Manufacturers hold personal data for large workforces: identity documents, wages, fingerprints, medical examinations and hours of CCTV. Add dealers, customers and warranty registrations, and the Digital Personal Data Protection (DPDP) Act touches every plant and office.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every manufacturer that processes digital personal data in India. Here is where manufacturing companies most often have gaps.
1. Employment is a legitimate use, but not a blank cheque
The Act recognises processing for purposes of employment as a legitimate use that does not need consent. That covers payroll, attendance, safety and the records the law requires. It does not cover everything: marketing to employees, or monitoring beyond what the business needs, needs another basis.
2. Contract workers
Contract workers’ identity documents, bank details and attendance often pass through labour contractors, supervisors and messaging apps without controls. Set out in contracts what contractors collect and share, collect documents through one controlled system, and audit contractors.
3. Biometrics
Fingerprint and face data cannot be changed if leaked. If biometric attendance is used, record why it is needed, store templates rather than images where possible, encrypt and restrict them, and delete them when people leave.
4. Monitoring
CCTV, vehicle tracking and monitoring of company devices should be limited to safety, security and real business needs, disclosed to workers, kept out of private areas, and kept only for a set period.
5. Medical records
Medical examinations and occupational health records should stay with the medical officer or a restricted system. HR and supervisors need only fitness outcomes, not diagnoses.
6. Notices people can read
A notice in English pinned at the head office does not inform a worker on the shop floor. Give notices, and training, in the languages used at each plant.
7. Dealers, customers and connected products
Warranty registrations and service requests create customer data that flows to dealers and service partners. Share only what service needs, and bind partners by contract. Connected products and apps can collect usage and location data that customers do not expect: assess them, tell users, and limit collection.
8. Ransomware and breaches
Manufacturers are frequent ransomware targets, and an attack on ERP or HR systems exposes personal data as well as halting production. A breach must be reported to the Data Protection Board of India and the people affected, with a detailed report within 72 hours.
A practical starting point
- Name the person accountable for DPDP compliance, with a contact at each plant.
- Build the inventory plant by plant, including attendance devices and gate registers.
- Bring contract worker data under contract and one controlled system.
- Protect biometric templates and delete them on exit.
- Translate notices into the languages used at each plant.
- Limit what dealers receive and add data protection terms to their contracts.
vDPO’s free DPDP gap analysis for manufacturing companies asks 35 questions written for manufacturers and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you an inventory to start from, notices, DPIAs, a risk register and a breach register.
This article is general information, not legal advice.