DPDP for the Company secretary in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

You prepare the papers the Board of Directors and its audit and risk committees see. DPDP should appear there with evidence, next to the safety and labour compliance items you already report.

Written for: Company secretary, Manufacturing. Open this seat in the interactive tool

What is different here

In manufacturing, most personal data sits at plants and with partners, so a board paper should show plant-level evidence, not only a head office policy. Most manufacturers are unlikely to be notified as Significant Data Fiduciaries, but large consumer and connected-vehicle businesses should prepare for a yearly impact assessment and audit. One incident at a plant can go to CERT-In and the Data Protection Board, so show it as one timeline.

The first four things to sort out

Add DPDP to the audit or risk committee agenda as a standing item.
Record the DPO appointment and reporting line in a resolution.
Minute the evidence seen: agency schedules, health record access, last drill.
Note in the calendar if the company could be notified as an SDF.

A worked example

Company secretary

Minuting DPDP alongside plant compliance

BeforeThe company secretary asks the DPO for a two-page note: agencies without a data schedule, who can open health records at each plant, requests answered on time and the last incident drill.
MeetingA director asks whether supervisors can see medical results. The DPO shows that one plant still needs a fix, with a date.
MinutesThe minutes record the questions asked, the evidence shown and two actions with owners and dates.
Next meetingThe action list is the first item. The plant fix is closed with evidence; the agency action is moved with a reason.

Evidence kept

Committee note
Minutes listing evidence seen
Action tracker

Minutes that list the evidence seen are proof of oversight.

What others in the sector usually do. Many company secretaries start by adding a short DPDP note from the DPO to the plant compliance report that already goes to the audit committee.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

What a good answer from management sounds like

Question to ask	A good answer sounds like	Effort and time
Worker medical records in hazardous processes: who may see them and how long do we keep them?	“Health records stay with the medical team, with named access and logs. HR sees only fitness notes. Workers can see their own records, and contract workers' records are held the same way.”	Medium · 6 to 10 weeks
Contract workers, gate passes and biometrics: who is responsible for their data?	“Every contract worker gets a notice at enrolment. Agencies sign our data schedule. Templates and photos are deleted within a month of exit, and the logs show it.”	Medium · 8 to 12 weeks across plants
What should the board of directors ask management about DPDP?	“DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.”	Light · one agenda item every quarter
Can management trust the DPDP position it is shown?	“The position we see separates what was tested from what was only stated, and we look at samples each quarter.”	Light · each review
Who owns accountability for personal data in practice?	“Every duty and major system has an owner who accepted it in writing, and we review the list when people move.”	Light · 2 to 4 weeks
Do we need a DPO?	“We have named an accountable person with a deputy, published the contact, and that person reports to management every month.”	Light · 2 to 4 weeks
Could we be a Significant Data Fiduciary?	“We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.”	Medium if you are a likely candidate
Something has gone wrong. What happens in the first 72 hours?	“We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.”	Medium · 4 to 8 weeks, then a yearly drill
Police, a court or a regulator asks for someone's data. What do we do?	“All authority requests go through Legal. We check the power, share only what is needed, and keep a log.”	Light · 2 to 3 weeks
How much effort and time will it take to be ready by 13 May 2027?	“We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.”	Programme · six to nine months

10 questions the Company secretary asks, answered in full

Worker medical records in hazardous processes: who may see them and how long do we keep them?

Short answer: The worker, the medical team and inspectors; others get only the fitness decision

Under the OSH Code, workers in hazardous processes have pre-employment, periodic and post-exposure medical examinations, and their health records are mandatory and accessible to the worker and to inspectors. Keep these records with the medical centre or occupational health team. HR and supervisors need only the fitness decision. Keep the records for the period the Code and state rules prescribe, then destroy them with a log.

What the law says

Section 7 covers duties under law and purposes of employment, so examinations need no consent. Section 8(5) needs strong safeguards. Section 11 lets the worker ask for a summary. Section 7 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14 · Section 8(1)–(2)

What a good answer from management sounds like: “Health records stay with the medical team, with named access and logs. HR sees only fitness notes. Workers can see their own records, and contract workers' records are held the same way.” Effort and time: Medium · 6 to 10 weeks.

Steps

List where health records sit: medical centre, outsourced clinic, HR files, contractor files.
Move all results to the medical team; give HR a fit, unfit or restricted note.
Restrict access by name and log every opening.
Give workers a simple way to see their own record.
Set retention from the Code and state rules and destroy on schedule.

Evidence to keep

Record location list
Access list and logs
Fitness note format
Retention schedule and destruction log

Common mistakes

Blood and lung test results in HR personal files
Outsourced clinic keeping records with no contract
Contract workers' results held only by the agency

Contract workers, gate passes and biometrics: who is responsible for their data?

Short answer: You are, for data used at your plant; agencies act for you under contract

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

What the law says

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

What a good answer from management sounds like: “Every contract worker gets a notice at enrolment. Agencies sign our data schedule. Templates and photos are deleted within a month of exit, and the logs show it.” Effort and time: Medium · 8 to 12 weeks across plants.

Steps

List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
Remove what the gate and the Labour Codes do not need.
Give a short notice in the worker's language at enrolment.
Add a data schedule to every agency and contractor contract.
Delete templates and photos at exit; keep only the registers the law requires.

Evidence to keep

Enrolment field list with reasons
Notice in local languages
Signed agency data schedules
Exit deletion log

Common mistakes

Agencies keeping their own copies of Aadhaar cards
Templates of workers who left years ago
Worker lists shared with contractors on chat groups

What should the board of directors ask management about DPDP?

Short answer: Five plain questions, asked every quarter

Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.

From your seat: Company secretary. Put DPDP on the board calendar and minute the questions asked and answers given.

Example in Manufacturing

Ask how contract labour data and health records are protected, plant by plant.

What the law says

The Act places duties on the Data Fiduciary, the organisation itself. Directors oversee whether management has put those duties into practice. Section 8(1)–(2) · Section 8(6) · Rule 7 · Section 10 · Rule 13

What a good answer from management sounds like: “DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.” Effort and time: Light · one agenda item every quarter.

Steps

Ask who is accountable for personal data, by name.
Ask when the breach plan was last rehearsed and what was learnt.
Ask for the list of vendors holding the most personal data.
Ask how many requests and complaints came in, and how fast they were answered.
Ask for the plan to May 2027 with evidence, not colours.

Evidence to keep

Quarterly note to the board
Minutes showing the questions asked
Management responses

Common mistakes

Discussing DPDP once and then never again
Accepting 'IT is handling it'
No date for the breach rehearsal

Can management trust the DPDP position it is shown?

Short answer: Only as far as the evidence behind it

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

From your seat: Company secretary. Minutes should record what evidence the board saw, not only what it was told.

What the law says

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

What a good answer from management sounds like: “The position we see separates what was tested from what was only stated, and we look at samples each quarter.” Effort and time: Light · each review.

Steps

Ask for the position split into tested, stated and not looked at.
Ask for two or three samples you can see.
Ask who reviewed the evidence.
Ask what changed since the last review.
Record the answers in minutes.

Evidence to keep

Position with tested and stated parts
Samples seen
Minutes

Common mistakes

Trusting a single summary slide
No difference between stated and tested
No record of what management saw

Who owns accountability for personal data in practice?

Short answer: Named owners, accepted by them, for each duty

The organisation is accountable under the Act, and management decides who answers for each duty inside it. In practice that means a named owner for each duty and each major system, written down and accepted by that person. An owner whose name was typed in by someone else, without their agreement, is not really an owner.

From your seat: Company secretary. Board-approved roles avoid arguments about who owns what during an incident.

What the law says

Section 8(1) puts responsibility on the Data Fiduciary. Section 8(9) asks for a published contact person. Section 8(1)–(2) · Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “Every duty and major system has an owner who accepted it in writing, and we review the list when people move.” Effort and time: Light · 2 to 4 weeks.

Steps

List duties and major systems.
Propose an owner for each.
Ask each owner to accept in writing.
Publish the overall contact person.
Review owners when people move.

Evidence to keep

Owner register with acceptances
Published contact
Review dates

Common mistakes

Owners assigned without telling them
One person owning everything
Owners who left the organisation

Do we need a DPO?

Short answer: Not required by law unless notified as an SDF, but name one person

Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.

From your seat: Company secretary. Record the appointment and the reporting line in a board or committee resolution.

Example in Manufacturing

Name one DPO across plants, with a contact person at each plant.

What the law says

Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13

What a good answer from management sounds like: “We have named an accountable person with a deputy, published the contact, and that person reports to management every month.” Effort and time: Light · 2 to 4 weeks.

Steps

Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Review the role if you are notified as an SDF.

Evidence to keep

Appointment letter
Published contact
Monthly report

Common mistakes

Giving the job to IT as a side task
A contact email nobody reads
No authority to make changes

Could we be a Significant Data Fiduciary?

Short answer: Only by notification; none notified yet

Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.

From your seat: Company secretary. If notified, the board will need to see the impact assessment and audit each year.

Example in Manufacturing

Most manufacturers are unlikely candidates, but large consumer and connected-vehicle businesses should prepare.

What the law says

Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15

What a good answer from management sounds like: “We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.” Effort and time: Medium if you are a likely candidate.

Steps

Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Identify an auditor you could appoint.
Watch MeitY notifications.

Evidence to keep

Volume and sensitivity note
Trial impact assessment
Board note

Common mistakes

Assuming 'not notified' means 'never'
Waiting for notification to start
Thinking only tech companies will be notified

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Company secretary. Know when the board must be told about an incident, and who tells it.

Example in Manufacturing

A stolen gate server or a lost medical register is a breach. CERT-In's six hours and the DPDP steps may both apply.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.” Effort and time: Medium · 4 to 8 weeks, then a yearly drill.

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

Police, a court or a regulator asks for someone's data. What do we do?

Short answer: Yes, when the request is lawful and in writing

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

From your seat: Company secretary. Authority requests that reach the secretarial team need the same log as others.

Example in Manufacturing

Labour inspectors, factory inspectors, police and crisis groups ask for records. Log each request and the law it uses.

What the law says

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6

What a good answer from management sounds like: “All authority requests go through Legal. We check the power, share only what is needed, and keep a log.” Effort and time: Light · 2 to 3 weeks.

Steps

Route every such request to Legal.
Check the authority, the legal power and the scope.
Share only what is asked, by a secure method.
Log the request, what was sent, by whom and when.
Tell the person, unless the law or the authority says you must not.

Evidence to keep

Authority request log
Copies of requests
Record of what was sent

Common mistakes

Sharing on a phone call
Sending whole files when a few lines were asked
No log

How much effort and time will it take to be ready by 13 May 2027?

Short answer: Six to nine months of steady work for most

For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.

From your seat: Company secretary. A dated plan, approved by the board, makes progress easy to review.

Example in Manufacturing

Many sites and partners make the work wide, not deep. Start with one pilot plant.

What the law says

Most duties under the DPDP Rules start on 13 May 2027. Section 8(5) · Rule 6 · Section 8(1)–(2) · Sections 11–14 · Rule 14

What a good answer from management sounds like: “We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.” Effort and time: Programme · six to nine months.

Steps

Month 1: name the owner, set a budget line, start the inventory.
Months 2 to 3: notices, consent records, contact person, request register.
Months 3 to 6: vendor contracts, access control, logs, retention schedule.
Months 6 to 8: breach rehearsal, training, internal review.
Month 9: management review with evidence.

Evidence to keep

Programme plan with owners
Monthly status with evidence
Management minutes

Common mistakes

Leaving it to the last quarter
Buying a tool before knowing the gaps
Status colours with no evidence behind them

The sections you will use most

Section 8(6) · Rule 7: Telling people about a breach. A leaked contractor list or a lost medical file is a breach. Tell affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours. CERT-In's six-hour clock may apply too.
Section 10 · Rule 13: Significant Data Fiduciaries.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints. Publish one contact for workers, dealers, farmers and consumers. Reply to grievances within 90 days at the most.
Sections 18–26: The Data Protection Board.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In