DPDP for the Plant head / factory manager in Manufacturing

Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.

Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 5 · Rule 3

1. List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
2. Remove what the gate and the Labour Codes do not need.
3. Give a short notice in the worker's language at enrolment.
4. Add a data schedule to every agency and contractor contract.
5. Delete templates and photos at exit; keep only the registers the law requires.

• Enrolment field list with reasons
• Notice in local languages
• Signed agency data schedules
• Exit deletion log

• Agencies keeping their own copies of Aadhaar cards
• Templates of workers who left years ago
• Worker lists shared with contractors on chat groups

Under the OSH Code, workers in hazardous processes have pre-employment, periodic and post-exposure medical examinations, and their health records are mandatory and accessible to the worker and to inspectors. Keep these records with the medical centre or occupational health team. HR and supervisors need only the fitness decision. Keep the records for the period the Code and state rules prescribe, then destroy them with a log.

Section 7 covers duties under law and purposes of employment, so examinations need no consent. Section 8(5) needs strong safeguards. Section 11 lets the worker ask for a summary. Section 7 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Sections 11–14 · Rule 14 · Section 8(1)–(2)

1. List where health records sit: medical centre, outsourced clinic, HR files, contractor files.
2. Move all results to the medical team; give HR a fit, unfit or restricted note.
3. Restrict access by name and log every opening.
4. Give workers a simple way to see their own record.
5. Set retention from the Code and state rules and destroy on schedule.

• Record location list
• Access list and logs
• Fitness note format
• Retention schedule and destruction log

• Blood and lung test results in HR personal files
• Outsourced clinic keeping records with no contract
• Contract workers' results held only by the agency

Yes. The chemical rules ask the occupier to prepare an on-site emergency plan and share it with the Authority, and crisis groups use plans to prepare district and local plans. Sharing names and phone numbers for this is a duty under law. Share only what the plan needs, keep the list current, and remove people who have left. The rules ask you to inform people outside the site about hazards; they do not ask you to build a register of residents, so keep any such list small.

Section 7 covers duties under law and safety during a disaster. Section 8(3) asks for accurate data when it is shared. Section 8(5) needs safeguards for the copies. Section 7 · Section 8(3) · Section 8(5) · Rule 6 · Section 8(7) · Rule 8

1. List the personal data in the on-site plan: emergency team, key staff, contractors, authority contacts.
2. Remove what the plan does not need, such as home addresses.
3. Review the list after every mock drill and when people leave.
4. Send the plan to authorities through a channel you can show.
5. Keep old versions only as long as needed, then destroy.

• Plan contact list with review date
• Mock drill record
• Transmission record
• Old version destruction log

• Lists with staff who left years ago
• Home addresses and family numbers in the plan
• Copies left on notice boards at the gate

Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.

Supervisors and contractors share worker lists on chat groups. Give them a better route.

Section 8(5) asks for reasonable safeguards. A wrong send is a breach under Section 2(u), and Section 8(6) applies. Section 8(5) · Rule 6 · Section 8(6) · Rule 7

1. Ask teams how they actually share files and photos today.
2. Provide an approved tool for that job.
3. Set three simple rules: approved tool, no personal accounts, report wrong sends.
4. Teach the rules with real examples from your own work.
5. Treat a quick report as good behaviour, not a disciplinary case.

• Approved-tool policy
• Training record
• Incident reports of wrong sends

• A ban with no alternative
• Punishing people who report
• Ignoring group chats with vendors

Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.

A contract worker's summary should include what the agency and the medical centre hold for you.

Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14

1. Log the request in one register the day it arrives.
2. Verify identity using details you already hold.
3. Search every system, including vendors' copies.
4. Write a plain summary: what data, why it is used, who received it.
5. Send it, and file the request, search notes and reply.

• Request register
• Search notes for each request
• Copy of each reply with date

• Sending raw database dumps
• Forgetting data held by vendors
• No identity check before sending

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A stolen gate server or a lost medical register is a breach. CERT-In's six hours and the DPDP steps may both apply.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan

Everyone who handles personal data needs short, practical training on what to do in their own job. Front-line staff need examples from their counter or desk. Managers need to know the clocks and their own duties. Management needs to know what to ask.

Train gate staff, supervisors and field sales with plant examples.

Section 8(4) and 8(5) ask for appropriate technical and organisational measures. Training is part of showing those measures work. Section 8(5) · Rule 6

1. Group staff by what they handle: front line, back office, IT, managers, management.
2. Write three to five real scenarios for each group.
3. Keep sessions short: 20 to 30 minutes.
4. Test with a few questions, and record attendance.
5. Repeat every year, and at joining.

• Training plan by group
• Attendance and test results
• Scenario material

• One long legal lecture for all
• Training once and never again
• No record of attendance

For every use of personal data you need one basis: consent, or one of the legitimate uses in Section 7, such as a legal duty, employment, a medical emergency, or data a person gave voluntarily for a specific purpose. Anything beyond what the person expects, such as marketing, profiling or sharing with partners, usually needs consent.

Attendance, wages and OSH Code medical examinations rest on employment and legal duty. Loyalty schemes, contests and connected-vehicle sharing need consent.

Section 4 allows processing only with consent or for a legitimate use. Section 6 sets what valid consent looks like. Section 7 lists the uses that need no consent. Section 4 · Section 6 · Section 7

1. List each purpose for which you use personal data.
2. Against each purpose, write the basis: consent or the exact clause of Section 7.
3. Where the basis is consent, check that it was asked separately, with a clear action and no pre-ticked box.
4. Stop or re-paper any purpose with no basis.
5. Review the list whenever a new product, campaign or system starts.

• Purpose and basis register
• Consent records with date, version and channel
• Legal sign-off on each legitimate use relied on

• Treating account terms as consent for marketing
• Bundling several purposes in one tick-box
• Relying on 'legitimate interest', which the Indian Act does not have

All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.

Plant gates, canteens and hostels have CCTV and biometrics. Put up notices and set short periods.

Section 5 needs notice. Section 8(5) needs safeguards. Section 8(7) needs erasure after the purpose. For staff, Section 7(i) can cover security and attendance. Section 5 · Rule 3 · Section 8(5) · Rule 6 · Section 8(7) · Rule 8 · Section 7

1. Put notices at CCTV points and reception, in the local language.
2. Ask visitors only for name, phone and whom they are meeting, unless security needs more.
3. Set a period for footage and registers, then delete.
4. Restrict who can view footage, and log viewing.
5. Check the vendor contracts for CCTV, guards and attendance systems.

• Notices in place
• Retention settings on the recorder
• Viewing log

• Photocopying visitor IDs as routine
• Footage kept until the disk fills
• Biometric systems with vendor default passwords