Manufacturing and Smart Devices: A DPDP Act Impact Study

Executive summary

Manufacturers once held little personal data beyond payroll and a dealer list. Now factory gates read fingerprints and faces, cameras cover the floor and connected safety gear tracks workers, while many products leave the plant with a sensor, an app and a cloud account and keep reporting from customers' homes.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 apply from 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the individual it is about; a data processor acts on a fiduciary's behalf.

Headline rating: Overall impact Medium-High. Three of the twelve areas in the Trayambic scorecard are rated High for a typical factory operator, FMCG or consumer durables brand, or industrial IoT and smart-device maker. Connected home devices sit at the top of that range; unconnected goods sold to businesses sit at the bottom.

The three biggest changes:

• Connected products make manufacturers consumer-data businesses. Device setup becomes the notice and consent moment, and anything beyond running and securing the device needs consent that can be refused without disabling it.
• Workforce data has a ground, not a blank cheque. Section 7(i) covers attendance, safety and security, but biometrics, cameras and wearables still need limits and deletion dates. In our view the written-consent rule for biometrics in the 2011 SPDI Rules lapses when s.43A of the IT Act is omitted on 13 May 2027.
• Every link in the chain needs a role. Brand, contract manufacturer, IoT platform, service franchisee and dealer each hold some of the data. The brand cannot contract away its responsibility, and the export exemption in s.17(1)(d) covers only non-residents' data processed under a foreign contract.

Device security rules are tightening too, through CCTV certification and the 2025 telecom conformity rules. They test products, not data practices.

Background

The businesses in scope:

• Factories and contract manufacturers, including electronics manufacturing services firms and export units.
• FMCG and consumer durables brands, with dealer, distributor and service networks.
• Industrial IoT providers: machine monitoring, connected safety equipment and plant analytics.
• Smart-device makers: televisions, air conditioners and appliances, cameras, locks, wearables, trackers and children's watches.

The data principals are permanent, contract and trainee workers, apprentices, job applicants, visitors and truck drivers, buyers and their households, guests in a camera's view, children, individual dealers and distributors, service technicians and suppliers' contact people.

On the shop floor the data includes identity and bank details, attendance templates, CCTV, gate passes, health examination results, accident reports, wearable location and fatigue signals, and operator IDs in machine logs. On the product side it includes warranty registrations, app accounts, device identifiers, telemetry, voice recordings, camera footage, home floor maps from robot cleaners, television viewing histories, health readings and tracker locations.

Typical flows run from device to the maker's cloud, often a third-party IoT platform, and on to the app; from service request to call centre to franchisee; from warranty registration to marketing; and from fingerprint reader to the attendance vendor's cloud to payroll.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.6, 7). Section 7(i) covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability". Section 7(a) covers data voluntarily provided for a specified purpose, such as a warranty registration or service request. Everything else needs consent that is "free, specific, informed, unconditional and unambiguous", with an itemised notice (Rule 3) and withdrawal as easy as giving it. There is no legitimate-interests ground.
• Personal and domestic use (s.3(c)(i)). A household's own use of a camera or speaker is outside the Act.
• Children (s.9; Rules 10, 12). Verifiable parental consent for anyone under 18, and no tracking, behavioural monitoring or targeted advertising directed at children. Under Rule 12(2) and Part B of the Fourth Schedule, those two duties do not apply to processing limited to tracking a child's real-time location for her safety.
• Duties (s.8; Rules 6, 7). Responsibility for processors "irrespective of any agreement to the contrary"; processors only under a valid contract; accuracy where data drives a decision; security safeguards with a year of logs; notice of every breach to each affected person and the Board, with a detailed report within 72 hours; erasure once the purpose is served, including by processors.
• Rights (ss.11 to 13; Rule 14). Access, including the identities of others who received the data, correction and erasure, for data processed on consent or s.7(a). Grievances answered within 90 days at most.
• Export processing (s.17(1)(d)). Where non-residents' data is processed in India under a contract with a person outside India, most of Chapter II, all of Chapter III and s.16 do not apply; s.8(1) and the security duty in s.8(5) still do.

Penalties reach ₹250 crore for security failures and ₹200 crore for breach-notice or children's data failures.

Sector instruments

How sections 38 and 16(2) fit them together

Section 38 makes the DPDP Act additional to these laws and decisive in a conflict. Labour law supplies registers and health records the law requires, which s.8(7) allows to be kept, and notices to authorities covered by s.7(d). A recall order is an order under law, covered by s.7(e). Product-security rules raise the floor for s.8(5) but do not replace it.

No sector law here restricts transfers abroad, and no country is restricted under s.16(1), so device clouds abroad are permitted, subject to any later orders under Rule 15.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

The shop floor: attendance, cameras, wearables and health checks

Section 7(i) gives employers a ground, but Trayambic's article on background checks and employee monitoring explains its limits. The plant-specific points:

• Biometric attendance. Until 13 May 2027, a company collecting fingerprints or face templates needs written consent under the SPDI Rules. After that, in our view, s.7(i) is enough as a ground, but s.8 still applies. Keep templates rather than images, on the reader where possible; delete them when a worker leaves; offer a card for those who cannot enrol; and agree with each labour contractor who holds contract workers' templates. Trayambic's HR tech and staffing study covers contract labour records.
• CCTV. Cameras over stores, gates and hazardous areas fit s.7(i). Keep them out of washrooms, changing rooms and rest areas, keep footage for weeks unless an incident needs it, and give visitors and drivers notice, since they are not employees. Trayambic's real estate study discusses cameras that record non-employees.
• Safety wearables. Proximity-sensing helmets, fall detectors and fatigue monitors serve the employer's safety duties under the OSH Code, which in our view are employment purposes. Their signals are also movement and health data. Collect them only during shifts and inside the plant, and do not reuse them to rate productivity; that use is much harder to fit within s.7(i).
• Health examinations. The Code requires free annual examinations for prescribed employees and notice of occupational diseases. The results are records the law requires, but supervisors need a fitness outcome, not a diagnosis; keep clinical detail with the occupational health centre.
• Night shifts. A woman's consent under s.43 to work before 6 a.m. or after 7 p.m. is a labour-law consent, not DPDP consent. Record it and use it for nothing else.
• Apprentices under 18 need verifiable parental consent under s.9(1).

Products that live in the home

Device setup is where notice and consent happen. Trayambic's automotive study sorts connected-car data into tiers; home devices need a similar split:

• Running and securing the device: account creation, pairing, fault diagnostics, security updates. The buyer provides this to use what she bought, so s.7(a) fits, with a clear notice.
• Optional features: voice control, remote viewing, usage history, family sharing. Each needs its own consent and switch.
• Uses for the maker or others: viewing data for advertising, voice clips for model training, usage data shared with partners. Each needs separate consent, off by default, and refusing must not degrade the device or the warranty, because consent must be "unconditional". Trayambic's article on dark patterns covers consent screens.

The household. Cameras and speakers record family members, domestic workers and guests, not just the account holder. In our view the domestic exclusion in s.3(c)(i) covers the household's own use but not the maker's storage of the stream in its cloud, so security, retention and breach duties attach to that copy. Short default cloud retention and on-device processing reduce the exposure.

Children. A children's GPS watch or connected toy needs verifiable parental consent for the child's account, chats and activity data. Location tracking for safety is exempt from both the parental-consent and tracking duties, but only that: no behavioural profiling and no advertising. A shared television should not build a targeting profile of a child. Wearables that measure health raise issues Trayambic's health-tech impact study covers.

Resale, returns and repair. A traded-in camera or speaker may still hold its previous owner's recordings and account link. Unlink accounts on proof of transfer, wipe devices at intake, and treat repair centres that can see device content as processors.

Security. The CCTV requirements test the product: credentials, encryption, secure boot, signed updates. Section 8(5) also covers the cloud, the app and the support desk, and Rule 6 requires logs for a year. Add a vulnerability disclosure channel and a stated support period, and stop collecting data from devices that no longer get updates. TEC already sets essential requirements for IoT gateways, and the 2025 rules allow security requirements in equipment certification.

Brand, contract maker, platform and service network

Role depends on the dataset:

• The brand is the fiduciary for buyers, app users and warranty data.
• A contract manufacturer is the fiduciary for its own workforce, and the brand's processor when it provisions devices linked to accounts, handles returns or repairs, or touches end-customer data on the brand's instructions.
• An IoT platform running the brand's cloud is a processor. One that pools data across brands or uses it for its own analytics acts as a fiduciary for that use, needs its own ground, and must be named when the brand answers an access request under s.11.
• Service franchisees and call centres working warranty jobs are processors; technicians should see the job, not the customer base. Dealers selling to their own customers are usually separate fiduciaries, as Trayambic's automotive study explains for vehicle dealers.
• Suppliers. Supplier contacts, individual dealers' KYC and worker interviews from social-compliance audits are personal data too.

Recalls. If the Central Consumer Protection Authority orders a recall under s.20(a), contacting buyers is compliance with an order under s.7(e). In a voluntary safety recall, in our view, using warranty contacts falls within the purpose for which buyers registered, but selling them a replacement model does not. Product liability makes serial-to-buyer traceability valuable; keep it for a defined period tied to product life and claims exposure, and record the reasoning.

Export work. An Indian electronics manufacturer repairing devices for a foreign brand's overseas customers, under a contract with that brand, processes non-residents' data within s.17(1)(d). Most fiduciary duties and rights fall away, but s.8(5) security and CERT-In reporting remain. The exemption does not reach Indian buyers' data, the unit's own workforce, or work done under a contract with an Indian company.

Worked example (illustrative): a consumer durables maker

A maker of air conditioners and air purifiers has two plants, one in a special economic zone assembling for a European brand. It employs 2,500 people, 60% through contractors; its connected models run on a white-label IoT cloud; 900 franchisees handle service; and it plans a children's GPS watch.

• Plant. Written biometric consent until May 2027; templates on the reader, deleted within a month of exit; cameras moved away from changing rooms; footage kept 30 days; contractor agreements say who holds contract workers' templates.
• Setup. Account and diagnostics under s.7(a); remote control and usage history as opt-in features; analytics for product planning separately consented and off by default.
• Platform contract. Processing on instructions, no cross-brand pooling, incident notice within hours, deletion on exit.
• Franchisees. Technicians see one job at a time in the service app; customer exports are disabled.
• Children's watch. Parental consent through the parent's account; location for safety only; no advertising or profiling.
• Recall. A purifier fan fault prompts a voluntary recall; warranty contacts are used for the recall notice only.
• Export unit. Repairs for the European brand's overseas customers run under s.17(1)(d), with full security controls.
• An incident. An app interface exposes purifier owners' addresses. The maker reports to CERT-In within six hours, notifies the Board and affected buyers without delay, and files the 72-hour report.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: role map; data inventory for plants and devices; biometric consents; vendor list.
• January to March 2027: setup redesign; contracts; camera and wearable settings; children's product review.
• April to May 2027: returns and repair workflow; rights channel; breach drill with the IoT platform.
• Ongoing: state OSH rules; new telecom security requirements; Rule 15 orders on transfers.

Recommendations

1. 1.Treat device setup as the consent moment, and keep the device working whether or not the buyer agrees to analytics.
2. 2.Draw the role map for brand, contract makers, platforms and service partners, then write it into contracts.
3. 3.Keep shop-floor data to what safety and security need, with deletion dates for templates, footage and wearable signals.
4. 4.Design children's products around parental consent and safety-only tracking.
5. 5.Build unlinking and wiping into every return, trade-in and repair.
6. 6.Treat product-security certification as a floor; s.8(5) also covers the cloud, the app and the support desk.
7. 7.Use s.17(1)(d) only for non-residents' data under foreign contracts, and keep security controls everywhere.

Key takeaways

• Device setup is the notice and consent moment; features and analytics beyond running the device need separate, refusable consent.
• Section 7(i) covers attendance, safety and security, but biometric written consent under the SPDI Rules is required until 13 May 2027.
• The domestic exclusion covers a household's own camera use, not the maker's cloud copy of the stream.
• IoT platforms, contract makers, call centres and franchisees are processors for brand data; any own-use turns them into fiduciaries.
• Section 17(1)(d) helps export units only for non-residents' data under foreign contracts, and security duties still apply.