InfraVeritas360DPDPiqDPDP Insights › Public sector undertakings and utilities
Sector
DPDP for public sector undertakings and utilities
PSUs serve citizens as customers at very large scale: LPG and fuel consumers, electricity and water connections, passengers, and people living in townships. Many PSUs are treated as 'the State' under Article 12 of the Constitution, which the DPDP Act uses for its own definition. Whether the State provisions apply to a given activity needs legal advice; for commercial, customer-facing work, most PSUs plan as a normal Data Fiduciary with full duties.
Open the interactive tool for this sectorTypes of organisation
- Oil and gas marketingLPG consumer records sit with the company and with thousands of distributors. Subsidy is paid through Aadhaar-linked bank accounts. Distributor counters and delivery staff see names, addresses and phone numbers every day.
- Power generation and transmissionCustomer data is limited, but workforce, contract labour, plant access, medical and township data is large. Plant control systems may be critical information infrastructure.
- Electricity distribution (state discoms)Smart meters record when and how much electricity a home uses, which can reveal daily life. Billing, collection and meter data often sit with private vendors and franchisees.
- Transport undertakings (rail PSUs, metro, state road transport)Ticketing, passes and travel cards collect identity, travel history and payment data. CCTV on stations and buses adds more.
- Steel, mining, defence production and heavy industryLarge workforces, townships, schools and hospitals make these PSUs small cities. Defence units add security clearance records.
- State development corporations and boardsHousing boards, industrial development and civil supplies corporations hold applications, allotment lotteries and beneficiary lists.
Whose data you hold
- Consumers and customers
- Employees, retired employees and their families
- Contract workers at plants and sites
- Township residents and patients at PSU hospitals
- Dealers, distributors and franchisees
- Vendors' staff on site
Read it from your seat
- DPO / Privacy leadYou look after data for consumers in the lakhs or crores, held across your own systems and a large network of distributors or franchisees.
- CISO / Security headYou protect both consumer systems and plant or network systems, some of which may be protected systems.
- CIO / IT headYour systems run across head office, regions, plants and partner networks.
- CMD / MDAs CMD, you lead an organisation the public expects to set the standard.
- Board directorAs a board director, you oversee risk in an organisation that serves the public at scale.
- HR headYou hold records for large workforces, retired employees, families and contract labour.
- Legal & complianceThe legal team must answer the first question: are we 'the State' for this activity?
- Operations headField offices, counters and distributor networks handle consumer data daily.
- Unit, plant or region headAt a unit, plant or region, you run sites with workers, contractors and sometimes townships.
- Chief risk officerData protection joins operational and reputational risk in your register.
By department
- IT department
- Administration department
- HR department
- Finance department
- Marketing department
- Customer service department
- Legal department
- Procurement department
Questions specific to this sector
- Is our PSU 'the State' under DPDP, and what changes if it is?
- What about distributors, dealers and franchisees?
- Townships, hospitals and schools run by the PSU: what applies?
Practical examples
Notice, request log, retention schedule, vendor clause and breach notice.
Rules that sit alongside DPDP
| Rule | What it says | What it means alongside DPDP | Source |
|---|---|---|---|
| DPDP Act, Section 2(x) and Article 12 of the Constitution | The Act defines 'State' with the meaning in Article 12. Many PSUs have been treated as 'the State' by courts, depending on government control. | Get a legal view on which activities can rely on Section 7(b), 7(c) and 17(4). Customer-facing commercial work usually follows full duties. | MeitY |
| CERT-In Directions, 2022 | Report specified cyber incidents within six hours; keep ICT logs 180 days in India. | Applies to every PSU. | CERT-In |
| IT Act, Section 70 and NCIIPC | Systems notified as protected systems come under NCIIPC's critical information infrastructure framework. | Plant control, grid and pipeline systems may be notified; personal data in them follows DPDP too. | NCIIPC |
| CEA (Cyber Security in Power Sector) Guidelines, 2021 | Cyber security requirements for power sector utilities, including incident reporting and supply chain controls. | Power PSUs and discoms can use this evidence for DPDP Rule 6. | Central Electricity Authority |
| Aadhaar Act, 2016 | Aadhaar-linked subsidies such as LPG must store Aadhaar numbers securely and limit sharing. | Distributor systems and counters must not keep Aadhaar copies. | UIDAI |
| Labour Codes (in force from 21 November 2025) | Registers for workers and contract labour, health and safety records for hazardous work. | Set retention for worker and contract labour records against the codes and state rules. | Ministry of Labour |
| SEBI LODR Regulations (listed PSUs) | Listed PSUs follow disclosure and governance rules. | Board-level reporting on data protection fits into existing risk committee work. | SEBI |
| RTI Act, Section 8(1)(j) as amended | Personal information is exempt from RTI disclosure since 13 November 2025. | PSU CPIOs should apply the new wording with reasoned orders. | SFLC.in summary |
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.