Emergency plans with contact lists shared with authorities: is that allowed?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary
Short answer: Yes, for the plan; share only what it needs
Yes. The chemical rules ask the occupier to prepare an on-site emergency plan and share it with the Authority, and crisis groups use plans to prepare district and local plans. Sharing names and phone numbers for this is a duty under law. Share only what the plan needs, keep the list current, and remove people who have left. The rules ask you to inform people outside the site about hazards; they do not ask you to build a register of residents, so keep any such list small.
Why it matters
Section 7 covers duties under law and safety during a disaster. Section 8(3) asks for accurate data when it is shared. Section 8(5) needs safeguards for the copies.
- Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
- Section 8(3): If personal data is used to make a decision about a person, or is shared with another Data Fiduciary, reasonable care must be taken that it is complete, accurate and consistent.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
A worked example
After a six-monthly mock drill, a chemical plant reviews its emergency contact list. Four people who left are removed, home addresses are dropped, and the updated plan goes to the Authority by recorded email.
Steps
- List the personal data in the on-site plan: emergency team, key staff, contractors, authority contacts.
- Remove what the plan does not need, such as home addresses.
- Review the list after every mock drill and when people leave.
- Send the plan to authorities through a channel you can show.
- Keep old versions only as long as needed, then destroy.
Evidence to keep
- Plan contact list with review date
- Mock drill record
- Transmission record
- Old version destruction log
Common mistakes
- Lists with staff who left years ago
- Home addresses and family numbers in the plan
- Copies left on notice boards at the gate
Who does what
- DPO / Privacy lead: This is a legal duty, not consent. Write that in the record of uses.
- CISO / Security head: Plan copies on shared drives need access limits.
- HR head: Send leavers and transfers to the safety team the same week.
- Legal & compliance: Note the rule under which each authority receives the plan.
- Operations head: Shift in-charges are on the list. Tell the safety team when numbers change.
- Plant head / factory manager: You own the on-site plan. Review the list after each six-monthly drill.
- Administration department: Keep gate and control room copies in a closed folder, not on the wall.
What a good answer from management sounds like
“Our emergency contact list is reviewed after each mock drill, carries only what the plan needs, and goes to authorities through a recorded channel.” Effort and time: Light · 2 to 4 weeks.