Contract worker gate passes and biometrics, visitor registers and CCTV collect data every day. Security agencies and labour contractors often hold the records.
The first four things to sort out
Put notices at gates and camera points.
Delete biometrics when contract workers exit.
Set periods for footage and visitor registers.
Add data terms to security agency contracts.
A worked example
Facilities and physical security department
Township gate register and CCTV review
Week 1Security finds visitor registers kept for years and ID copies taken at the township gate.
Week 2Copying stops; guards check ID and note only what is needed.
Week 3Old registers past the set period are shredded with a record.
AfterNotices go up at gates and camera points, and the security agency contract gets data terms.
Evidence kept
Change note
Shredding record
Notice photo
Contract amendment
See it, note what is needed, and do not copy it.
What others in the sector usually do. Units commonly add data checks to monthly safety and security reviews.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
Oil and gas marketing
Distributor registers and delivery slips with addresses; Subsidy and Aadhaar data in distributor software; Consumer numbers shared with marketing partners
Power generation and transmission
Contract labour gate passes and biometrics; PSU hospital records of employees and families; Township allotment and resident records
Electricity distribution (state discoms)
Smart-meter data held by the meter vendor; Billing files shared with collection agencies; Consumer lists exposed on public bill lookup pages
Transport undertakings (rail PSUs, metro, state road transport)
Passenger lists and reservation charts; Concession passes with ID copies; CCTV and travel-card data
Steel, mining, defence production and heavy industry
Medical surveillance records of workers; Township and school records; Resettlement and compensation records of affected families
State development corporations and boards
Lottery and allotment lists published with full details; Ration and supply records; Old paper files in record rooms
7 questions the Facilities and physical security department asks, answered in full
These hold residents', patients' and students' data. Each needs a notice, access limits and retention. PSU hospital records follow medical record rules; school records may involve children, where Fourth Schedule exemptions for educational institutions and healthcare may apply to some purposes.
Short answer: Yes, with notice, limits and a deletion period
All three are personal data. Put a clear notice where people are recorded, collect only what you need at reception, keep footage and registers for a set period, and protect biometric templates carefully. Do not keep copies of ID documents unless you must.
From your seat: Facilities and physical security department. Notices, retention and viewing rights.
Their data is your responsibility when you decide why and how it is used, for example gate passes, attendance, biometrics and safety records. The agency holds payroll and personal files, so your contract with the agency must cover how it protects that data.
From your seat: Facilities and physical security department. Guard and housekeeping staff data.
Example in PSUs and utilities
Plants and sites have large contract workforces with gate passes and biometrics.
What the law says
Section 7(i) covers employment purposes. Section 8(1) and 8(2) make you responsible for processors such as manpower agencies working on your behalf. Section 7 · Section 8(1)–(2) · Section 8(5) · Rule 6
Steps
List what you hold about contract workers: ID copies, photos, biometrics, attendance, medical fitness.
Decide who is the Data Fiduciary for each item: you or the agency.
Put data terms in every manpower contract.
Give a short notice in the workers' language at the gate or induction.
Short answer: Yes, every vendor that touches personal data
You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.
From your seat: Facilities and physical security department. Security agency contracts.
Example in PSUs and utilities
Distributors, franchisees, meter vendors, ticketing vendors and labour contractors.
Short answer: For the legal or business period, then erase
Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.
From your seat: Facilities and physical security department. Visitor registers and footage periods.
Example in PSUs and utilities
Pension and service records are kept long; consumer records follow legal and business needs.
What the law says
Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.
Evidence to keep
Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates
Common mistakes
'Keep everything forever' because storage is cheap
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Facilities and physical security department. A lost register is a breach.
Example in PSUs and utilities
A leaked consumer list from a distributor is your breach to report.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Short answer: Yes, at every point where you collect data
A notice must tell people, in plain words, what data you collect, why, how they can withdraw consent, how they can use their rights and how they can complain to the Data Protection Board. It has to stand on its own, separate from long terms and conditions, and be shown at the point where data is collected.
From your seat: Facilities and physical security department. Notice at the gate.
Example in PSUs and utilities
LPG booking, new connection forms, ticket counters and bill payment portals each need a notice.
What the law says
Section 5 and Rule 3 ask for a notice that can be understood on its own, with an itemised list of the data and the purpose for each item. Data you already hold from before the Act also needs a notice, as soon as reasonably practicable. Section 5 · Rule 3 · Section 6 · Sections 11–14 · Rule 14
Steps
List every point where personal data comes in: forms, apps, counters, calls, emails, partner feeds.
Write one short notice per collection point, with the data items and purpose side by side.
Add how to withdraw consent, how to make a request and the DPO or contact person's details.
Offer the notice in English and in the languages your consumers actually use.
Keep each version with the date it went live.
Evidence to keep
Screenshots or copies of the notice at each collection point, with dates
Notice version history
Translations, where used
Common mistakes
Hiding the notice inside terms and conditions
One notice for everything, with no link between data items and purposes
Section 8(5) · Rule 6: Security safeguards. Large consumer systems and plant systems both need safeguards; some are protected systems.
Section 8(7) · Rule 8: Erasure and retention. If the State provisions do not apply to an activity, normal DPDP erasure applies after legal retention.
Other rules that sit alongside DPDP
Rule
What it says
What it means alongside DPDP
Source
DPDP Act, Section 2(x) and Article 12 of the Constitution
The Act defines 'State' with the meaning in Article 12. Many PSUs have been treated as 'the State' by courts, depending on government control.
Get a legal view on which activities can rely on Section 7(b), 7(c) and 17(4). Customer-facing commercial work usually follows full duties.
MeitY
CERT-In Directions, 2022
Report specified cyber incidents within six hours; keep ICT logs 180 days in India.
Applies to every PSU.
CERT-In
IT Act, Section 70 and NCIIPC
Systems notified as protected systems come under NCIIPC's critical information infrastructure framework.
Plant control, grid and pipeline systems may be notified; personal data in them follows DPDP too.
NCIIPC
CEA (Cyber Security in Power Sector) Guidelines, 2021
Cyber security requirements for power sector utilities, including incident reporting and supply chain controls.
Power PSUs and discoms can use this evidence for DPDP Rule 6.
Central Electricity Authority
Aadhaar Act, 2016
Aadhaar-linked subsidies such as LPG must store Aadhaar numbers securely and limit sharing.
Distributor systems and counters must not keep Aadhaar copies.
UIDAI
Labour Codes (in force from 21 November 2025)
Registers for workers and contract labour, health and safety records for hazardous work.
Set retention for worker and contract labour records against the codes and state rules.
Ministry of Labour
SEBI LODR Regulations (listed PSUs)
Listed PSUs follow disclosure and governance rules.
Board-level reporting on data protection fits into existing risk committee work.
SEBI
RTI Act, Section 8(1)(j) as amended
Personal information is exempt from RTI disclosure since 13 November 2025.
PSU CPIOs should apply the new wording with reasoned orders.
SFLC.in summary
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
