Buyer guides
The DPDP Act for Manufacturers: What Changes for Employee, Customer and Farmer Data
A plain-language guide for operations and IT teams. Not legal advice, but a practical starting point.
Trikaan Research & Engineering4 min read
KEY TAKEAWAYS
- Manufacturers hold more personal data than they think — employees, contractors, customers, visitors, farmers.
- Map what you collect, why, where it lives and who can see it.
- Collect only what you need and keep it only as long as necessary.
- Have contracts with processors and a process for rights requests.
India’s Digital Personal Data Protection Act, 2023 sets out obligations for organisations that process personal data in digital form. Implementing rules and timelines are being phased in. Manufacturers are affected because they hold data about employees, contract workers, customers, vendors, visitors and — for agri businesses — farmers.
This is a practical starting point for operations and IT teams. It is not legal advice; work with your legal advisers on specifics.
Personal data in a typical plant
| Group | Examples |
|---|---|
| Employees | ID, contact, attendance, payroll, bank |
| Contract workers | ID, attendance, skills |
| Customers | Contact persons, addresses |
| Vendors | Contact persons, bank details |
| Visitors and drivers | Name, phone, vehicle, photo |
| Farmers / growers | Name, phone, land, location, photos |
Key ideas in plain language
- Process personal data for a lawful purpose, with notice and consent or a recognised legitimate use.
- Collect only what is needed for that purpose.
- Keep data accurate and protect it with reasonable security safeguards.
- Erase it when the purpose is served, subject to legal retention.
- Notify breaches as required.
- Respond to individuals’ rights requests.
Practical steps
- Build a data inventory by group, purpose and system.
- Review forms and apps to remove unnecessary fields.
- Add clear notices and consent capture where needed — in local languages.
- Set retention periods per record type.
- Put data processing agreements in place with vendors.
- Define a rights-request and grievance process.
- Prepare a breach response procedure.
Farmer data needs extra care
Agri programmes collect location, land and identity data from people who may not be familiar with digital consent. Explain purposes simply, in their language, keep government ID collection optional where possible and mask it, and restrict access to the officers who need it.
Your software vendors
Vendors that host or process your data act on your behalf. Check where data is hosted, how it is secured, which sub-processors are used and whether the vendor uses your data for any other purpose.
Frequently asked questions
Does the DPDP Act apply to employee data?
It applies to digital personal data broadly, including employees; specific treatment depends on the Act and rules — confirm with legal advisers.
Do we need consent for everything?
Not always; the Act recognises certain legitimate uses. Take legal advice on which basis applies.
What should vendors provide?
A data processing agreement, security information, sub-processor list and support for rights requests and breaches.
Is this legal advice?
No. It is a practical overview; consult your legal advisers.
- #DPDP Act manufacturing
- #DPDP compliance
- #personal data protection India
- #data fiduciary obligations
- #employee data privacy
Trikaan Research & Engineering
Trikaan
Written by the researchers and engineers who build Anvaya, ASTR and Seed Track, with input from Trikaan's delivery and engineering teams.
