Worker medical records in hazardous processes: who may see them and how long do we keep them?
Reviewed by InfraVeritas360 ResearchFirst published Last reviewed
Sources: DPDP Act, 2023 and DPDP Rules, 2025 (MeitY) · Ministry of Labour and Employment (PIB) · India Code; PRS summary
Short answer: The worker, the medical team and inspectors; others get only the fitness decision
Under the OSH Code, workers in hazardous processes have pre-employment, periodic and post-exposure medical examinations, and their health records are mandatory and accessible to the worker and to inspectors. Keep these records with the medical centre or occupational health team. HR and supervisors need only the fitness decision. Keep the records for the period the Code and state rules prescribe, then destroy them with a log.
Why it matters
Section 7 covers duties under law and purposes of employment, so examinations need no consent. Section 8(5) needs strong safeguards. Section 11 lets the worker ask for a summary.
- Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
- Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
- Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
- Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.
- Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
A worked example
A worker in a hazardous process asks for his lung test results. The medical centre gives him a copy within a week. His supervisor had only ever seen a 'fit with restrictions' note, and the access log shows no one outside the medical team opened the record.
Steps
- List where health records sit: medical centre, outsourced clinic, HR files, contractor files.
- Move all results to the medical team; give HR a fit, unfit or restricted note.
- Restrict access by name and log every opening.
- Give workers a simple way to see their own record.
- Set retention from the Code and state rules and destroy on schedule.
Evidence to keep
- Record location list
- Access list and logs
- Fitness note format
- Retention schedule and destruction log
Common mistakes
- Blood and lung test results in HR personal files
- Outsourced clinic keeping records with no contract
- Contract workers' results held only by the agency
Who does what
- DPO / Privacy lead: A health record leak harms the worker most. Treat it as a priority breach.
- CISO / Security head: The occupational health system needs named accounts, logs and encrypted backups.
- HR head: Take medical results out of HR files and keep only the fitness note.
- Legal & compliance: Write the retention period from the Code and state rules into the schedule.
- Operations head: Supervisors need to know who is fit for a task, not why. Ask for the note, not the report.
- Plant head / factory manager: The medical centre is in your plant. Check who has keys and logins.
- Procurement department: Outsourced clinics and labs need a data schedule.
What a good answer from management sounds like
“Health records stay with the medical team, with named access and logs. HR sees only fitness notes. Workers can see their own records, and contract workers' records are held the same way.” Effort and time: Medium · 6 to 10 weeks.