibility for vendors. Manpower agencies, labour contractors, canteen and medical centre operators, transporters, loyalty vendors, telematics vendors and dealer software vendors all work for you on some data.
Section 8(6) · Rule 7: Telling people about a breach. A leaked contractor list or a lost medical file is a breach. Tell affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours. CERT-In's six-hour clock may apply too.
Section 10 · Rule 13: Significant Data Fiduciaries.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints. Publish one contact for workers, dealers, farmers and consumers. Reply to grievances within 90 days at the most.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In