InfraVeritas360DPDPiqDPDP Insights › Public sector undertakings and utilities › Practical examples
Practical examples for PSUs and utilities
Five documents most organisations in this sector need before 13 May 2027.
Examples to adapt, not legal advice. Replace the text in square brackets with your own details.
Notice wording: New LPG or electricity connection
We collect your name, address, phone, ID proof and, for subsidy, Aadhaar-linked bank details to give you a connection, deliver supply, bill you and pay any subsidy. We share them only with your distributor or our authorised agencies for these purposes, and with government where the law requires.
We will not share your details for anyone's marketing without your separate consent.
To see what we hold, correct it, or complain, contact [Grievance Officer, phone, email]. You may also approach the Data Protection Board of India.
Request and complaint log
| Ref | Date | Consumer no. | Request | Partner involved | Owner | Due | Status |
|---|---|---|---|---|---|---|---|
| CR-310 | 01-11-2026 | verified | Marketing calls | Distributor X | DPO team | within published period | Partner stopped; replied |
| CR-311 | 02-11-2026 | verified | Correct address | None | Region office | within published period | Corrected |
| CR-312 | 04-11-2026 | verified | Who has my data | Distributor, payment partner | DPO team | within published period | Replied day 7 |
Retention schedule
| Record | Keep for | Why |
|---|---|---|
| Consumer and connection records | While connected, plus legal and audit period | Service, audit |
| Subsidy payment records | As scheme and audit rules require | Audit |
| Smart-meter raw readings | Only as long as billing and disputes need, then aggregate | Purpose limit |
| Contract worker gate records | Short period after exit, as labour rules allow | Purpose over |
| Access and activity logs | At least 1 year; ICT logs 180 days in India | DPDP Rules; CERT-In |
Vendor data clause
The Distributor shall use consumer personal data received from the Company only to register, supply, deliver to and serve consumers on the Company's behalf, and for no other purpose, including its own or any third party's marketing. It shall keep consumer records secure, shall not keep copies of Aadhaar or ID documents beyond what the Company's process requires, shall report any loss or misuse to the Company within [24] hours, and shall return or delete consumer data when the agreement ends.
Breach notice to affected people
Dear consumer, on [date] we learnt that a list held by your distributor, with your name, address and phone number, was shared without permission. Your Aadhaar and bank details were not included. We have stopped the sharing, informed CERT-In and the Data Protection Board, and taken action with the distributor. If you receive calls claiming to be from us asking for OTPs or payments, please do not respond. For questions, contact [Grievance Officer].