DPDP for the Customer service department in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Service teams handle warranty claims, product registration and consumer complaints.

Written for: Customer service department, Manufacturing. Open this seat in the interactive tool

What is different here

Factories hold more personal data than most people think: large workforces and contract labour, gate passes, biometrics, medical checks, dealers and distributors, and in some industries, consumers and farmers. Most of it is collected at the gate, the medical centre and the dealer counter, not in head office. DPDP does not change your safety or labour duties. It asks you to know what you hold about each person, keep it safe, use it only for the reason it was collected, and answer when someone asks.

The first four things to sort out

Log data requests the same day.
Verify identity before sharing.
Recording notice on calls.
Reply inside the published time.

A worked example

Customer service department

A buyer asks who has her vehicle data

CallThe request is logged.
Day 4The team checks the dealer, telematics vendor and insurer sharing.
Day 8She gets a list of recipients and purposes.
AfterShe switches off sharing with the insurer in the app.

Evidence kept

Know every hand-off.

What others in the sector usually do. A privacy tag in the complaint system.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

8 questions the Customer service department asks, answered in full

Connected vehicles and product registration: what can we do with the data?

Short answer: For the service the buyer chose; anything more needs consent

Connected vehicles and smart products send location, usage and driving data, and registration gives you the buyer's contact details. Use it for what the buyer signed up for: warranty, recalls, safety and the services in the app. Sharing with insurers, finance partners or for marketing needs specific consent. Location data shows where people live and go, so keep only what each service needs.

From your seat: Customer service department. Explain sharing settings to buyers who call.

What the law says

Section 6 needs specific consent for each purpose. Section 5 needs a notice. Section 16 applies if telematics data goes abroad. Section 5 · Rule 3 · Section 6 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 16 · Rule 15 · Sections 11–14 · Rule 14

Steps

List the data each connected feature sends and why.
Show the notice in the app and at delivery, by feature.
Ask separately for insurer, partner and marketing sharing.
Set retention for location history and trip data.
Check where the telematics vendor stores and supports data.

Evidence to keep

Feature and data list
App notice and consent screens
Retention settings
Telematics vendor schedule

Common mistakes

Location kept for years by default
Dealer handing buyer lists to insurers
Telematics support from abroad with no contract terms

Dealer, retailer, mason and mechanic loyalty programmes: what do we need?

Short answer: Consent with a clear notice; collect only what rewards need

Loyalty schemes collect names, phone numbers, photos, ID and bank details to pay rewards. Joining is a choice, so this rests on consent with a clear notice. Collect only what rewards and tax rules need, keep bank details in one secure place, and make leaving the scheme easy. The loyalty vendor acts for you. Dealer KYC for appointment is a separate purpose from loyalty.

What the law says

Section 5 needs a notice. Section 6 sets what valid consent is, including easy withdrawal. Section 8(1) covers the loyalty vendor. Section 5 · Rule 3 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List the fields the app and forms collect, and drop what rewards do not need.
Show a short notice at sign-up in the local language.
Keep bank details in the payout system only.
Add a data schedule to the loyalty vendor contract.
Close and delete inactive members' data on a set period.

Evidence to keep

Field list with reasons
Sign-up notice and consent records
Vendor schedule
Inactive member deletion log

Common mistakes

Bank details in spreadsheets sent by email
Field staff enrolling masons without telling them
Loyalty data reused for unrelated offers

Someone asks what data we hold about them. What do we send?

Short answer: Yes, a clear summary, inside the published timeline

Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.

From your seat: Customer service department. Log every request on the day it comes in and route it to the DPO's register.

Example in Manufacturing

A contract worker's summary should include what the agency and the medical centre hold for you.

What the law says

Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14

Steps

Log the request in one register the day it arrives.
Verify identity using details you already hold.
Search every system, including vendors' copies.
Write a plain summary: what data, why it is used, who received it.
Send it, and file the request, search notes and reply.

Evidence to keep

Request register
Search notes for each request
Copy of each reply with date

Common mistakes

Sending raw database dumps
Forgetting data held by vendors
No identity check before sending

How do we handle a privacy complaint within 90 days?

Short answer: Reply within your published period, never beyond 90 days

Publish one clear way to complain, log every complaint, give it an owner and reply within the period you publish, never more than 90 days. People can go to the Data Protection Board only after using your process, so a good process keeps most matters with you.

From your seat: Customer service department. Tag privacy complaints and count the days.

Example in Manufacturing

Workers raise data concerns through supervisors and unions. Log them in the same register, within the 90-day limit.

What the law says

Section 8(10) requires a working grievance process. Rule 14(3) caps the reply time at 90 days. Section 13 says people must use your process before approaching the Board. Section 8(9)–(10) · Rules 9, 14 · Sections 11–14 · Rule 14 · Sections 18–26

Steps

Publish one contact for privacy complaints on your website, app and notices.
Log each complaint with the date, channel and a named owner.
Acknowledge within a few days, and set an internal target well under 90 days.
Find and fix the cause, not just the single case.
Reply in writing and close the entry with the date.

Evidence to keep

Complaint register with dates
Replies sent
Monthly summary to management

Common mistakes

Mixing privacy complaints into general complaints with no tag
No owner, so nobody counts the days
Closing a complaint without fixing the cause

What about call recordings and customer service screens?

Short answer: Yes, with notice, a retention period and masking

Call recordings, chat transcripts and agent screens hold a lot of personal data. Tell callers that calls are recorded and why, keep recordings for a set period, limit who can listen, and mask card numbers and passwords on screen and in recordings.

From your seat: Customer service department. Play the recording notice and pause recording for card details.

Example in Manufacturing

Warranty and service lines record calls; tell callers at the start.

What the law says

Section 5 needs notice, Section 8(5) needs safeguards, and Section 8(7) needs erasure after the purpose. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

Play a short recording notice at the start of calls.
Set a retention period by call type.
Pause recording when card or other sensitive details are given.
Limit replay rights to quality and complaint teams.
Lock agent screens and stop phones on the floor if data is sensitive.

Evidence to keep

Recording notice script
Retention settings
Replay access list

Common mistakes

Recordings kept indefinitely
Card numbers in recordings
Open replay access for all supervisors

Someone asks us to delete their data. Must we?

Short answer: Yes, unless a law requires you to keep it

You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.

From your seat: Customer service department. Explain clearly what can be deleted and what the law requires to be kept.

Example in Manufacturing

Labour Code registers stay for the legal period; biometric templates and gate photos of exited workers can go much sooner.

What the law says

Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first. Sections 11–14 · Rule 14 · Section 8(7) · Rule 8

Steps

Log the request and verify identity.
Check the retention schedule for each record type involved.
Delete what has no legal reason to stay, including copies with vendors and in test systems.
Mark what must stay, with the law and the end date.
Reply in plain words: what was deleted, what is kept, why and until when.

Evidence to keep

Erasure log
Vendor deletion confirmations
Reply to the person

Common mistakes

Refusing every erasure request 'because of backups'
Deleting records a law requires
Not telling vendors

Someone withdraws consent. What has to stop, and how fast?

Short answer: Stop that use quickly, across every system and vendor

Withdrawal must be as easy as giving consent. Once someone withdraws, you and every vendor working for you must stop that use within a reasonable time. What was done before withdrawal stays lawful, and data that a law requires you to keep is kept.

From your seat: Customer service department. Process stop requests the same day and confirm in writing.

Example in Manufacturing

A mason leaves the loyalty scheme in the app. Offers stop, and the vendor closes his account within the set period.

What the law says

Section 6(4) to 6(6) give the right to withdraw at any time, with the same ease, and require processors to stop as well. Section 8(7) then asks for erasure unless a law requires retention. Section 6 · Section 8(7) · Rule 8 · Section 8(1)–(2)

Steps

Give one simple way to withdraw on every channel where consent is taken.
Record the withdrawal against the person and the purpose.
Push the change to every system and vendor that uses that purpose.
Confirm to the person, in writing, what has stopped and what is kept by law.
Check a sample every month to see that the change actually reached every list.

Evidence to keep

Withdrawal log with time stamps
Proof that downstream systems and vendors updated
Confirmation sent to the person

Common mistakes

Withdrawal by email only, while consent was one tap in an app
Stopping in the main system but not in vendor lists
Deleting records a law requires you to keep

Staff share personal data on WhatsApp and personal email. What do we do?

Short answer: Yes, this is a common breach; give staff a safer option

Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.

From your seat: Customer service department. Never send customer data from personal phones or accounts.

Example in Manufacturing

Supervisors and contractors share worker lists on chat groups. Give them a better route.

What the law says

Section 8(5) asks for reasonable safeguards. A wrong send is a breach under Section 2(u), and Section 8(6) applies. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

Steps

Ask teams how they actually share files and photos today.
Provide an approved tool for that job.
Set three simple rules: approved tool, no personal accounts, report wrong sends.
Teach the rules with real examples from your own work.
Treat a quick report as good behaviour, not a disciplinary case.

Evidence to keep

Approved-tool policy
Training record
Incident reports of wrong sends

Common mistakes

A ban with no alternative
Punishing people who report
Ignoring group chats with vendors

The sections you will use most

Sections 11–14 · Rule 14: Rights of people. A worker can ask what you hold, including what the agency and medical centre hold for you. A farmer or mason can ask who received his data.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints. Publish one contact for workers, dealers, farmers and consumers. Reply to grievances within 90 days at the most.
Section 8(3): Accuracy.
Section 5 · Rule 3: Notice. Gate pass forms, contract worker enrolment, medical check forms, dealer onboarding, loyalty app sign-ups, warranty cards and connected-vehicle apps each need a short notice in the language people use.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In