Field and counter staff and partner staff see consumer data most often. Train them with real examples from counters and delivery.
The first four things to sort out
Train partners as well as staff.
Use counter, delivery and gate examples.
Record attendance and a short test.
Repeat at joining and every year.
A worked example
Training and L&D department
Training distributor counter staff
Month 1L&D runs a short session for distributor staff using counter and delivery examples.
Month 2Staff stop taking Aadhaar photocopies and stop leaving delivery slips in vehicles.
Month 3A short test and a few counter visits confirm the change.
AfterAttendance, test results and visit notes are kept as evidence.
Evidence kept
Attendance
Test results
Visit notes
Train the people at the counter, then go and see.
What others in the sector usually do. PSUs commonly add a DPDP module to distributor training.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
Oil and gas marketing
Distributor registers and delivery slips with addresses; Subsidy and Aadhaar data in distributor software; Consumer numbers shared with marketing partners
Power generation and transmission
Contract labour gate passes and biometrics; PSU hospital records of employees and families; Township allotment and resident records
Electricity distribution (state discoms)
Smart-meter data held by the meter vendor; Billing files shared with collection agencies; Consumer lists exposed on public bill lookup pages
Transport undertakings (rail PSUs, metro, state road transport)
Passenger lists and reservation charts; Concession passes with ID copies; CCTV and travel-card data
Steel, mining, defence production and heavy industry
Medical surveillance records of workers; Township and school records; Resettlement and compensation records of affected families
State development corporations and boards
Lottery and allotment lists published with full details; Ration and supply records; Old paper files in record rooms
7 questions the Training and L&D department asks, answered in full
These hold residents', patients' and students' data. Each needs a notice, access limits and retention. PSU hospital records follow medical record rules; school records may involve children, where Fourth Schedule exemptions for educational institutions and healthcare may apply to some purposes.
Short answer: Everyone who handles personal data, by role
Everyone who handles personal data needs short, practical training on what to do in their own job. Front-line staff need examples from their counter or desk. Managers need to know the clocks and their own duties. Management needs to know what to ask.
From your seat: Training and L&D department. Train by role, with real examples, and record attendance.
Example in PSUs and utilities
Train distributors as well as staff.
What the law says
Section 8(4) and 8(5) ask for appropriate technical and organisational measures. Training is part of showing those measures work. Section 8(5) · Rule 6
Steps
Group staff by what they handle: front line, back office, IT, managers, management.
Write three to five real scenarios for each group.
Short answer: Yes, this is a common breach; give staff a safer option
Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.
From your seat: Training and L&D department. Use wrong-send cases in training.
Example in PSUs and utilities
Field and distributor groups share consumer lists on chat.
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Training and L&D department. Teach the first-hour steps.
Example in PSUs and utilities
A leaked consumer list from a distributor is your breach to report.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Short answer: Yes, a clear summary, inside the published timeline
Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.
From your seat: Training and L&D department. Teach front-line staff to log requests.
Example in PSUs and utilities
Consumers can ask who received their data: distributors, franchisees, payment partners.
What the law says
Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14
Steps
Log the request in one register the day it arrives.
Verify identity using details you already hold.
Search every system, including vendors' copies.
Write a plain summary: what data, why it is used, who received it.
Send it, and file the request, search notes and reply.
Short answer: Not for employment purposes; yes for anything extra
Usually not for normal employment purposes. Section 7(i) lets you process employee data for employment, such as payroll, attendance, safety and preventing corporate espionage. Anything beyond that, such as wellness apps, photos for marketing or sharing with a bank for offers, needs consent.
From your seat: Training and L&D department. Training records are staff data too.
Example in PSUs and utilities
Pension, medical and family records need tight access.
No. A policy shows what an organisation intends. It does not show that the control runs. To show operation you need records: a deletion log, an access review sign-off, a drill report, a sample of requests answered on time. Auditors and regulators look for these.
From your seat: Training and L&D department. Show that training changed behaviour, for example fewer wrong sends.
What the law says
Section 8(4) asks for appropriate technical and organisational measures to ensure compliance. Being able to show those measures work is part of meeting that duty. Section 8(5) · Rule 6 · Section 8(1)–(2)
Steps
For each policy, write the record that would show it working.
Check whether that record exists for the last quarter.
Where it does not, start producing it.
Sample a few records every quarter.
Keep the samples with the policy.
Evidence to keep
Policy-to-record map
Quarterly samples
Gaps and actions
Common mistakes
Approving policies with no record behind them
Showing a policy when asked for evidence
Records that exist only before an audit
The sections you will use most
Section 8(5) · Rule 6: Security safeguards. Large consumer systems and plant systems both need safeguards; some are protected systems.
Other rules that sit alongside DPDP
Rule
What it says
What it means alongside DPDP
Source
DPDP Act, Section 2(x) and Article 12 of the Constitution
The Act defines 'State' with the meaning in Article 12. Many PSUs have been treated as 'the State' by courts, depending on government control.
Get a legal view on which activities can rely on Section 7(b), 7(c) and 17(4). Customer-facing commercial work usually follows full duties.
MeitY
CERT-In Directions, 2022
Report specified cyber incidents within six hours; keep ICT logs 180 days in India.
Applies to every PSU.
CERT-In
IT Act, Section 70 and NCIIPC
Systems notified as protected systems come under NCIIPC's critical information infrastructure framework.
Plant control, grid and pipeline systems may be notified; personal data in them follows DPDP too.
NCIIPC
CEA (Cyber Security in Power Sector) Guidelines, 2021
Cyber security requirements for power sector utilities, including incident reporting and supply chain controls.
Power PSUs and discoms can use this evidence for DPDP Rule 6.
Central Electricity Authority
Aadhaar Act, 2016
Aadhaar-linked subsidies such as LPG must store Aadhaar numbers securely and limit sharing.
Distributor systems and counters must not keep Aadhaar copies.
UIDAI
Labour Codes (in force from 21 November 2025)
Registers for workers and contract labour, health and safety records for hazardous work.
Set retention for worker and contract labour records against the codes and state rules.
Ministry of Labour
SEBI LODR Regulations (listed PSUs)
Listed PSUs follow disclosure and governance rules.
Board-level reporting on data protection fits into existing risk committee work.
SEBI
RTI Act, Section 8(1)(j) as amended
Personal information is exempt from RTI disclosure since 13 November 2025.
PSU CPIOs should apply the new wording with reasoned orders.
SFLC.in summary
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
