DPDP for the Operations head in Manufacturing

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

1. List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
2. Remove what the gate and the Labour Codes do not need.
3. Give a short notice in the worker's language at enrolment.
4. Add a data schedule to every agency and contractor contract.
5. Delete templates and photos at exit; keep only the registers the law requires.

• Enrolment field list with reasons
• Notice in local languages
• Signed agency data schedules
• Exit deletion log

• Agencies keeping their own copies of Aadhaar cards
• Templates of workers who left years ago
• Worker lists shared with contractors on chat groups

Yes. The chemical rules ask the occupier to prepare an on-site emergency plan and share it with the Authority, and crisis groups use plans to prepare district and local plans. Sharing names and phone numbers for this is a duty under law. Share only what the plan needs, keep the list current, and remove people who have left. The rules ask you to inform people outside the site about hazards; they do not ask you to build a register of residents, so keep any such list small.

Section 7 covers duties under law and safety during a disaster. Section 8(3) asks for accurate data when it is shared. Section 8(5) needs safeguards for the copies. Section 7 · Section 8(3) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List the personal data in the on-site plan: emergency team, key staff, contractors, authority contacts.
2. Remove what the plan does not need, such as home addresses.
3. Review the list after every mock drill and when people leave.
4. Send the plan to authorities through a channel you can show.
5. Keep old versions only as long as needed, then destroy.

• Plan contact list with review date
• Mock drill record
• Transmission record
• Old version destruction log

• Lists with staff who left years ago
• Home addresses and family numbers in the plan
• Copies left on notice boards at the gate

Loyalty schemes collect names, phone numbers, photos, ID and bank details to pay rewards. Joining is a choice, so this rests on consent with a clear notice. Collect only what rewards and tax rules need, keep bank details in one secure place, and make leaving the scheme easy. The loyalty vendor acts for you. Dealer KYC for appointment is a separate purpose from loyalty.

Section 5 needs a notice. Section 6 sets what valid consent is, including easy withdrawal. Section 8(1) covers the loyalty vendor. Section 5 · Rule 3 · Section 6 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List the fields the app and forms collect, and drop what rewards do not need.
2. Show a short notice at sign-up in the local language.
3. Keep bank details in the payout system only.
4. Add a data schedule to the loyalty vendor contract.
5. Close and delete inactive members' data on a set period.

• Field list with reasons
• Sign-up notice and consent records
• Vendor schedule
• Inactive member deletion log

• Bank details in spreadsheets sent by email
• Field staff enrolling masons without telling them
• Loyalty data reused for unrelated offers

A notice must tell people, in plain words, what data you collect, why, how they can withdraw consent, how they can use their rights and how they can complain to the Data Protection Board. It has to stand on its own, separate from long terms and conditions, and be shown at the point where data is collected.

Gate pass forms, contract worker enrolment, the medical centre, dealer and mason app sign-ups and warranty cards each need a short notice, in the language people use.

Section 5 and Rule 3 ask for a notice that can be understood on its own, with an itemised list of the data and the purpose for each item. Data you already hold from before the Act also needs a notice, as soon as reasonably practicable. Section 5 · Rule 3 · Section 6 · Sections 11–14 · Rule 14

1. List every point where personal data comes in: forms, apps, counters, calls, emails, partner feeds.
2. Write one short notice per collection point, with the data items and purpose side by side.
3. Add how to withdraw consent, how to make a request and the DPO or contact person's details.
4. Offer the notice in English and in the languages your workers and customers actually use.
5. Keep each version with the date it went live.

• Screenshots or copies of the notice at each collection point, with dates
• Notice version history
• Translations, where used

• Hiding the notice inside terms and conditions
• One notice for everything, with no link between data items and purposes
• Forgetting old data collected before the Act

Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.

A contract worker's summary should include what the agency and the medical centre hold for you.

Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14

1. Log the request in one register the day it arrives.
2. Verify identity using details you already hold.
3. Search every system, including vendors' copies.
4. Write a plain summary: what data, why it is used, who received it.
5. Send it, and file the request, search notes and reply.

• Request register
• Search notes for each request
• Copy of each reply with date

• Sending raw database dumps
• Forgetting data held by vendors
• No identity check before sending

Publish one clear way to complain, log every complaint, give it an owner and reply within the period you publish, never more than 90 days. People can go to the Data Protection Board only after using your process, so a good process keeps most matters with you.

Workers raise data concerns through supervisors and unions. Log them in the same register, within the 90-day limit.

Section 8(10) requires a working grievance process. Rule 14(3) caps the reply time at 90 days. Section 13 says people must use your process before approaching the Board. Section 8(9)–(10) · Rules 9, 14 · Sections 11–14 · Rule 14 · Sections 18–26

1. Publish one contact for privacy complaints on your website, app and notices.
2. Log each complaint with the date, channel and a named owner.
3. Acknowledge within a few days, and set an internal target well under 90 days.
4. Find and fix the cause, not just the single case.
5. Reply in writing and close the entry with the date.

• Complaint register with dates
• Replies sent
• Monthly summary to management

• Mixing privacy complaints into general complaints with no tag
• No owner, so nobody counts the days
• Closing a complaint without fixing the cause

Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.

Supervisors and contractors share worker lists on chat groups. Give them a better route.

Section 8(5) asks for reasonable safeguards. A wrong send is a breach under Section 2(u), and Section 8(6) applies. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

1. Ask teams how they actually share files and photos today.
2. Provide an approved tool for that job.
3. Set three simple rules: approved tool, no personal accounts, report wrong sends.
4. Teach the rules with real examples from your own work.
5. Treat a quick report as good behaviour, not a disciplinary case.

• Approved-tool policy
• Training record
• Incident reports of wrong sends

• A ban with no alternative
• Punishing people who report
• Ignoring group chats with vendors

All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.

Plant gates, canteens and hostels have CCTV and biometrics. Put up notices and set short periods.

Section 5 needs notice. Section 8(5) needs safeguards. Section 8(7) needs erasure after the purpose. For staff, Section 7(i) can cover security and attendance. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 7

1. Put notices at CCTV points and reception, in the local language.
2. Ask visitors only for name, phone and whom they are meeting, unless security needs more.
3. Set a period for footage and registers, then delete.
4. Restrict who can view footage, and log viewing.
5. Check the vendor contracts for CCTV, guards and attendance systems.

• Notices in place
• Retention settings on the recorder
• Viewing log

• Photocopying visitor IDs as routine
• Footage kept until the disk fills
• Biometric systems with vendor default passwords

Call recordings, chat transcripts and agent screens hold a lot of personal data. Tell callers that calls are recorded and why, keep recordings for a set period, limit who can listen, and mask card numbers and passwords on screen and in recordings.

Warranty and service lines record calls; tell callers at the start.

Section 5 needs notice, Section 8(5) needs safeguards, and Section 8(7) needs erasure after the purpose. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. Play a short recording notice at the start of calls.
2. Set a retention period by call type.
3. Pause recording when card or other sensitive details are given.
4. Limit replay rights to quality and complaint teams.
5. Lock agent screens and stop phones on the floor if data is sensitive.

• Recording notice script
• Retention settings
• Replay access list

• Recordings kept indefinitely
• Card numbers in recordings
• Open replay access for all supervisors

You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.

Labour Code registers stay for the legal period; biometric templates and gate photos of exited workers can go much sooner.

Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first. Sections 11–14 · Rule 14 · Section 8(7) · Rule 8

1. Log the request and verify identity.
2. Check the retention schedule for each record type involved.
3. Delete what has no legal reason to stay, including copies with vendors and in test systems.
4. Mark what must stay, with the law and the end date.
5. Reply in plain words: what was deleted, what is kept, why and until when.

• Erasure log
• Vendor deletion confirmations
• Reply to the person

• Refusing every erasure request 'because of backups'
• Deleting records a law requires
• Not telling vendors