Heavy industry personal data is mostly workforce data: HR, biometrics, CCTV, contractor and visitor records at scale.
In short
The Act brings notice, purpose limits, security and worker rights to all of it, across every site. Penalties reach ₹250 crore.
What changes for this sub-sector.
Worker and contractor data is personal data; give notice, limit purposes and secure it.
Biometric attendance and access control is intrusive; minimise collection and protect it strongly.
Post notices for CCTV and gate registers, and set a defined retention period.
Handle union, grievance and health-related records with care and tight access.
Support access and correction requests from employees.
Payroll, HRMS and security vendors are processors under contract.
Fix HR notices and biometric handling first.
The readiness check maps HR, biometric and CCTV gaps.
Take the readiness check →