DPDP Compliance for Manufacturing and MSMEs: Practical, Not Paperwork

Many manufacturers and MSMEs, including the textile and processing units around Bhilwara, assume the DPDP Act is meant only for banks and tech companies. In reality, any business that processes digital personal data is covered. The Act does allow the government to notify exemptions for certain classes of businesses, but unless such an exemption applies to you, the obligations remain.

Personal data a typical factory holds

• Employees and contract workers: Aadhaar, bank details, PF and ESI records, attendance, medical fitness records.
• Biometric attendance and CCTV: Fingerprints, face data and camera footage of workers and visitors.
• Dealers, agents and customers: Names, phone numbers, PAN, GST details of proprietors and addresses in ERP and Tally.
• Visitor and gate registers: Increasingly maintained on tablets or apps.

Common risks

• HR and payroll files shared freely over email and WhatsApp with contractors and consultants.
• Biometric devices and CCTV systems managed by vendors with default passwords.
• ERP access shared among staff, with no review when people leave.
• No retention rule for ex-employee and contract labour records.

A lean DPDP plan for MSMEs

• Prepare a one-page data inventory: employees, workers, dealers, customers, visitors.
• Give workers a simple notice, in Hindi or the local language, explaining why their data and biometrics are collected.
• Change default passwords on CCTV, biometric and ERP systems; give each user a separate login.
• Add data protection clauses to agreements with payroll, security, IT and CCTV vendors.
• Set retention periods for HR and CCTV data and delete what is no longer needed.
• Use business automation to reduce manual data handling: approval workflows, role-based ERP access and automatic deletion schedules make compliance easier and cheaper to sustain.

← Back to all articles · 25 DPDP FAQs