Contract workers, gate passes and biometrics: who is responsible for their data?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary
Short answer: You are, for data used at your plant; agencies act for you under contract
Your company decides why contract workers' data is collected at your plant: gate access, attendance, safety and the records the Labour Codes ask for. So for that data you are responsible, even when a manpower agency or contractor collects it. Agencies need a contract with data terms. Collect only what the gate and the law need, and delete biometric templates and photos when a worker leaves.
Why it matters
Section 7 covers purposes of employment and duties under law. Section 8(1) keeps you responsible for processors. Section 8(7) asks for erasure when the purpose is over.
- Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
- Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
- Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.
A worked example
A chemical plant's agency enrols 300 contract workers for a shutdown. Workers get a notice at the gate, the agency signs the data schedule, and when the shutdown ends, fingerprints and gate photos are deleted within a month while the registers the Labour Codes require are kept.
Steps
- List what is collected for each contract worker: ID, photo, biometric, bank details, medical fitness.
- Remove what the gate and the Labour Codes do not need.
- Give a short notice in the worker's language at enrolment.
- Add a data schedule to every agency and contractor contract.
- Delete templates and photos at exit; keep only the registers the law requires.
Evidence to keep
- Enrolment field list with reasons
- Notice in local languages
- Signed agency data schedules
- Exit deletion log
Common mistakes
- Agencies keeping their own copies of Aadhaar cards
- Templates of workers who left years ago
- Worker lists shared with contractors on chat groups
Who does what
- DPO / Privacy lead: Agency workers will make requests too. Make sure the agency's records are part of your answer.
- CISO / Security head: Biometric devices and gate servers must sit away from plant control networks, with named vendor logins.
- HR head: Run contract worker enrolment in one HR system, not in each agency's spreadsheet.
- Legal & compliance: One data schedule for all agencies and contractors saves months.
- Operations head: Gate and shift teams see agency practice first. Report copies and lists that should not exist.
- Plant head / factory manager: Your gate is the collection point. Check the notice, the device and the exit clean-up every month.
- Procurement department: Put the schedule into every new labour contract.
What a good answer from management sounds like
“Every contract worker gets a notice at enrolment. Agencies sign our data schedule. Templates and photos are deleted within a month of exit, and the logs show it.” Effort and time: Medium · 8 to 12 weeks across plants.