DPDP for the Chief risk officer in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Data protection joins safety, labour and supply chain risk in your register.

Written for: Chief risk officer, Manufacturing. Open this seat in the interactive tool

What is different here

The risk sits with partners and plants: agencies, dealers, loyalty vendors and gate systems. Health records and farmer data carry the most harm if exposed.

The first four things to sort out

Add each DPDP duty as a risk line with an owner.
Track agency, contractor and dealer network risk separately.
Link safety audit and ISO evidence where it fits.
Report every quarter.

A worked example

Chief risk officer

DPDP enters the plant risk register

Step 1Each duty becomes a risk line with an owner at plant and head office.
Step 2Agency, dealer and loyalty vendor risk get their own lines.
Step 3Safety audit and ISO evidence are linked where they fit.
QuarterlyThe register goes to the risk committee.

Evidence kept

Register extract
Linked evidence
Committee note

Use the safety register you already trust.

What others in the sector usually do. Risk teams are rating plants and partners by the volume and sensitivity of data they hold.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

10 questions the Chief risk officer asks, answered in full

Contract workers, gate passes and biometrics: who is responsible for their data?

Short answer: You are, for data used at your plant; agencies act for you under contract

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

What the law says

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

Steps

List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
Remove what the gate and the Labour Codes do not need.
Give a short notice in the worker's language at enrolment.
Add a data schedule to every agency and contractor contract.
Delete templates and photos at exit; keep only the registers the law requires.

Evidence to keep

Enrolment field list with reasons
Notice in local languages
Signed agency data schedules
Exit deletion log

Common mistakes

Agencies keeping their own copies of Aadhaar cards
Templates of workers who left years ago
Worker lists shared with contractors on chat groups

Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?

Short answer: The scheme flow is the government's; your own farmer programmes are yours

Subsidised fertiliser is sold through PoS devices at retailers, with Aadhaar-based farmer authentication on iFMS, a government platform built by NIC for the Department of Fertilizers. The scheme decides why farmer identity is collected in that flow. Your company sees sales data from it and supplies the retailers. Treat any farmer-level data you see as personal data, use it only for supply and subsidy work, and never for marketing. For your own farmer meetings, soil testing and agronomy apps, you are the Data Fiduciary with full duties. Get a written legal view on your role.

What the law says

Section 4 needs a lawful basis for each use. Section 6 needs consent for your own programmes. Section 8(1) and 8(5) apply to any data your staff, dealers or vendors handle for you. Section 4 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 5 · Rule 3

Steps

Write down which farmer data you see from the scheme, and which you collect yourself.
Limit company dashboards and exports to what supply and subsidy work needs.
Remind dealers and retailers not to keep Aadhaar copies or note numbers in registers.
Give a notice and ask consent in your own farmer apps and meetings.
Keep scheme data and marketing data apart in your systems.

Evidence to keep

Written role view
Dashboard access list
Dealer circular
Farmer app notice and consent records

Common mistakes

Using scheme purchase data to target offers
Retailers keeping Aadhaar photocopies
Farmer meeting registers kept for ever

Dealer, retailer, mason and mechanic loyalty programmes: what do we need?

Short answer: Consent with a clear notice; collect only what rewards need

Loyalty schemes collect names, phone numbers, photos, ID and bank details to pay rewards. Joining is a choice, so this rests on consent with a clear notice. Collect only what rewards and tax rules need, keep bank details in one secure place, and make leaving the scheme easy. The loyalty vendor acts for you. Dealer KYC for appointment is a separate purpose from loyalty.

What the law says

Section 5 needs a notice. Section 6 sets what valid consent is, including easy withdrawal. Section 8(1) covers the loyalty vendor. Section 5 · Rule 3 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List the fields the app and forms collect, and drop what rewards do not need.
Show a short notice at sign-up in the local language.
Keep bank details in the payout system only.
Add a data schedule to the loyalty vendor contract.
Close and delete inactive members' data on a set period.

Evidence to keep

Field list with reasons
Sign-up notice and consent records
Vendor schedule
Inactive member deletion log

Common mistakes

Bank details in spreadsheets sent by email
Field staff enrolling masons without telling them
Loyalty data reused for unrelated offers

How do we put DPDP into the risk register?

Short answer: One line per duty, with owner and evidence

Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.

From your seat: Chief risk officer. Split DPDP into separate duties. One line called 'DPDP compliance' hides where the risk actually is.

Example in Manufacturing

Add agency, dealer network and plant system lines.

What the law says

The Act sets duties in Sections 5 to 12. A risk register shows management where each duty stands. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 10 · Rule 13

Steps

List the duties that apply to you.
For each, write the risk in plain words, the control and the owner.
Link existing controls and audits as evidence.
Rate likelihood and impact in your usual way.
Review every quarter with management.

Evidence to keep

Risk register extract
Linked evidence
Quarterly review minutes

Common mistakes

One line saying 'DPDP compliance'
No owners
Evidence that is only a policy document

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Chief risk officer. Map every reporting clock that applies to you on one page: CERT-In, your regulator and the Data Protection Board.

Example in Manufacturing

A stolen gate server or a lost medical register is a breach. CERT-In's six hours and the DPDP steps may both apply.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Chief risk officer. Vendor risk is usually the largest single item. Track the top vendors as separate risk lines.

Example in Manufacturing

Manpower agencies, contractors, canteen and medical centre operators, transporters, loyalty and telematics vendors.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: Chief risk officer. Keep notification as a scenario in the register, with a trigger and an owner.

Example in Manufacturing

Most manufacturers are unlikely candidates, but large consumer and connected-vehicle businesses should prepare.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Can personal data be stored or accessed outside India?

Short answer: Yes, unless a sector rule says otherwise

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

From your seat: Chief risk officer. Record every system or support team outside India, and check each against sector localisation rules.

Example in Manufacturing

Buyers' social audits, parent company HR systems and telematics platforms may hold data abroad.

What the law says

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

Steps

List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Tell people in your notice if data goes abroad.

Evidence to keep

Hosting and access-location list
Contract clauses
Sector rule check

Common mistakes

Forgetting email, CRM and helpdesk SaaS
Ignoring overseas support logins
Assuming 'Indian vendor' means 'data in India'

Does ISO 27001 or NIST CSF cover our DPDP duties?

Short answer: They cover security, not the whole Act

They help a great deal with the security part. ISO/IEC 27001 and NIST CSF 2.0 are good evidence of reasonable security safeguards. They do not cover notice, consent, rights, complaints or children's data. ISO/IEC 27701 adds privacy controls, but no certificate replaces the Act.

From your seat: Chief risk officer. Use existing certifications as evidence, but record the DPDP duties they do not cover as their own risk lines.

Example in Manufacturing

ISO 27001 and plant safety audits give evidence for much of Rule 6.

What the law says

Section 8(5) and Rule 6 ask for reasonable security safeguards. A recognised standard is strong evidence of that duty, and only of that duty. Section 8(5) · Rule 6

Steps

Map your current controls to Rule 6.
Add the DPDP-only items: notice, consent, rights, complaints, children, retention.
Use the same evidence for audits and for DPDP.
Include privacy in the scope of your next internal audit.
Consider ISO/IEC 27701 if clients ask for it.

Evidence to keep

Control map
Audit reports
Gap list for DPDP-only items

Common mistakes

Treating a certificate as DPDP compliance
Scope that leaves out the systems with the most personal data
No owner for the non-security duties

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: Chief risk officer. Track the programme against dated milestones and report slippage early.

Example in Manufacturing

Many sites and partners make the work wide, not deep. Start with one pilot plant.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

The sections you will use most

Section 8(1)–(2): Responsibility for vendors. Manpower agencies, labour contractors, canteen and medical centre operators, transporters, loyalty vendors, telematics vendors and dealer software vendors all work for you on some data.
Section 8(6) · Rule 7: Telling people about a breach. A leaked contractor list or a lost medical file is a breach. Tell affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours. CERT-In's six-hour clock may apply too.
Section 10 · Rule 13: Significant Data Fiduciaries.
Section 16 · Rule 15: Data going outside India. Global buyers' social audits, overseas parent HR systems and telematics platforms may move data abroad. DPDP allows it unless a country is restricted; check contracts and support access.
Section 8(5) · Rule 6: Security safeguards. Biometric attendance, occupational health records and connected-vehicle data need strong access control. Keep plant control networks apart from systems holding personal data.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In