DPDP by sector
Draft. Awaiting approval.
DPDP for manufacturing units
A manufacturing unit that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Workers and contract labour, attendance, wages and statutory filings, gate and CCTV records.
Where personal data sits
- Gate register and visitor desk
- Attendance machine or register
- HR office (joining forms and wage records)
- CCTV
What Fohrkast maps
- Worker, visitor and dealer names
- Mobile number
- Email address
- Address
- ID numbers collected for identity checks
- Bank details for wages
- CCTV footage and gate photos
- Staff names, phone numbers and salary records
Each use of the data is recorded as a purpose:
- Employment and wages. Keep worker records, mark attendance, pay wages and make the filings the law asks for.
- Gate and site safety. Record visitors at the gate and keep CCTV for site safety.
- Dealer and buyer updates. Send product and price updates to dealers and buyers.
Which duties weigh most
- Decisions and sharing. Data used to make a decision about a person, or shared with another Data Fiduciary, must be complete, accurate and consistent (s.8(3)).
- Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
- Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
- Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).
Sector rules
The sector regulator's rules for a manufacturing unit: not set.
A short case
Case: not set. Figures: not set. Customers: not set.
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.
Next
- Privacy Check: a look at the website's notices, trackers and forms.
- Plans and prices in INR.
- Book a demo.
Not legal advice.