DPDP for the CIO / IT head in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Your systems span the ERP, HRMS, dealer portals, loyalty apps and sometimes connected products.

Written for: CIO / IT head, Manufacturing. Open this seat in the interactive tool

What is different here

The same person can be a contract worker in the gate system, an employee in HRMS later, and a mason in the loyalty app. Farmer data may sit in agronomy apps, procurement apps and exports from scheme dashboards.

The first four things to sort out

List systems with personal data, including plant-level ones and vendor apps.
Find exports of dealer, farmer and buyer lists on shared drives.
Plan deletion of biometric templates when workers exit.
Mask data in test copies of loyalty and dealer systems.

A worked example

CIO / IT head

Dealer lists found on a shared drive

Week 1A drive review finds 40 spreadsheets of dealer and mason details, some with bank account numbers.
Week 2Owners are found. Current files move to the dealer portal; the rest are deleted.
Week 4Export from the portal now needs approval and is logged.
AfterA monthly scan for bank account patterns runs on shared drives.

Evidence kept

Drive scan report
Deletion log
Export approval setting

Every export is a copy you must look after.

What others in the sector usually do. Teams are adding a data owner and retention field to every system in the IT asset list.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022

DPDP duty	Law	NIST CSF 2.0	ISO/IEC 27001 Annex A	Evidence
Know where personal data is	Section 8(5) · Rule 6	ID.AM-02, ID.AM-07	5.9, 5.12	Inventory of systems and data types, with owner and hosting location
Only the right people get in	Section 8(5) · Rule 6	PR.AA-01, PR.AA-05	5.15, 5.16, 5.18, 8.2	Role matrix, quarterly access review sign-off, leaver removal report
Strong sign-in for admins and remote users	Section 8(5) · Rule 6	PR.AA-03	5.17, 8.5	MFA enforcement report for admin, VPN and email accounts
Encrypt or mask data	Section 8(5) · Rule 6	PR.DS-01, PR.DS-02	8.11, 8.24	Encryption settings for databases, laptops, backups and transfers; masking in test copies
Keep and watch logs	Section 8(5) · Rule 6	PR.PS-04, DE.CM-01, DE.CM-03	8.15, 8.16, 8.17	Log retention settings (one year; 180 days in India for CERT-In), alert rules, NTP source
Backups that restore	Section 8(5) · Rule 6	PR.DS-11, RC.RP-03	8.13, 5.30	Backup schedule, offline copy, last restore test with date and result
Separate networks	Section 8(5) · Rule 6	PR.IR-01	8.20, 8.22	Network diagram showing segments, firewall rule review
Patch and fix weaknesses	Section 8(5) · Rule 6	ID.RA-01	8.8	Vulnerability scan results and closure tracker
Handle incidents and tell people	Section 8(6) · Rule 7	RS.MA-01, RS.CO-02, RS.CO-03	5.24, 5.25, 5.26, 6.8	Incident plan with the 6-hour and 72-hour steps, drill record, contact list
Learn from incidents	Section 8(6) · Rule 7	DE.AE-02, ID.IM-01	5.27, 5.28	Post-incident review and actions closed
Vendors protect data too	Section 8(1)–(2)	GV.SC-05, GV.SC-07	5.19, 5.20, 5.22	Contracts with data terms, vendor review record
Data comes back or is deleted at contract end	Section 8(7) · Rule 8	GV.SC-10	5.20, 8.10	Exit clause and deletion certificate from the vendor
Cloud is set up safely	Section 16 · Rule 15	GV.SC-05, PR.DS-01	5.23	Cloud region list, shared-responsibility note, configuration review
Delete when the purpose is over	Section 8(7) · Rule 8	PR.DS-01	8.10, 7.14	Retention schedule, deletion log, disposal certificates for disks and paper
People know the rules	Section 8(5) · Rule 6	PR.AT-01	6.3	Training attendance and short test results by department
Legal duties are tracked	Section 8(5) · Rule 6	GV.OC-03	5.31, 5.34	Register of laws and rules that apply, reviewed yearly
Roles are named	Section 8(9)–(10) · Rules 9, 14	GV.RR-02	5.2, 5.4	Named owners for each system and each duty, approved by management

Logs, backups and access checklist

Logs. Access and activity logs for systems holding personal data are kept for at least one year (DPDP Rule 6 and Rule 8(3)).
Logs. ICT system logs are kept for 180 days, within India, as the CERT-In Directions of 28 April 2022 require.
Logs. System clocks are synced to the NTP servers of NIC or NPL, or to servers traceable to them, as CERT-In asks.
Clocks. Reportable cyber incidents can be reported to CERT-In within six hours of being noticed.
Clocks. Affected people and the Data Protection Board are told without delay, and the Board gets a detailed report within 72 hours.
Backups. At least one backup copy is offline or immutable, and a full restore was tested in the last six months.
Backups. Backup retention matches the retention schedule, so deleted records do not live on for years in old copies.
Access. Privileged and remote accounts use multi-factor sign-in.
Access. Access rights are reviewed every quarter, and leavers are removed on their last working day.
Access. Shared or generic logins are replaced with named accounts, or are tied to a named person in a register.
Vendors. Vendor remote access is named, time-bound and logged.
Test data. Test and training systems use masked data, not live copies.
OT separation. Gate, attendance, CCTV and medical centre systems are separated from plant control networks.
Biometrics. Biometric templates and gate photos are deleted within a set period after a worker's exit, and the deletion is logged.
Health records. Occupational health records have named access and logs; HR and supervisors see only fitness notes.

9 questions the CIO / IT head asks, answered in full

Connected vehicles and product registration: what can we do with the data?

Short answer: For the service the buyer chose; anything more needs consent

Connected vehicles and smart products send location, usage and driving data, and registration gives you the buyer's contact details. Use it for what the buyer signed up for: warranty, recalls, safety and the services in the app. Sharing with insurers, finance partners or for marketing needs specific consent. Location data shows where people live and go, so keep only what each service needs.

From your seat: CIO / IT head. Build retention into the telematics platform, not as a later clean-up.

What the law says

Section 6 needs specific consent for each purpose. Section 5 needs a notice. Section 16 applies if telematics data goes abroad. Section 5 · Rule 3 · Section 6 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 16 · Rule 15 · Sections 11–14 · Rule 14

Steps

List the data each connected feature sends and why.
Show the notice in the app and at delivery, by feature.
Ask separately for insurer, partner and marketing sharing.
Set retention for location history and trip data.
Check where the telematics vendor stores and supports data.

Evidence to keep

Feature and data list
App notice and consent screens
Retention settings
Telematics vendor schedule

Common mistakes

Location kept for years by default
Dealer handing buyer lists to insurers
Telematics support from abroad with no contract terms

Dealer, retailer, mason and mechanic loyalty programmes: what do we need?

Short answer: Consent with a clear notice; collect only what rewards need

Loyalty schemes collect names, phone numbers, photos, ID and bank details to pay rewards. Joining is a choice, so this rests on consent with a clear notice. Collect only what rewards and tax rules need, keep bank details in one secure place, and make leaving the scheme easy. The loyalty vendor acts for you. Dealer KYC for appointment is a separate purpose from loyalty.

What the law says

Section 5 needs a notice. Section 6 sets what valid consent is, including easy withdrawal. Section 8(1) covers the loyalty vendor. Section 5 · Rule 3 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List the fields the app and forms collect, and drop what rewards do not need.
Show a short notice at sign-up in the local language.
Keep bank details in the payout system only.
Add a data schedule to the loyalty vendor contract.
Close and delete inactive members' data on a set period.

Evidence to keep

Field list with reasons
Sign-up notice and consent records
Vendor schedule
Inactive member deletion log

Common mistakes

Bank details in spreadsheets sent by email
Field staff enrolling masons without telling them
Loyalty data reused for unrelated offers

Where does personal data live in our organisation?

Short answer: Start with one row per system

Usually in more places than anyone expects: core systems, email, shared drives, laptops, vendor systems, backups, test copies, spreadsheets and paper. A simple inventory, one row per system, is the base for every other duty.

From your seat: CIO / IT head. Start from your application list and cloud bills. Each system needs an owner, a hosting location and a list of the vendors that touch it.

Example in Manufacturing

Include gate systems, biometric devices, medical centre software, hostel registers and dealer apps.

What the law says

Every duty in Sections 5 to 12 assumes you know where the data is. Rule 6 needs safeguards for each system, and Section 11 needs you to find the data when someone asks. Section 8(5) · Rule 6 · Sections 11–14 · Rule 14 · Section 8(7) · Rule 8 · Section 3

Steps

List systems, then shared drives, email, spreadsheets and paper stores.
For each one, note whose data, which items, purpose, owner, hosting location and vendors.
Add copies: backups, test, analytics.
Get each owner to confirm their rows.
Update it whenever a system is bought or retired.

Evidence to keep

Data inventory
Owner confirmations
Change log

Common mistakes

A 200-column spreadsheet nobody finishes
Leaving out SaaS tools bought by departments
No owner for each row

Can personal data be stored or accessed outside India?

Short answer: Yes, unless a sector rule says otherwise

Under DPDP, yes, unless the government restricts a country, and none had been restricted when this page was last reviewed. A sector rule can be stricter, for example RBI's rule that payment system data must be stored only in India. Remote support access from abroad also counts as data going outside India.

From your seat: CIO / IT head. SaaS tools bought by departments are the usual surprise. Ask Finance for the list of software subscriptions.

Example in Manufacturing

Buyers' social audits, parent company HR systems and telematics platforms may hold data abroad.

What the law says

Section 16 allows transfers unless restricted, and keeps stricter sector laws in force. Rule 15 adds conditions on making data available to foreign states. Section 16 · Rule 15 · Section 8(1)–(2)

Steps

List where each system is hosted and where support teams log in from.
Check sector rules for localisation.
Put location and access terms in cloud and vendor contracts.
Keep the list current; new SaaS tools change it quietly.
Tell people in your notice if data goes abroad.

Evidence to keep

Hosting and access-location list
Contract clauses
Sector rule check

Common mistakes

Forgetting email, CRM and helpdesk SaaS
Ignoring overseas support logins
Assuming 'Indian vendor' means 'data in India'

Does deletion have to reach backups and test copies?

Short answer: Yes, through a written backup-expiry rule

Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.

From your seat: CIO / IT head. Deletion is an engineering task. Decide how each system deletes, how backups expire, and how test copies are masked.

Example in Manufacturing

Gate and attendance servers at plants are often not backed up, or backed up for ever. Match backups to the schedule.

What the law says

Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List where copies live: backups, replicas, test, analytics, laptops, vendors.
Set backup retention to match the retention schedule.
Write a rule: deleted records are not restored into live systems.
Mask personal data in test and training copies.
Get deletion confirmations from vendors.

Evidence to keep

Backup retention settings
Written backup-expiry rule
Masking procedure for test data

Common mistakes

Ten-year backups for convenience
Live copies in test
Restoring old backups and bringing deleted records back

Who should be able to see personal data in our systems?

Short answer: Only those who need it, reviewed every quarter

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

From your seat: CIO / IT head. Role-based access needs application changes as well as policy. Budget for it in the next release cycle.

Example in Manufacturing

Medical records and biometric data need named access. Supervisors get fitness notes, not results.

What the law says

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

Steps

Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Review access every quarter with each manager.
Remove access on the last working day.

Evidence to keep

Role matrix
Quarterly review sign-offs
Leaver removal report

Common mistakes

Generic logins on shared machines
Access that only grows
No review of vendor accounts

Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

From your seat: CIO / IT head. Make sure applications log who viewed a record, not only system errors. That is what a request or a breach review needs.

Example in Manufacturing

Gate, attendance and occupational health systems need logs kept for a year, and ICT logs 180 days in India.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Sync clocks and review alerts every day.

Evidence to keep

Log source list
Retention settings
Alert review records

Common mistakes

Logging only failures, not who viewed a record
Logs stored on the same server they describe
Clocks out of sync, so timelines cannot be built

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: CIO / IT head. Your architecture decisions decide which vendors see data. Prefer designs that send vendors only what they need.

Example in Manufacturing

Manpower agencies, contractors, canteen and medical centre operators, transporters, loyalty and telematics vendors.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

Does ISO 27001 or NIST CSF cover our DPDP duties?

Short answer: They cover security, not the whole Act

They help a great deal with the security part. ISO/IEC 27001 and NIST CSF 2.0 are good evidence of reasonable security safeguards. They do not cover notice, consent, rights, complaints or children's data. ISO/IEC 27701 adds privacy controls, but no certificate replaces the Act.

From your seat: CIO / IT head. Keep the mapping current as systems change. A new system without logging or access control undoes the work.

Example in Manufacturing

ISO 27001 and plant safety audits give evidence for much of Rule 6.

What the law says

Section 8(5) and Rule 6 ask for reasonable security safeguards. A recognised standard is strong evidence of that duty, and only of that duty. Section 8(5) · Rule 6

Steps

Map your current controls to Rule 6.
Add the DPDP-only items: notice, consent, rights, complaints, children, retention.
Use the same evidence for audits and for DPDP.
Include privacy in the scope of your next internal audit.
Consider ISO/IEC 27701 if clients ask for it.

Evidence to keep

Control map
Audit reports
Gap list for DPDP-only items

Common mistakes

Treating a certificate as DPDP compliance
Scope that leaves out the systems with the most personal data
No owner for the non-security duties

The sections you will use most

Section 8(5) · Rule 6: Security safeguards. Biometric attendance, occupational health records and connected-vehicle data need strong access control. Keep plant control networks apart from systems holding personal data.
Section 8(7) · Rule 8: Erasure and retention. Labour Code and safety records stay for the legal period. Biometric templates, gate photos and visitor data of people who left should go much sooner.
Section 16 · Rule 15: Data going outside India. Global buyers' social audits, overseas parent HR systems and telematics platforms may move data abroad. DPDP allows it unless a country is restricted; check contracts and support access.
Section 8(1)–(2): Responsibility for vendors. Manpower agencies, labour contractors, canteen and medical centre operators, transporters, loyalty vendors, telematics vendors and dealer software vendors all work for you on some data.
Section 8(3): Accuracy.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In