Sector reference
DPDP for Cooperatives, Dairy and Agri Processing
- What is processed
- Member and producer records, collection and quality readings tied to a member number, payment and bank details, veterinary and cattle records held against a member's name, and the staff who run the society.
Why it is allowed, and when
A society holds member data to run the membership and to pay for what the member supplies, which is the purpose the member handed her details over for. Staff records sit under employment. Where a society is constituted under a statute, the registers that statute requires it to keep are retained because that law requires it.
Where the permission stops
Membership does not license everything. Data held to run the collection and the payment is not automatically available to a lending arm, an insurance tie up or a supplier's promotion. Each of those is a fresh purpose needing a basis of its own.
Questions people actually ask
Does DPDP apply to a cooperative society?
Yes. The Act reaches any person who alone or with others determines the purpose and means of processing personal data, and person includes a society, an association of persons and a body of individuals whether incorporated or not.
Not being a company changes nothing. The only carve out of that shape is for an individual processing data for a purely personal or domestic purpose, and running a collection centre is neither.
Members own the society. Does that mean member data belongs to us?
No. Owning the institution and owning an individual's data are different things. A member has the same rights against her society as against any company: a summary of what is held and the processing done with it, the identities of everyone it was shared with and a description of what went, correction, and a grievance route.
You must publish how she makes such a request, and your grievance system has to respond within a period not exceeding ninety days.
We hold registers going back thirty years. Is that a problem?
Not where the governing statute or tax law requires them, because the erasure duty gives way to retention that is necessary for compliance with a law in force. Be able to name the provision you are relying on.
Where nothing requires it and no purpose is still live, the register should not still be there. Age alone is not a purpose.
What people get wrong
Members own the society, so member data belongs to the society.
Owning the institution is not owning the individual's data. A member has the same rights against her society as she would against any company, including the right to a summary of what is held about her and the identities of everyone it was shared with.
We are not a company, so this does not apply to us.
The Act binds any person who determines the purpose and means of processing. Cooperatives, trusts, societies and associations are all inside it. The only carve out of that kind is for an individual processing data for a purely personal or domestic purpose.
We can hand member lists to a bank or an insurer we have tied up with.
That is a new purpose and needs its own basis. If the partner acts on the society's behalf there has to be a contract in place first, and if it acts for its own ends it needs its own basis with the member directly.
Records going back decades are fine because they are historical.
Keep what the governing statute and tax law require, and be able to name the provision. Beyond that, retention needs a purpose that is still live, and age on its own is not one.
Related questions
- Does DPDP apply to my small business?
- What rights do people have under DPDP?
- How long can I keep personal data?
This sector sits inside the full Sector Reference, which covers 26 sectors and 160 questions. To work through your own organisation rather than the general case, the Template Builder starts from your answers.