DPDP for the Internal audit head in Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Internal audit in manufacturing already tests safety, labour and plant controls. DPDP adds new things to test at each plant: notices at the gate, access to medical records, agency data terms and deletion after exit.

Written for: Internal audit head, Manufacturing. Open this seat in the interactive tool

What is different here

Much of the plant evidence already exists from safety audits, ISO reviews and visits by the labour department, so the useful testing is usually elsewhere. Contract workers' data held by agencies, biometric templates of people who left, and loyalty and farmer lists are where gaps show. Retention cannot be tested against one date, because Labour Code registers, health records and emergency plans each follow their own rule.

The first four things to sort out

Add DPDP lines to the plant audit plan, next to the safety and labour items.
Check who can open health records at two plants.
Read three agency or contractor contracts against the data schedule.
Test one exit: are the worker's template and gate photo gone?

A worked example

Internal audit head

Testing exit deletion at a chemical plant

Week 1Audit picks 20 contract workers who left the plant in the last quarter and checks the gate system, attendance devices and the agency's records for each.
Week 2Twelve have been cleaned up. Eight still have biometric templates and gate photos, and the agency still holds copies of their ID cards.
Week 3The finding goes to DPO / Management with an owner and a date. IT links exit in HRMS to deletion at the devices, and the agency is reminded of its data schedule.
Six monthsAudit retests a fresh sample of leavers and checks the agency's deletion confirmations.

Evidence kept

Sample list of leavers
System and agency check results
Management response with dates
Retest results

Test deletion from the leaver's side, across every place the worker was recorded.

What others in the sector usually do. Many audit teams start by adding a short DPDP section to the plant compliance audit they already run, rather than a separate audit.

Where it usually goes wrong, by organisation type

Organisation type	Hotspots
Chemicals and petrochemicals	Worker health surveillance records; Hazardous goods driver and transporter records; Emergency plan contact lists shared with authorities
Fertilisers	Farmer Aadhaar authentication at retailer PoS; Farmer lists from meetings and agronomy apps; Dealer and retailer KYC records
Automotive and auto components	Connected-vehicle location data; Dealer-shared buyer lists; Mechanic loyalty apps
FMCG and consumer goods	Contest and promotion entries; Retailer app data; Agency-held consumer lists
Steel, metals and mining	Township and hospital records; Contract labour biometrics; Resettlement records
Cement and building materials	Mason loyalty bank details; Driver records; Dealer KYC
Textiles and apparel	Auditor access to worker files; Hostel records; Agency-held worker data
Food processing and dairy	Farmer payment data; Collection centre registers; Consumer complaint records

Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022

DPDP duty	Law	NIST CSF 2.0	ISO/IEC 27001 Annex A	Evidence
Know where personal data is	Section 8(5) · Rule 6	ID.AM-02, ID.AM-07	5.9, 5.12	Inventory of systems and data types, with owner and hosting location
Only the right people get in	Section 8(5) · Rule 6	PR.AA-01, PR.AA-05	5.15, 5.16, 5.18, 8.2	Role matrix, quarterly access review sign-off, leaver removal report
Strong sign-in for admins and remote users	Section 8(5) · Rule 6	PR.AA-03	5.17, 8.5	MFA enforcement report for admin, VPN and email accounts
Encrypt or mask data	Section 8(5) · Rule 6	PR.DS-01, PR.DS-02	8.11, 8.24	Encryption settings for databases, laptops, backups and transfers; masking in test copies
Keep and watch logs	Section 8(5) · Rule 6	PR.PS-04, DE.CM-01, DE.CM-03	8.15, 8.16, 8.17	Log retention settings (one year; 180 days in India for CERT-In), alert rules, NTP source
Backups that restore	Section 8(5) · Rule 6	PR.DS-11, RC.RP-03	8.13, 5.30	Backup schedule, offline copy, last restore test with date and result
Separate networks	Section 8(5) · Rule 6	PR.IR-01	8.20, 8.22	Network diagram showing segments, firewall rule review
Patch and fix weaknesses	Section 8(5) · Rule 6	ID.RA-01	8.8	Vulnerability scan results and closure tracker
Handle incidents and tell people	Section 8(6) · Rule 7	RS.MA-01, RS.CO-02, RS.CO-03	5.24, 5.25, 5.26, 6.8	Incident plan with the 6-hour and 72-hour steps, drill record, contact list
Learn from incidents	Section 8(6) · Rule 7	DE.AE-02, ID.IM-01	5.27, 5.28	Post-incident review and actions closed
Vendors protect data too	Section 8(1)–(2)	GV.SC-05, GV.SC-07	5.19, 5.20, 5.22	Contracts with data terms, vendor review record
Data comes back or is deleted at contract end	Section 8(7) · Rule 8	GV.SC-10	5.20, 8.10	Exit clause and deletion certificate from the vendor
Cloud is set up safely	Section 16 · Rule 15	GV.SC-05, PR.DS-01	5.23	Cloud region list, shared-responsibility note, configuration review
Delete when the purpose is over	Section 8(7) · Rule 8	PR.DS-01	8.10, 7.14	Retention schedule, deletion log, disposal certificates for disks and paper
People know the rules	Section 8(5) · Rule 6	PR.AT-01	6.3	Training attendance and short test results by department
Legal duties are tracked	Section 8(5) · Rule 6	GV.OC-03	5.31, 5.34	Register of laws and rules that apply, reviewed yearly
Roles are named	Section 8(9)–(10) · Rules 9, 14	GV.RR-02	5.2, 5.4	Named owners for each system and each duty, approved by management

Logs, backups and access checklist

Logs. Access and activity logs for systems holding personal data are kept for at least one year (DPDP Rule 6 and Rule 8(3)).
Logs. ICT system logs are kept for 180 days, within India, as the CERT-In Directions of 28 April 2022 require.
Logs. System clocks are synced to the NTP servers of NIC or NPL, or to servers traceable to them, as CERT-In asks.
Clocks. Reportable cyber incidents can be reported to CERT-In within six hours of being noticed.
Clocks. Affected people and the Data Protection Board are told without delay, and the Board gets a detailed report within 72 hours.
Backups. At least one backup copy is offline or immutable, and a full restore was tested in the last six months.
Backups. Backup retention matches the retention schedule, so deleted records do not live on for years in old copies.
Access. Privileged and remote accounts use multi-factor sign-in.
Access. Access rights are reviewed every quarter, and leavers are removed on their last working day.
Access. Shared or generic logins are replaced with named accounts, or are tied to a named person in a register.
Vendors. Vendor remote access is named, time-bound and logged.
Test data. Test and training systems use masked data, not live copies.
OT separation. Gate, attendance, CCTV and medical centre systems are separated from plant control networks.
Biometrics. Biometric templates and gate photos are deleted within a set period after a worker's exit, and the deletion is logged.
Health records. Occupational health records have named access and logs; HR and supervisors see only fitness notes.

10 questions the Internal audit head asks, answered in full

Contract workers, gate passes and biometrics: who is responsible for their data?

Short answer: You are, for data used at your plant; agencies act for you under contract

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

What the law says

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

Steps

List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
Remove what the gate and the Labour Codes do not need.
Give a short notice in the worker's language at enrolment.
Add a data schedule to every agency and contractor contract.
Delete templates and photos at exit; keep only the registers the law requires.

Evidence to keep

Enrolment field list with reasons
Notice in local languages
Signed agency data schedules
Exit deletion log

Common mistakes

Agencies keeping their own copies of Aadhaar cards
Templates of workers who left years ago
Worker lists shared with contractors on chat groups

Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?

Short answer: The scheme flow is the government's; your own farmer programmes are yours

Subsidised fertiliser is sold through PoS devices at retailers, with Aadhaar-based farmer authentication on iFMS, a government platform built by NIC for the Department of Fertilizers. The scheme decides why farmer identity is collected in that flow. Your company sees sales data from it and supplies the retailers. Treat any farmer-level data you see as personal data, use it only for supply and subsidy work, and never for marketing. For your own farmer meetings, soil testing and agronomy apps, you are the Data Fiduciary with full duties. Get a written legal view on your role.

What the law says

Section 4 needs a lawful basis for each use. Section 6 needs consent for your own programmes. Section 8(1) and 8(5) apply to any data your staff, dealers or vendors handle for you. Section 4 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 5 · Rule 3

Steps

Write down which farmer data you see from the scheme, and which you collect yourself.
Limit company dashboards and exports to what supply and subsidy work needs.
Remind dealers and retailers not to keep Aadhaar copies or note numbers in registers.
Give a notice and ask consent in your own farmer apps and meetings.
Keep scheme data and marketing data apart in your systems.

Evidence to keep

Written role view
Dashboard access list
Dealer circular
Farmer app notice and consent records

Common mistakes

Using scheme purchase data to target offers
Retailers keeping Aadhaar photocopies
Farmer meeting registers kept for ever

Can a policy show that a control actually works?

Short answer: No; operation needs records

No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.

From your seat: Internal audit head. Test operation, not existence. Pick five records and trace each one end to end.

What the law says

Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty. Section 8(5) · Rule 6 · Section 8(1)–(2)

Steps

For each policy, write the record that would show it working.
Check whether that record exists for the last quarter.
Where it does not, start producing it.
Sample a few records every quarter.
Keep the samples with the policy.

Evidence to keep

Policy-to-record map
Quarterly samples
Gaps and actions

Common mistakes

Approving policies with no record behind them
Showing a policy when asked for evidence
Records that exist only before an audit

What evidence should exist before management accepts that we are ready?

Short answer: Evidence for each duty, not status colours

Before accepting a readiness statement, management should see evidence for each duty: dated notices, consent records, a request register with replies, signed vendor terms, access review sign-offs, log settings, a breach drill report and a deletion log. A status colour without these is a statement, not evidence.

From your seat: Internal audit head. Ask for the evidence list before you accept any readiness statement.

What the law says

The Act places duties on the Data Fiduciary as an organisation. Management is accountable for whether they are actually met. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(9)–(10) · Rules 9, 14

Steps

List the duties that apply.
For each, name the piece of evidence that would satisfy an auditor.
Ask owners to attach it.
Mark duties without evidence as open, not ready.
Review the list before each management sign-off.

Evidence to keep

Duty-to-evidence list
Attached evidence
Sign-off record

Common mistakes

Accepting 'done' without seeing anything
Counting policies as evidence
One sign-off and no review after

Can management trust the DPDP position it is shown?

Short answer: Only as far as the evidence behind it

Only as far as the evidence behind it. Ask three things: what was actually tested, what rests only on someone's statement, and what was not looked at. A position built from answers alone may describe what people believe, not what happens with the data.

From your seat: Internal audit head. Your report is one of the few independent views management gets. Say what was tested and what was not.

What the law says

Accountability under the Act sits with the organisation; management oversight is how that accountability becomes real. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 10 · Rule 13

Steps

Ask for the position split into tested, stated and not looked at.
Ask for two or three samples you can see.
Ask who reviewed the evidence.
Ask what changed since the last review.
Record the answers in minutes.

Evidence to keep

Position with tested and stated parts
Samples seen
Minutes

Common mistakes

Trusting a single summary slide
No difference between stated and tested
No record of what management saw

How do we put DPDP into the risk register?

Short answer: One line per duty, with owner and evidence

Turn each duty into a risk line with an owner, a control, evidence and a review date. Map controls you already run for your regulator, auditors or certifications, so the same evidence serves several purposes. Track vendor risk separately.

From your seat: Internal audit head. Check that each DPDP line has a control you can actually test.

Example in Manufacturing

Add agency, dealer network and plant system lines.

What the law says

The Act sets duties in Sections 5 to 12. A risk register shows management where each duty stands. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 10 · Rule 13

Steps

List the duties that apply to you.
For each, write the risk in plain words, the control and the owner.
Link existing controls and audits as evidence.
Rate likelihood and impact in your usual way.
Review every quarter with management.

Evidence to keep

Risk register extract
Linked evidence
Quarterly review minutes

Common mistakes

One line saying 'DPDP compliance'
No owners
Evidence that is only a policy document

Which logs must we keep, for how long, and where?

Short answer: At least one year; 180 days of ICT logs in India

Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.

From your seat: Internal audit head. Sample whether logs exist for the period, not just whether logging is switched on.

Example in Manufacturing

Gate, attendance and occupational health systems need logs kept for a year, and ICT logs 180 days in India.

What the law says

Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8

Steps

List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Sync clocks and review alerts every day.

Evidence to keep

Log source list
Retention settings
Alert review records

Common mistakes

Logging only failures, not who viewed a record
Logs stored on the same server they describe
Clocks out of sync, so timelines cannot be built

What must a vendor contract say about personal data?

Short answer: Yes, every vendor that touches personal data

You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.

From your seat: Internal audit head. Pick the three largest vendors and read their contracts against the six things.

Example in Manufacturing

Manpower agencies, contractors, canteen and medical centre operators, transporters, loyalty and telematics vendors.

What the law says

Section 8(1) keeps responsibility with you. Section 8(2) allows a processor only under a valid contract. Rule 6 asks for security terms in that contract. Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(6) · Rule 7 · Section 8(7) · Rule 8

Steps

List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Review the top vendors every year.

Evidence to keep

Vendor register
Signed data-protection schedules
Annual review notes

Common mistakes

Relying on the vendor's standard terms
No incident-notice time
No exit and deletion clause

Who should be able to see personal data in our systems?

Short answer: Only those who need it, reviewed every quarter

Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.

From your seat: Internal audit head. Compare the access list with the HR leavers list.

Example in Manufacturing

Medical records and biometric data need named access. Supervisors get fitness notes, not results.

What the law says

Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6

Steps

Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Review access every quarter with each manager.
Remove access on the last working day.

Evidence to keep

Role matrix
Quarterly review sign-offs
Leaver removal report

Common mistakes

Generic logins on shared machines
Access that only grows
No review of vendor accounts

Something has gone wrong. What happens in the first 72 hours?

Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

From your seat: Internal audit head. Ask for the last drill record and its findings.

Example in Manufacturing

A stolen gate server or a lost medical register is a breach. CERT-In's six hours and the DPDP steps may both apply.

What the law says

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

Steps

Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.

Evidence to keep

Incident plan with clocks
Rehearsal record
Incident log with times of each step

Common mistakes

Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan

The sections you will use most

Section 8(5) · Rule 6: Security safeguards. Biometric attendance, occupational health records and connected-vehicle data need strong access control. Keep plant control networks apart from systems holding personal data.
Section 8(1)–(2): Responsibility for vendors. Manpower agencies, labour contractors, canteen and medical centre operators, transporters, loyalty vendors, telematics vendors and dealer software vendors all work for you on some data.
Section 8(6) · Rule 7: Telling people about a breach. A leaked contractor list or a lost medical file is a breach. Tell affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours. CERT-In's six-hour clock may apply too.
Section 8(7) · Rule 8: Erasure and retention. Labour Code and safety records stay for the legal period. Biometric templates, gate photos and visitor data of people who left should go much sooner.
Section 8(9)–(10) · Rules 9, 14: Contact person and complaints. Publish one contact for workers, dealers, farmers and consumers. Reply to grievances within 90 days at the most.

Other rules that sit alongside DPDP

Rule	What it says	What it means alongside DPDP	Source
Labour Codes (in force from 21 November 2025)	The Code on Wages, 2019, the Industrial Relations Code, 2020, the Code on Social Security, 2020 and the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025. Together they rationalise 29 earlier labour laws.	Worker and contract labour records now follow the codes and the rules under them. Set retention for these records against the codes and state rules, not against the old Acts.	Ministry of Labour and Employment (PIB)
Occupational Safety, Health and Working Conditions Code, 2020	Subsumes earlier Acts including the Factories Act, 1948 and the Contract Labour (Regulation and Abolition) Act, 1970. Requires a free annual health examination for employees where prescribed, licences for those hiring contract labour, and registers kept in the prescribed form, electronically or otherwise.	Gate passes, attendance, contractor registers and medical checks are legal records. DPDP adds access limits, security and deletion when the legal period is over.	India Code; PRS summary
OSH Code: workers in hazardous processes	Pre-employment, periodic and post-exposure medical examinations are mandatory. Health records are mandatory and accessible to employees and inspectors. Hazardous establishments need an on-site emergency plan and six-monthly mock drills.	Health records are among the most sensitive data a plant holds. The worker and the inspector may see them; supervisors and the wider HR team should not.	PIB
Manufacture, Storage and Import of Hazardous Chemical Rules, 1989	Rule 13: the occupier prepares and keeps up to date an on-site emergency plan, with a mock drill every six months and the report made available to the Authority. Rule 14: the Authority prepares the off-site emergency plan. Rule 15: the occupier informs persons outside the site about the hazard and safety measures.	Emergency plans carry names and phone numbers of staff, contractors and authorities. Share them because the law asks, keep them current, and remove people who have left.	Kerala Factories and Boilers Department (copy of the Rules)
Chemical Accidents (Emergency Planning, Preparedness and Response) Rules, 1996	Set up Central, State, District and Local Crisis Groups. The District Crisis Group reviews occupiers' on-site plans while preparing the district off-site plan. The Local Crisis Group prepares the local emergency plan for the industrial pocket, educates the population likely to be affected and answers public inquiries.	Contact lists you give the crisis groups are shared for a legal duty. Send only what the plan needs, through a channel you can show.	FAOLEX (text of the Rules)
Direct Benefit Transfer in fertilisers (Department of Fertilizers)	Sale of all subsidised fertilisers to farmers and buyers is made through Point of Sale (PoS) devices at retail shops. Beneficiaries are identified through documents such as Aadhaar, Kisan Credit Card or Voter ID. Subsidy is released to fertiliser companies on the basis of actual sales by retailers to beneficiaries.	Farmer identity and purchase data move through retailers and a government system. Your company sees part of it. Use what you see only for the scheme and supply work.	Department of Fertilizers
Integrated Fertilizer Management System (iFMS)	A pan-India digital platform developed by NIC for fertiliser DBT. It includes Aadhaar-based farmer authentication at PoS, captures transactions at manufacturing, import and retail points, and subsidy is released after a sale is recorded at the retailer level.	iFMS is the government's system. Company dashboards and exports drawn from it still need access control and logs on your side.	National Informatics Centre
Fertiliser (Control) Order, 1985	Dealers may sell only under an authorisation letter or certificate of registration (clauses 7 and 8). A retail dealer displays daily stock and prices (clause 4) and issues a cash or credit memo in Form M to the purchaser (clause 5). Records and returns in Form N are kept when the Controller directs (clause 35).	Dealer authorisation papers and sale memos are dealer and farmer records. Your dealer KYC files and any farmer details on memos need the same care as other personal data.	Government of Odisha (copy of the Order)
CERT-In Directions, 28 April 2022	Report specified cyber incidents to CERT-In within six hours of noticing them. Keep logs of ICT systems for a rolling 180 days within India. Sync clocks to NIC or NPL time servers, or servers traceable to them.	Applies to plants as well as head office. Keep this clock next to the DPDP breach steps in one plan.	CERT-In