DPDP for the HR head in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

You hold records for employees and, through agencies, for contract workers who may outnumber them.

Written for: HR head, Manufacturing. Open this seat in the interactive tool

What is different here

The Labour Codes require registers, wages records and medical examinations. Section 7 covers purposes of employment, so most of this needs no consent. The work is limiting access, keeping medical records apart from HR files, and making sure agencies follow the same rules.

The first four things to sort out

Give employees and contract workers a short notice in their language.
Keep medical records with the medical centre, not in HR files.
Add data terms to manpower agency contracts.
Set retention for candidate, ex-employee and ex-contract worker files.

A worked example

HR head

Medical results found in an employee's HR file

Day 1During a transfer, HR notices full blood test results in the personal file.
Day 2The results go back to the medical centre. HR keeps only the fitness certificate.
Week 2All files in the plant are checked; 60 more are corrected.
AfterThe medical centre now sends HR only fit, unfit or restricted with dates.

Evidence kept

File check record
New form
Medical centre instruction

HR needs the decision, not the diagnosis.

What others in the sector usually do. Several plants have moved contract worker enrolment to one HR-run system instead of each agency's spreadsheet.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

9 questions the HR head asks, answered in full

Contract workers, gate passes and biometrics: who is responsible for their data?

Short answer: You are, for data used at your plant; agencies act for you under contract

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

From your seat: HR head. Run contract worker enrolment in one HR system, not in each agency's spreadsheet.

What the law says

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

Steps

List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
Remove what the gate and the Labour Codes do not need.
Give a short notice in the worker's language at enrolment.
Add a data schedule to every agency and contractor contract.
Delete templates and photos at exit; keep only the registers the law requires.

Evidence to keep

Enrolment field list with reasons
Notice in local languages
Signed agency data schedules
Exit deletion log

Common mistakes

Agencies keeping their own copies of Aadhaar cards
Templates of workers who left years ago
Worker lists shared with contractors on chat groups

Worker medical records in hazardous processes: who may see them and how long do we keep them?

Short answer: The worker, the medical team and inspectors; others get only the fitness decision

Under the OSH Code, workers in hazardous processes have pre-employment, periodic and post-exposure medical examinations, and their health records are mandatory and accessible to the worker and to inspectors. Keep these records with the medical centre or occupational health team. HR and supervisors need only the fitness decision. Keep the records for the period the Code and state rules prescribe, then destroy them with a log.

From your seat: HR head. Take medical results out of HR files and keep only the fitness note.

What the law says

Section 7 covers duties under law and purposes of employment, so examinations need no consent. Section 8(5) needs strong safeguards. Section 11 lets the worker ask for a summary. Section 7 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14 · Section 8(1)–(2)

Steps

List where health records sit: medical centre, outsourced clinic, HR files, contractor files.
Move all results to the medical team; give HR a fit, unfit or restricted note.
Restrict access by name and log every opening.
Give workers a simple way to see their own record.
Set retention from the Code and state rules and destroy on schedule.

Evidence to keep

Record location list
Access list and logs
Fitness note format
Retention schedule and destruction log

Common mistakes

Blood and lung test results in HR personal files
Outsourced clinic keeping records with no contract
Contract workers' results held only by the agency

Do we need consent for employee data?

Short answer: Not for employment purposes; yes for anything extra

Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.

From your seat: HR head. Write a one-page employee privacy notice and give it at joining. Keep consent separate for extras like wellness apps or photos.

Example in Manufacturing

OSH Code medical examinations and registers are employment and legal duties; explain them in the worker notice.

What the law says

Section 7(i) covers employment purposes and safeguarding the employer from loss or liability. Notice, security, retention and rights still apply to employees. Section 7 · Section 5 · Rule 3 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14

Steps

List what you collect from staff and why.
Mark which items are employment purposes and which are extra.
Take consent for the extras, separately.
Give staff a short employee privacy notice.
Set retention for ex-employee records.

Evidence to keep

Employee data list with basis
Employee privacy notice
Consent for extras

Common mistakes

A blanket consent clause in the offer letter
Keeping candidate data forever
Sharing staff data with vendors without terms

Are contract and agency workers our responsibility?

Short answer: Yes, for the data you decide about

Their data is your responsibility when you decide why and how it is used, for example gate passes, attendance, biometrics and safety records. The agency holds payroll and personal files, so your contract with the agency must cover how it protects that data.

From your seat: HR head. You decide what is collected at the gate and in induction. Make sure agency contracts cover the data agencies hold.

Example in Manufacturing

Plants often have more contract workers than employees; gate passes, biometrics and medical checks are yours to protect.

What the law says

Section 7(i) covers employment purposes. Section 8(1) and 8(2) make you responsible for processors such as manpower agencies working on your behalf. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6

Steps

List what you hold about contract workers: ID copies, photos, biometrics, attendance, medical fitness.
Decide who is the Data Fiduciary for each item: you or the agency.
Put data terms in every manpower contract.
Give a short notice in the workers' language at the gate or induction.
Delete gate and ID records on a schedule.

Evidence to keep

Contract-worker data list
Agency contracts with data terms
Notice at the gate

Common mistakes

Photocopies of Aadhaar kept in open files
No terms in the agency contract
Biometric data with no deletion date

What about CCTV, visitor registers and biometric attendance?

Short answer: Yes, with notice, limits and a deletion period

All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.

From your seat: HR head. Biometric attendance is the item to watch: who can see templates, how long they are kept, and what happens when someone leaves.

Example in Manufacturing

Plant gates, canteens and hostels have CCTV and biometrics. Put up notices and set short periods.

What the law says

Section 5 needs notice. Section 8(5) needs safeguards. Section 8(7) needs erasure after the purpose. For staff, Section 7(i) can cover security and attendance. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 7

Steps

Put notices at CCTV points and reception, in the local language.
Ask visitors only for name, phone and whom they are meeting, unless security needs more.
Set a period for footage and registers, then delete.
Restrict who can view footage, and log viewing.
Check the vendor contracts for CCTV, guards and attendance systems.

Evidence to keep

Notices in place
Retention settings on the recorder
Viewing log

Common mistakes

Photocopying visitor IDs as routine
Footage kept until the disk fills
Biometric systems with vendor default passwords

How long can we keep personal data?

Short answer: For the legal or business period, then erase

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

From your seat: HR head. Ex-employee files are the usual pile-up. Set a period by record type, with labour-law minimums, and delete after it.

Example in Manufacturing

Set periods from the Labour Codes, the chemical rules and the fertiliser order, record type by record type.

What the law says

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

Steps

List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.

Evidence to keep

Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates

Common mistakes

'Keep everything forever' because storage is cheap
Deleting before the legal minimum
Forgetting email, shared drives and backups

Who needs DPDP training, and what should it cover?

Short answer: Everyone who handles personal data, by role

Everyone who handles personal data needs short, practical training on what to do in their own job. Front-line staff need examples from their counter or desk. Managers need to know the clocks and their own duties. Management needs to know what to ask.

From your seat: HR head. HR runs the joining programme, so DPDP training fits naturally in the first month for every new joiner.

Example in Manufacturing

Train gate staff, supervisors and field sales with plant examples.

What the law says

Section 8(4) and 8(5) ask for appropriate technical and organisational measures. Training is part of showing those measures work. Section 8(5) · Rule 6

Steps

Group staff by what they handle: front line, back office, IT, managers, management.
Write three to five real scenarios for each group.
Keep sessions short: 20 to 30 minutes.
Test with a few questions, and record attendance.
Repeat every year, and at joining.

Evidence to keep

Training plan by group
Attendance and test results
Scenario material

Common mistakes

One long legal lecture for all
Training once and never again
No record of attendance

Staff share personal data on WhatsApp and personal email. What do we do?

Short answer: Yes, this is a common breach; give staff a safer option

Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.

From your seat: HR head. Teams share CVs, salary sheets and ID copies on chat. Give recruiters and payroll an approved way to share.

Example in Manufacturing

Supervisors and contractors share worker lists on chat groups. Give them a better route.

What the law says

Section 8(5) asks for reasonable safeguards. A wrong send is a breach under Section 2(u), and Section 8(6) applies. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

Steps

Ask teams how they actually share files and photos today.
Provide an approved tool for that job.
Set three simple rules: approved tool, no personal accounts, report wrong sends.
Teach the rules with real examples from your own work.
Treat a quick report as good behaviour, not a disciplinary case.

Evidence to keep

Approved-tool policy
Training record
Incident reports of wrong sends

Common mistakes

A ban with no alternative
Punishing people who report
Ignoring group chats with vendors

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: HR head. A leaked salary sheet or ID folder is a breach. Make sure HR knows to call the DPO at once.

Example in Manufacturing

A stolen gate server or a lost medical register is a breach. CERT-In's six hours and the DPDP steps may both apply.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

The sections you will use most

Section 7: Uses allowed without consent. Section 7 covers purposes of employment and duties under law. Attendance, wages, medical examinations required by the OSH Code and emergency plans under the chemical rules rest here, not on consent.
Section 5 · Rule 3: Notice. Gate pass forms, contract worker enrolment, medical check forms, dealer onboarding, loyalty app sign-ups, warranty cards and connected-vehicle apps each need a short notice in the language people use.
Section 8(5) · Rule 6: Security safeguards. Biometric attendance, occupational health records and connected-vehicle data need strong access control. Keep plant control networks apart from systems holding personal data.
Section 8(7) · Rule 8: Erasure and retention. Labour Code and safety records stay for the legal period. Biometric templates, gate photos and visitor data of people who left should go much sooner.
Sections 11–14 · Rule 14: Rights of people. A worker can ask what you hold, including what the agency and medical centre hold for you. A farmer or mason can ask who received his data.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In