Practical DPDP Readiness for Retail and Manufacturing

A fingerprint scanner at the gate. A camera above it. A contract worker's Aadhaar copy in an HR file. None of it looks like customer data, and all of it is personal data under the DPDP Act.

Many manufacturers still wait and watch. We are B2B, they say, so the Act is for consumer companies. It is not. The Act covers any organisation that handles an individual's digital personal data, and a plant handles plenty of it. DPDP Act manufacturing duties start on 13 May 2027, so the time to look is now.

What Two Plant Leaders Said About DPDP Act Manufacturing

In September 2026, Amit Rana and Baidyanath Kumar joined a webinar hosted by Malcolm Gomes, COO of IDfy, and Nikhil Jhanji of IDfy's privacy team. Amit heads security and infrastructure at Page Industries, the Jockey and Speedo licensee. Baidyanath is CISO and DPO at JK Lakshmi Cement, part of JK Organisation. Six DPDP Act manufacturing points stood out.

1. Start with people, not databases

The first step is to identify where the business handles personal data. As Baidyanath points out, this could be an employee record, a driver's phone number in a transporter's register, or a visitor log at the factory gate. These everyday interactions are where DPDP compliance begins.

2. Finding data is only half the job

Technology can help locate personal data, but someone in the business must take responsibility for it. Baidyanath treats DPDP as a business risk and works with business heads to build the data inventory.

3. Keep the data inventory up to date

Amit Rana's team reached out to business teams and partners to understand what data they held, where it was stored, and what kind of personal information it contained. They brought the information into one central repository. The ongoing challenge is keeping it current, especially when vendors also hold personal data.

4. Make vendors accountable too

Vendors may not have the same systems or resources as large manufacturers, but they still need to follow clear rules. Baidyanath points to contracts that specify what data can be used, for what purpose, and when it can be shared. Amit's team checks franchise stores and partners before onboarding them, looking at data minimisation, retention, deletion, sub-processors, and how individuals can exercise their rights.

5. Make privacy a business priority

Amit says his D2C team worries that asking for consent before marketing could affect conversions. His response is straightforward: the law is there to protect individuals, so the customer experience must be designed accordingly. At JK Lakshmi Cement, Baidyanath brings DPDP to the risk committee and appoints privacy champions across teams to make it part of everyday business decisions.

6. Prepare for enforcement, not just the deadline

Malcolm Gomes points out that once the Data Protection Board is operational, organisations will need to respond quickly and provide evidence. With enforcement provisions scheduled to take effect in May 2027, manufacturers need to build readiness into their regular processes rather than treat compliance as a one-time project.

Watch the full session: click here

The Gate: Biometric Data Consent in India and CCTV Data Purpose Limitation

Your attendance system collects biometric data. Your camera records people at work. Both are personal data, and a DPDP Act manufacturing review starts here.

Many plants installed fingerprint scanners for convenience, and most workers have never seen a notice that says what is collected and why. The Act asks for a clear basis and a notice. Some employers will rely on consent, and others on the employment ground. Document the choice, tell workers in their own language, and set a retention period.

CCTV footage kept for safety cannot quietly become a productivity or dispute tool. Under purpose limitation, each extra use needs its own basis and a notice. Decide how long footage is kept.

The HR File: Employee Data Protection and Contract Worker Data

The HR file holds Aadhaar copies, PAN, bank details, and joining forms. A paper form is outside the Act only until someone digitises it, so involve IT, security, and privacy before that happens.

PF, ESI, and gratuity records are personal data too. Reporting them to the government is a legitimate use, so you do not need consent for it. Employees keep their data principal rights to access, correct, and erase their data.

Contract worker data usually reaches you through a staffing agency. In most DPDP Act manufacturing setups, you decide why it is collected, so you are the fiduciary, and the agency acts for you. Put it in the contract: what data, why, only for the agreed purpose, and no disclosure without validation.

Beyond the Gate: Shop Floor Data and Dealer Distributor Data

Productivity data becomes personal data as soon as it's linked to a named employee. Shift logs and safety systems do the same.

In DPDP Act manufacturing, dealer and distributor records matter where they identify individuals. A dealer can be a data fiduciary for its own customers and a processor for you, depending on who decides why the data is collected. Franchise stores are a close case. They sell under your brand, so treat them as part of your risk.

Questions Manufacturers Ask Before They Act

These are the DPDP Act manufacturing questions we hear most.

We Are B2B. Do We Really Need to Prioritise DPDP?

Yes. The Act covers people as well as consumers. Your plant holds data on employees, contract workers, visitors, transporters, and dealers' staff. Baidyanath Kumar does not expect a B2B cement maker to be a significant data fiduciary, but the duties of a fiduciary still apply. Listed companies feel extra pressure to show readiness.

What Is the Minimum We Need to Do?

The DPDP Act manufacturing minimum is five things, all due from 13 May 2027. Find the personal data you hold. Set a basis and a notice for each use. Add privacy terms to vendor contracts. Build a way to answer requests. Have a breach workflow. You can start with one module and add the rest later. The DPDP compliance guide for 2026 and the 90 day implementation guide show the order.

The DPDP implementation guide walks through the work step by step.

We Already Have Security Covered. What Does Privy Add?

Security tools protect and monitor data. DPDP asks other questions. Why do you hold it? Was the person told? Who else has it? How fast can you erase it? What do you tell the Board after a breach? Privy by IDfy adds that privacy layer: notice and consent, data principal requests, vendor accountability, and a breach workflow with evidence. For evaluation criteria, read what a DPDPA compliance platform needs to have in 2026 and IDfy's seven things an ideal DPDP solution should have.

We Already Use DLP, a SOC, and DSPM. Why Another Platform?

You keep them. DLP stops data leaving, a SOC watches for threats, and DSPM shows where data is exposed. Most security tools do not record consent, route an erasure request, or track a vendor's agreement. Privy handles those. Data Discovery & Classification gives you a personal data map, and Third-Party Risk Management keeps staffing agencies, transporters, and dealers in one register.

Can One Platform Bring All of This Together?

For privacy, yes. Privy connects consent, personal data discovery, impact assessments, vendor risk, and incident management in one programme, across 3 pillars and 10 modules. It works alongside your security stack. Many teams start with one module.

How Does Privy Fit With Our Tools, and Can It Integrate?

Ask three questions. What do we already have? What is still missing? Where does a privacy layer fit? Privy fills the gaps and works with your existing tools where integrations are supported, so ask for the list for your stack. Our manufacturing page and the DPDP readiness assessment are good places to start.

Who Is Already Doing This

More than 50 enterprise implementations are in progress with Privy by IDfy, including DPDP Act manufacturing programmes. Manufacturers and consumer brands among them include Page Industries (Jockey), Haier, Toyota, Mother Dairy, CP Plus, and Wakefit. On the retail and food side, they include Shoppers Stop, Jubilant FoodWorks, and Thomas Cook.

Conclusion

DPDP Act manufacturing readiness starts at the gate, not the database. Find the data, give it an owner, hold every vendor to the same accountability, and be ready by 13 May 2027.

To see how Privy by IDfy can map the personal data in your plants, book a demo or write to shivani@idfy.com.