DPDP for the CFO / Finance head in Manufacturing

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

1. List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
2. Remove what the gate and the Labour Codes do not need.
3. Give a short notice in the worker's language at enrolment.
4. Add a data schedule to every agency and contractor contract.
5. Delete templates and photos at exit; keep only the registers the law requires.

• Enrolment field list with reasons
• Notice in local languages
• Signed agency data schedules
• Exit deletion log

• Agencies keeping their own copies of Aadhaar cards
• Templates of workers who left years ago
• Worker lists shared with contractors on chat groups

Under the OSH Code, workers in hazardous processes have pre-employment, periodic and post-exposure medical examinations, and their health records are mandatory and accessible to the worker and to inspectors. Keep these records with the medical centre or occupational health team. HR and supervisors need only the fitness decision. Keep the records for the period the Code and state rules prescribe, then destroy them with a log.

Section 7 covers duties under law and purposes of employment, so examinations need no consent. Section 8(5) needs strong safeguards. Section 11 lets the worker ask for a summary. Section 7 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14 · Section 8(1)–(2)

1. List where health records sit: medical centre, outsourced clinic, HR files, contractor files.
2. Move all results to the medical team; give HR a fit, unfit or restricted note.
3. Restrict access by name and log every opening.
4. Give workers a simple way to see their own record.
5. Set retention from the Code and state rules and destroy on schedule.

• Record location list
• Access list and logs
• Fitness note format
• Retention schedule and destruction log

• Blood and lung test results in HR personal files
• Outsourced clinic keeping records with no contract
• Contract workers' results held only by the agency

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

Many sites and partners make the work wide, not deep. Start with one pilot plant.

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

1. Month 1: name the owner, set a budget line, start the inventory.
2. Months 2 to 3: notices, consent records, contact person, request register.
3. Months 3 to 6: vendor contracts, access control, logs, retention schedule.
4. Months 6 to 8: breach rehearsal, training, internal review.
5. Month 9: management review with evidence.

• Programme plan with owners
• Monthly status with evidence
• Management minutes

• Leaving it to the last quarter
• Buying a tool before knowing the gaps
• Status colours with no evidence behind them

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

Manpower agencies, contractors, canteen and medical centre operators, transporters, loyalty and telematics vendors.

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

1. List vendors who receive or can see personal data.
2. Rank them by how much and how sensitive.
3. Add a data-protection schedule to each contract, starting with the top ten.
4. Ask for evidence: certificates, test results, deletion confirmations.
5. Review the top vendors every year.

• Vendor register
• Signed data-protection schedules
• Annual review notes

• Relying on the vendor's standard terms
• No incident-notice time
• No exit and deletion clause

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

1. List the duties that apply.
2. For each, name the piece of evidence that would satisfy an auditor.
3. Ask owners to attach it.
4. Mark duties without evidence as open, not ready.
5. Review the list before each management sign-off.

• Duty-to-evidence list
• Attached evidence
• Sign-off record

• Accepting 'done' without seeing anything
• Counting policies as evidence
• One sign-off and no review after

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

Set periods from the Labour Codes, the chemical rules and the fertiliser order, record type by record type.

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

1. List the record types you hold.
2. Write the period for each, with the law, regulator rule or business reason.
3. Set a trigger for the period to start: end of relationship, date of transaction, exit date.
4. Automate deletion where you can; for paper, schedule shredding.
5. Keep a deletion log.

• Retention schedule approved by Legal
• Deletion log
• Shredding or disposal certificates

• 'Keep everything forever' because storage is cheap
• Deleting before the legal minimum
• Forgetting email, shared drives and backups

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

Most manufacturers are unlikely candidates, but large consumer and connected-vehicle businesses should prepare.

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

1. Estimate how many people's data you hold and how sensitive it is.
2. Note any public or security role your data plays.
3. If you are a likely candidate, run a trial impact assessment this year.
4. Identify an auditor you could appoint.
5. Watch MeitY notifications.

• Volume and sensitivity note
• Trial impact assessment
• Board note

• Assuming 'not notified' means 'never'
• Waiting for notification to start
• Thinking only tech companies will be notified

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

Buyers' social audits, parent company HR systems and telematics platforms may hold data abroad.

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

1. List where each system is hosted and where support teams log in from.
2. Check sector rules for localisation.
3. Put location and access terms in cloud and vendor contracts.
4. Keep the list current; new SaaS tools change it quietly.
5. Tell people in your notice if data goes abroad.

• Hosting and access-location list
• Contract clauses
• Sector rule check

• Forgetting email, CRM and helpdesk SaaS
• Ignoring overseas support logins
• Assuming 'Indian vendor' means 'data in India'

Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.

OSH Code medical examinations and registers are employment and legal duties; explain them in the worker notice.

Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Notice, security, retention and rights still apply to employees. Section 7 · Section 5 · Rule 3 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14

1. List what you collect from staff and why.
2. Mark which items are employment purposes and which are extra.
3. Take consent for the extras, separately.
4. Give staff a short employee privacy notice.
5. Set retention for ex-employee records.

• Employee data list with basis
• Employee privacy notice
• Consent for extras

• A blanket consent clause in the offer letter
• Keeping candidate data forever
• Sharing staff data with vendors without terms

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

Name one DPO across plants, with a contact person at each plant.

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

1. Name one accountable person, with a deputy.
2. Publish the contact on your website, app and notices.
3. Give the role time, a budget line and a route to management.
4. Set a short monthly report: requests, complaints, incidents, actions.
5. Review the role if you are notified as an SDF.

• Appointment letter
• Published contact
• Monthly report

• Giving the job to IT as a side task
• A contact email nobody reads
• No authority to make changes