CCTV, biometric attendance and HR files: what a factory must sort out before 13 May 2027

A factory collects more personal data than its owner usually thinks. There is the camera at the gate, the fingerprint or face reader at the time office, the HR file with Aadhaar, PAN and bank details, and the PF, ESI and medical records. Most of it was set up for discipline and wages, with privacy law nowhere in mind.

That changes on 13 May 2027.

On that day most of the Digital Personal Data Protection Rules, 2025 come into force, along with the main sections of the DPDP Act, 2023.

For your own employees, the Act lets you process their data for employment purposes without asking for consent. What it does not excuse is weak security, a slow response to a leak, or keeping data forever.

Checked against the gazette notifications and the Act on 28 October 2026. I am not a lawyer. This is how I read the law as a factory owner, and you should confirm your own set-up with one.

The dates

MeitY published the DPDP Rules as G.S.R. 846(E) on 13 November 2025. A companion notification, G.S.R. 843(E), sets the dates for the Act's own sections. They start in three steps.

1. 13 November 2025: definitions, the Data Protection Board and how it works.
2. 13 November 2026: the rules for consent managers.
3. 13 May 2027: notice, security safeguards, breach intimation, erasure, children's data and the rights of individuals.

Plan for 13 May 2027 unless MeitY notifies a different date.

Do we need workers' consent for biometric attendance?

For your own employees, I think probably not. You still have work to do.

Section 7 of the DPDP Act lists "legitimate uses" where consent is not needed. Clause (i) covers processing for the purposes of employment, and for protecting the employer from loss or liability, with examples such as preventing corporate espionage and keeping trade secrets confidential. Recording attendance so that wages can be paid reads to me like an employment purpose.

Two points are easy to miss.

1. Until 13 May 2027, the older IT Act rules still apply to companies and firms. The 2011 rules on sensitive personal data list biometric information as sensitive and ask for consent in writing before it is collected. The DPDP Act deletes section 43A of the IT Act, the section those rules rest on, from the same 13 May 2027. So a fingerprint system you install this year should still come with written consent.
2. The DPDP Act has no separate "sensitive" category. A fingerprint template gets the same legal protection as a phone number. That does not make it less risky. A leaked password can be changed, but a leaked fingerprint stays leaked for life.

People on your floor who are not your employees need more thought: contract workers, drivers, visitors. Section 7(i) speaks of employment, and whether a contractor's worker is covered is a question for your lawyer. Until you have that answer, give them a written notice of what you record and why.

If anybody under 18 works for you, for example as an apprentice, the Act treats them as a child and has separate rules on parental consent. Ask your lawyer about that case specifically.

CCTV: the gate, the floor and the canteen

Factory cameras record three groups: employees, contract workers and outsiders such as truck drivers and visitors. The law treats them differently, so set the cameras up with that in mind.

1. Put a clear notice at the gate and the time office, in Hindi and English or your local language. Say that the premises are under CCTV, why, and whom to contact with questions.
2. Decide who may watch live and recorded footage, and write those roles down. A camera app on five phones is five ways for footage to leak.
3. Keep cameras out of toilets, changing rooms and rest areas.
4. Set the retention period on purpose. Rule 6(1)(e) asks a Data Fiduciary to keep logs and personal data for one year to detect and investigate unauthorised access, unless another law says otherwise, and Rule 8(3) sets a similar one-year minimum for logs of processing. Many recorders are set to overwrite after a few weeks, depending on disk size. How these rules apply to continuous CCTV is not settled. Decide a period with your lawyer, write it in your CCTV notice, and make the recorder follow it.
5. If footage goes to a vendor's cloud or app, that vendor is your Data Processor, and the contract matters (see below).

Change the default password on every recorder and camera today.

That one is not a legal question, and I would not wait for May to do it.

HR files, payroll and the WhatsApp group

1. List what you hold for each employee: ID proofs, address, bank details, PF and ESI numbers, medical records, photographs.
2. Keep paper files in a locked cupboard. Keep soft copies in one folder that only HR and accounts can open.
3. Stop collecting ID photos on WhatsApp groups. Use one controlled channel, and delete the photos from phones once they are filed.
4. When someone leaves, keep what other laws make you keep (wage, PF and tax records) and erase the rest once its purpose is over. Section 8(7) of the Act says personal data must be erased when the purpose is no longer served, unless a law requires it to be kept.

The PC that runs your attendance or payroll software matters too. If it is on an old version of Windows, read end of support in 2027 for factory PCs and servers as well.

Your vendors: attendance, CCTV and payroll

Rule 6(1)(f) says the contract between you and a Data Processor must provide for reasonable security safeguards. In a factory, the Data Processors are usually the attendance software company, the CCTV cloud or app, the payroll processor and any HR app you use.

Ask each vendor, in writing:

1. Where is our data stored, and in which country?
2. Who at your end can see it, and is that access logged?
3. How quickly will you tell us about a breach on your side? It has to be fast enough for us to meet our own 72 hours.
4. How do we get our data back, and will you delete it when we leave?
5. Will you sign a data processing clause covering these points?

Put the answers into the contract or a short addendum.

If I had to pick one job to start in January, it would be this one. A vendor who will not answer these questions has already told you something.

If something goes wrong: the 72-hour clock

Rule 7 is short and strict. On becoming aware of a personal data breach, you must inform each affected person without delay and inform the Data Protection Board without delay. Within 72 hours, the Board must get a detailed report: what happened, why, what you have done, what you will do to stop it happening again, and what you told the people affected.

In a factory, a breach looks ordinary. A laptop with the salary sheet is stolen from a car. A pen drive with HR files goes missing. A CCTV recorder still on its default password is reached from the internet.

Write a one-page plan now. It should say who decides that something is a breach, who writes to the Board, and who informs the workers.

I would rather spend one hour on that page today than three days arguing about it after a laptop goes missing.

The penalty ceilings in the Act's Schedule are high: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not reporting a breach, and up to ₹50 crore for most other failures. These are upper limits. The Board decides the actual amount case by case.

Before 13 May 2027: a month-by-month plan

Start with the camera app on your own phone. Count how many people in your company have the same app and the same login. That number tells you where to begin.