DPDP Insights › Questions › Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?

Farmer Aadhaar authentication at the retailer's PoS: who is responsible for what?

Reviewed by InfraVeritas360 ResearchFirst published 10 October 2026Last reviewed 11 October 2026

Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary

Short answer: The scheme flow is the government's; your own farmer programmes are yours

Subsidised fertiliser is sold through PoS devices at retailers, with Aadhaar-based farmer authentication on iFMS, a government platform built by NIC for the Department of Fertilizers. The scheme decides why farmer identity is collected in that flow. Your company sees sales data from it and supplies the retailers. Treat any farmer-level data you see as personal data, use it only for supply and subsidy work, and never for marketing. For your own farmer meetings, soil testing and agronomy apps, you are the Data Fiduciary with full duties. Get a written legal view on your role.

Why it matters

Section 4 needs a lawful basis for each use. Section 6 needs consent for your own programmes. Section 8(1) and 8(5) apply to any data your staff, dealers or vendors handle for you.

Section 4: Personal data may be processed only for a lawful purpose, either with the person's consent or for one of the legitimate uses listed in Section 7.
Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 5 · Rule 3: When you ask for consent, give a clear notice that stands on its own: what data, for what purpose, how to withdraw consent, how to use the rights and how to complain to the Data Protection Board. For data collected before the Act, a notice is due as soon as reasonably practicable.

A worked example

A fertiliser company's sales team wants to use scheme purchase data for a crop advisory campaign. The DPO says no; the campaign goes only to farmers who joined the company's own app with consent, and dashboard exports now show district totals.

Steps

Write down which farmer data you see from the scheme, and which you collect yourself.
Limit company dashboards and exports to what supply and subsidy work needs.
Remind dealers and retailers not to keep Aadhaar copies or note numbers in registers.
Give a notice and ask consent in your own farmer apps and meetings.
Keep scheme data and marketing data apart in your systems.

Evidence to keep

Written role view
Dashboard access list
Dealer circular
Farmer app notice and consent records

Common mistakes

Using scheme purchase data to target offers
Retailers keeping Aadhaar photocopies
Farmer meeting registers kept for ever

Who does what

DPO / Privacy lead: Own the written role view and keep scheme data out of marketing.
CISO / Security head: Company dashboards and exports from scheme data need access control and logs.
HR head: Train field and sales staff on what scheme data they may not use.
Legal & compliance: Write the role view and get it approved by DPO / Management.
Operations head: Depots and field staff talk to retailers daily. Check that no Aadhaar copies or farmer lists are passed around.
Plant head / factory manager: If your plant runs farmer meetings or soil tests, those registers are yours to protect.
Marketing department: Farmer campaigns use only your own consented lists, never scheme data.

What a good answer from management sounds like

“We have a written view on our role in the scheme. Scheme data is used only for supply and subsidy. Our own farmer apps have a notice and consent, and dealers are told not to keep Aadhaar copies.” Effort and time: Light to medium · 4 to 8 weeks.