Skin
Free gap analysis · Manufacturing

DPDP Gap Analysis for Manufacturing Companies

Measure your company’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to manufacturers of industrial, consumer, automotive, electronics, textile, chemical and other goods, and to their plants, warehouses, sales offices and service networks in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the company assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the company identified when it acts as a Data Fiduciary and when as a Data Processor, for example with labour contractors, dealers, service partners and group companies?
03 Are data protection responsibilities defined across HR, plant administration, security, sales and marketing, after-sales service and IT?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Personal Data Inventory and Mapping
05 Has the company identified the personal data it holds about employees, contract workers, visitors, dealers, customers and suppliers’ staff?
06 Has the company documented the purposes for processing personal data, including employment, plant safety, security, sales, warranty, service and marketing?
07 Has the company mapped how personal data flows between HR and payroll, attendance systems, plant systems, dealer and service portals and group systems?
08 Does the company maintain an inventory of systems, devices and vendors that store or process personal data, including at each plant?
09 Has the company identified personal data shared with labour contractors, dealers, service partners, insurers, group companies and authorities?
3. Notices and Legal Basis
10 Does the company give employees, contract workers and visitors a clear privacy notice, in languages they understand?
11 Has the company identified which processing of employee data relies on the legitimate use for purposes of employment and which needs consent?
12 Does the company give customers a clear privacy notice for product registration, warranty, service and marketing?
13 Is consent for marketing to customers and dealers’ customers obtained separately, without pre-ticked boxes, and recorded?
14 Are business contacts at dealers, distributors, suppliers and customers handled with a notice and only for business purposes?
4. Employees, Contract Workers and Workplace Monitoring
15 If biometric attendance or access is used, is it necessary, are templates protected, and is an alternative considered where appropriate?
16 Is CCTV, vehicle tracking and monitoring of company devices limited to safety, security and legitimate business needs, and disclosed to workers?
17 Are medical examinations and occupational health records kept confidential and separate from general HR files?
18 Does the company control how labour contractors collect, share and keep contract workers’ personal data?
19 Does the company identify workers, apprentices or customers under 18 and handle their data with the protections the DPDP Act requires for children?
5. Rights and Retention
20 Can employees, workers and customers obtain a summary of their personal data, correct it and request erasure where the law allows?
21 Does the company have a procedure for verifying, tracking and responding to requests and grievances?
22 Has the company defined retention periods for employee and contract worker records, biometric data, CCTV footage, visitor logs and customer data?
23 Does the company securely erase or destroy personal data, including paper registers and files at plants, when it is no longer required?
24 Can the company implement and verify deletion across its systems, plants, contractors, dealers and Data Processors?
6. Data Security and Breach Management
25 Has the company implemented appropriate technical and organisational security safeguards to protect personal data, across offices and plants?
26 Is access to HR, payroll, biometric and customer data role-based, reviewed and logged?
27 Does the company have documented procedures to detect, investigate, respond to and record personal data breaches?
28 Can the company notify affected individuals and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, Dealers, Connected Products and Cross-Border Processing
29 Does the company assess the data protection practices of vendors, labour contractors, dealers and service partners that handle personal data?
30 Do contracts with Data Processors include provisions for data protection, security, breach reporting and deletion?
31 If the company’s products are connected or collect data about users, has it assessed the personal data they collect and how it is used?
32 Has the company identified personal data processed outside India, for example by group HR systems, global ERP or cloud services, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are HR, plant administration, security, supervisors and sales and service staff trained on handling personal data?
34 Does the company assess privacy risks before introducing new systems, devices, monitoring or connected products, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the company periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.