Employees and the employment basis
Processing for purposes of employment is a legitimate use under the Act. Anything beyond employment needs another basis.
Manufacturing
Your workforce, contract workers, dealers and customers all trust you with their data. The DPDP Act sets the rules.
Manufacturers hold identity documents, wages, biometrics, medical records and CCTV footage for large workforces across plants, plus dealer, customer and warranty data. vDPO helps you map it plant by plant and close the gaps.
The DPDP Act
What it means for manufacturing companies
The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 apply to every organisation that processes digital personal data in India. These are the areas that need the most attention in this sector.
Contract workers
Contract workers’ data often passes through labour contractors. Control what is collected, shared and kept.
Biometrics and monitoring
Biometric attendance, CCTV and vehicle tracking must be necessary, disclosed to workers and protected.
Notices in the right language
Workers must be able to understand the notice. Provide it in the languages used at each plant.
Dealers and customers
Warranty and service data shared with dealers must be limited and protected by contract.
Breaches and ransomware
A breach must be reported to the Data Protection Board of India and the people affected, with a detailed report within 72 hours.
vDPO
What vDPO gives manufacturing companies
Start with the free gap analysis. A client workspace then turns the gaps into an inventory, notices, assessments and registers you can keep up to date.
Gap analysis
Answer 35 questions written for manufacturing companies and get a score, the gaps found and the corrective action for each. Free, with no login.
Start gap analysisPersonal data inventory
Start from a list of the activities, systems and recipients typical of manufacturing companies, then confirm or edit each one.
Privacy notice and retention schedule
A plain-language privacy notice for each group of people, and a retention schedule, written from the inventory.
Data Protection Impact Assessments
Assess new systems and uses of personal data, with questions for manufacturing companies alongside the standard ones.
Risk register
Turn gap analysis answers into risks, and add the risks manufacturing companies commonly face as a starting list.
Breaches, requests and grievances
A breach register with the 72-hour countdown and draft notices, and a log of requests and grievances with their due dates.
What the DPDP Act Means for Manufacturing Companies
Employees and contract workers, biometrics, monitoring, medical records and dealers: how India’s DPDP Act applies to manufacturers.
Read the article