DPDP for the Software engineering department in Manufacturing

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

1. List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
2. Remove what the gate and the Labour Codes do not need.
3. Give a short notice in the worker's language at enrolment.
4. Add a data schedule to every agency and contractor contract.
5. Delete templates and photos at exit; keep only the registers the law requires.

• Enrolment field list with reasons
• Notice in local languages
• Signed agency data schedules
• Exit deletion log

• Agencies keeping their own copies of Aadhaar cards
• Templates of workers who left years ago
• Worker lists shared with contractors on chat groups

Connected vehicles and smart products send location, usage and driving data, and registration gives you the buyer's contact details. Use it for what the buyer signed up for: warranty, recalls, safety and the services in the app. Sharing with insurers, finance partners or for marketing needs specific consent. Location data shows where people live and go, so keep only what each service needs.

Section 6 needs specific consent for each purpose. Section 5 needs a notice. Section 16 applies if telematics data goes abroad. Section 5 · Rule 3 · Section 6 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 16 · Rule 15 · Sections 11–14 · Rule 14

1. List the data each connected feature sends and why.
2. Show the notice in the app and at delivery, by feature.
3. Ask separately for insurer, partner and marketing sharing.
4. Set retention for location history and trip data.
5. Check where the telematics vendor stores and supports data.

• Feature and data list
• App notice and consent screens
• Retention settings
• Telematics vendor schedule

• Location kept for years by default
• Dealer handing buyer lists to insurers
• Telematics support from abroad with no contract terms

Ask four questions at the design stage: what personal data, why, for how long, and who sees it. Then build in what the Act assumes: a notice, consent where needed, role-based access, logs of record views, a way to delete, and a way to answer requests. Adding these after launch costs far more.

Sections 5 to 12 assume systems that can show notices, record consent, limit access, log, delete and answer requests. Section 5 · Rule 3 · Section 6 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14

1. Add the four questions to design templates.
2. Drop data you do not need.
3. Build access roles and record-view logs.
4. Build deletion and request export.
5. Register the system in the inventory at launch.

• Design review records
• Inventory entries
• Deletion tests

• Privacy review only at launch
• Collecting 'in case we need it'
• No delete function

Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.

Gate and attendance servers at plants are often not backed up, or backed up for ever. Match backups to the schedule.

Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

1. List where copies live: backups, replicas, test, analytics, laptops, vendors.
2. Set backup retention to match the retention schedule.
3. Write a rule: deleted records are not restored into live systems.
4. Mask personal data in test and training copies.
5. Get deletion confirmations from vendors.

• Backup retention settings
• Written backup-expiry rule
• Masking procedure for test data

• Ten-year backups for convenience
• Live copies in test
• Restoring old backups and bringing deleted records back

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

Gate, attendance and occupational health systems need logs kept for a year, and ICT logs 180 days in India.

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List systems holding personal data and what each logs today.
2. Turn on access logging where it is missing.
3. Send logs to one protected store, with at least one year of retention.
4. Keep a copy of ICT logs in India for at least 180 days.
5. Sync clocks and review alerts every day.

• Log source list
• Retention settings
• Alert review records

• Logging only failures, not who viewed a record
• Logs stored on the same server they describe
• Clocks out of sync, so timelines cannot be built

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

Medical records and biometric data need named access. Supervisors get fitness notes, not results.

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

1. Write a role matrix for each key system.
2. Replace shared logins with named accounts.
3. Use multi-factor sign-in for admin and remote access.
4. Review access every quarter with each manager.
5. Remove access on the last working day.

• Role matrix
• Quarterly review sign-offs
• Leaver removal report

• Generic logins on shared machines
• Access that only grows
• No review of vendor accounts

Anyone under 18 is a child under the Act. For a child's data you need verifiable consent from a parent or lawful guardian, and you must not track, behaviourally monitor or show targeted ads to children. Some classes and purposes are exempt under Rule 12 and the Fourth Schedule, for example healthcare to the extent needed to protect the child's health, and educational institutions for their educational work.

Product contests and school promotions may reach children. Parent consent and no targeted ads apply.

Section 9 sets the duties. Rule 10 explains how to verify the parent. Rule 12 and the Fourth Schedule list the exemptions. Section 9 · Rules 10, 12 · Section 6

1. Find where children's data enters: customers, dependants, interns, visitors, scholarships, app sign-ups.
2. Decide whether an exemption in the Fourth Schedule applies to that purpose.
3. Where none applies, add an age question and a parent-consent step.
4. Switch off tracking and targeted ads for under-18 users.
5. Record the decision for each channel.

• Channel-by-channel note on children's data
• Parent-consent records
• Ad and tracking settings

• Assuming 'we are B2B, so no children'
• Using the age 13 or 16 from foreign laws
• Treating a tick-box from the child as parental consent

You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.

Labour Code registers stay for the legal period; biometric templates and gate photos of exited workers can go much sooner.

Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first. Sections 11–14 · Rule 14 · Section 8(7) · Rule 8

1. Log the request and verify identity.
2. Check the retention schedule for each record type involved.
3. Delete what has no legal reason to stay, including copies with vendors and in test systems.
4. Mark what must stay, with the law and the end date.
5. Reply in plain words: what was deleted, what is kept, why and until when.

• Erasure log
• Vendor deletion confirmations
• Reply to the person

• Refusing every erasure request 'because of backups'
• Deleting records a law requires
• Not telling vendors