DPDP templates for Manufacturing

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary · PIB · Kerala Factories and Boilers Department (copy of the Rules)

Example only. General information, not legal advice. Replace the text in square brackets with your own details.

Notice wording: Contract worker enrolment at the plant gate

We collect your name, photo, ID proof, contact number, bank details from your agency, fingerprint for attendance, and your medical fitness for the work. We use them to let you into the plant, record attendance and wages, keep you safe, and keep the registers the Labour Codes require.

If your work involves a hazardous process, you will have medical examinations as the law requires. Your results stay with the medical centre. Your supervisor sees only whether you are fit for the task. You can ask to see your own records.

When your work here ends, we delete your fingerprint and gate photo within [30] days and keep only the records the law requires. To ask what we hold, correct it, or complain, contact [Grievance Officer, phone, email]. You may also approach the Data Protection Board of India.

Request and complaint log

Ref	Date in	Person	Type	Records searched	Owner	Reply due	Status
MR-021	03-11-2026	Contract worker (verified)	What do you hold	Gate, attendance, medical centre, agency	DPO team	within published period	Replied day 10
MR-022	05-11-2026	Mason (verified)	Leave loyalty scheme	Loyalty app, payout system	Marketing	within published period	Closed day 3
MR-023	06-11-2026	Employee (verified)	Copy of medical record	Occupational health system	Medical centre	within published period	Given day 4

Retention schedule

Record	Keep for	Why
Labour Code registers and wage records	As the Codes and state rules prescribe	Labour Codes
Health records of workers in hazardous processes	As the OSH Code and state rules prescribe	OSH Code
Biometric templates and gate photos	Short period after exit, then delete	Purpose over
Visitor and driver registers	Short fixed period set by policy	Security
Emergency plan contact lists	Current version; old versions destroyed after review	Chemical rules
Loyalty member data	While active, then a set period after inactivity	Consent
Access and activity logs	At least 1 year; ICT logs 180 days in India	DPDP Rules; CERT-In

Vendor data clause

The Agency shall process personal data of workers deployed at the Company's plant only for deployment, attendance, wages, safety and the records required by law under this Agreement, and for no other purpose. It shall not keep copies of identity documents beyond what the Company's process requires, shall keep reasonable security safeguards, and shall not share worker data with any other party except as the law requires. It shall inform the Company of any personal data breach within [24] hours of becoming aware, help the Company answer workers' requests, and on a worker's exit or on termination, return or delete the personal data not required by law within [30] days and confirm in writing.

Breach notice to affected people

Dear colleague, on [date] we found that our plant gate system was attacked, and your name, photo, phone number and gate pass number may have been seen by an outside party. Your bank details and medical records were not in this system. We have closed the access, restored the system from a clean copy, and informed CERT-In and the Data Protection Board. Please be careful of calls or messages that use your name to ask for money or OTPs; we will never ask for them. For questions, contact [Grievance Officer] or your supervisor.

Evidence these documents create

A dated notice for each collection point
A request register that shows replies on time
An approved retention schedule and deletion log
Signed vendor terms
A breach message ready before you need it