Draft for founder review. Not yet approved for publication.
Many manufacturers assume data protection law is written for banks and apps. But a plant holds a great deal of personal data, and the Digital Personal Data Protection Act (the DPDP Act) applies to it too.
Where personal data hides in a plant
It is rarely in one system. Look in these places first:
- Employee and contract-worker records, including identity documents.
- Attendance and gate systems, especially where fingerprints or faces are used.
- Camera footage and visitor registers.
- Health and fitness records kept for safety-critical roles.
- Transport, canteen and housing lists.
- Dealer, customer and supplier contact details held by sales and purchase teams.
A sensible order of work
- Make the list. Write down where personal data is held, why, and who owns it. Include every plant and every contractor.
- Question each item. Do you still need it? If not, stop collecting it and plan to delete it.
- Check what people were told. Compare your notices and consent records with what you actually do.
- Look at your suppliers. Payroll processors, security agencies, transport contractors and IT support firms often handle personal data on your behalf.
- Decide who answers. Name the person who handles requests and complaints from individuals.
- Plan for a breach. Agree who decides, who is informed and what is recorded, before it happens.
Traps to avoid
- Treating it as an IT project. Most of the data sits with HR, security and administration.
- Buying a tool before making the list.
- Covering the head office and forgetting the plants.
- Writing policies nobody on the shop floor has read.
Where to start
Pick one plant or one function and do the first two steps properly. The gaps you find there will tell you how much work the rest will be.
This note is general information, not legal advice. Check your obligations with your legal adviser.