Are contract and agency workers our responsibility?

Short answer: Yes, for the data you decide about

Their data is your responsibility when you decide why and how it is used, for example gate passes, attendance, biometrics and safety records. The agency holds payroll and personal files, so your contract with the agency must cover how it protects that data.

What the law says

Section 7(i) covers employment purposes. Section 8(1) and 8(2) make you responsible for processors such as manpower agencies working on your behalf.

Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

List what you hold about contract workers: ID copies, photos, biometrics, attendance, medical fitness.
Decide who is the Data Fiduciary for each item: you or the agency.
Put data terms in every manpower contract.
Give a short notice in the workers' language at the gate or induction.
Delete gate and ID records on a schedule.

Evidence to keep

Contract-worker data list
Agency contracts with data terms
Notice at the gate

Common mistakes

Photocopies of Aadhaar kept in open files
No terms in the agency contract
Biometric data with no deletion date

How it plays out by sector

Banking, financial services and insurance: Branch guards, housekeeping and data entry operators are often agency staff.
IT, ITeS, BPO and GCC: Contractors and consultants placed through agencies need the same access rules as staff.
Central government: ministries and departments: Outsourced data entry operators and MTS staff often handle files.
Public sector undertakings and utilities: Plants and sites have large contract workforces with gate passes and biometrics.
Healthcare and hospitals: Housekeeping, security and ambulance staff are often agency staff.
Manufacturing: Plants often have more contract workers than employees; gate passes, biometrics and medical checks are yours to protect.

From each seat

HR head: You decide what is collected at the gate and in induction. Make sure agency contracts cover the data agencies hold.
Administration department: Guards, housekeeping and drivers are often agency staff. Their ID copies and gate records need care.
HR department: Agree with Admin and agencies who holds which worker records.

What a good answer from management sounds like

“We know what we hold about contract workers. Agency contracts carry data terms, and ID copies are masked and deleted on a schedule.” Effort and time: Light to medium · 4 to 8 weeks.