Does this law apply to us?

Yes, even with no retail customers at all.

The Act applies to digital personal data, not to customer data. Your workers, your job applicants and the named contact person at each buyer, supplier and transporter are all individuals.

A unit with three hundred workers and not a single retail customer is squarely inside the Act. This is the most common misreading in an industrial estate.

Your industry, in detail

These nine sit inside the Sector Reference alongside seventeen others, twenty six in all. Each one sets out what is processed in practice, under which provision, where that permission stops, and what the Act actually says in reply to the claims the industry makes.

Do we need worker consent?

Employment is one of the certain legitimate uses under section 7(i). Payroll, attendance, gate passes and access control do not run on consent at all.

Nor is a notice owed. Section 5(1) requires a notice where a request for consent is made under section 6. Here no consent is requested, so no notice duty arises.

Leaning on a signed consent form is actually the weaker position. Consent can be withdrawn at any time with comparable ease. A legitimate use cannot be withdrawn.

Then what do we actually owe?

A legitimate use removes the need to ask. It removes nothing else. Every section 8 obligation still applies, whatever basis you rely on, and these six carry most of the weight.

Biometric attendance and CCTV

The Act has no sensitive data category at all. A fingerprint sits on exactly the same footing as a name, so biometric attendance needs no special permission and no separate form.

Section 7(i) goes further and says so in its own words: processing related to safeguarding the employer from loss or liability is a legitimate use, and it names prevention of corporate espionage and confidentiality of trade secrets as examples. The cameras over a polishing table stand on that provision.

The limits are these. Do not use that footage for something unrelated, do not keep it once the purpose it was taken for has passed, and do not watch a worker outside work.

Exports and sending data abroad

Section 16(1) gives the Central Government a power to restrict transfer to a country it notifies, which means a restriction has to be announced before it bites. You are not required to establish first that a destination is safe.

There is no Indian adequacy decision. If a consultant asks you to produce one under this Act, they are asking for a document the Act does not create.

Two things do sit on top. Section 16(2) preserves any Indian law that already imposes a stricter transfer rule, so sectoral requirements keep their full force. And Rule 15 lets the Government specify requirements about making data available to a foreign State, or to a person or entity under its control.

There is no exemption for a special economic zone. Being outside the customs territory answers a customs question, not this one.

Is there an exemption for small units?

There is no turnover threshold, no headcount threshold and no MSME exemption anywhere in the Act.

Being large cuts the other way. Section 10(1) lets the Government notify a Data Fiduciary as a Significant Data Fiduciary after weighing several factors, among them the volume of data processed, the risk to the rights of individuals, and the security of the State. Being notified brings extra duties, including an annual impact assessment and audit. It adds duties. It never subtracts them.

Penalties

These are ceilings. "May extend to" means at most. They are not per record figures, and the full amount does not attach to every failure.

Three things worth doing this month

One. Find out where copies of worker data actually sit. The answer is usually a supervisor's phone and a WhatsApp group. Identity documents and bank details there have no access control you own, no log anyone reviews, and no realistic way to erase them later.

Two. Turn on full disk encryption centrally and keep the evidence. Rule 6(1) asks for one of encryption, obfuscation, masking or virtual tokens, and on a laptop encryption is both the easiest to apply and the easiest to prove.

Three. Name one person who will answer questions about your data, and publish that name and contact on your website. It costs nothing and it is a direct duty under section 8(9).