DPDP for Diamonds, Gems and Jewellery

Is biometric attendance still allowed under DPDP?

Yes. Two things make it work. Employment processing is a certain legitimate use, so attendance does not need consent. And the Act has no sensitive data category at all, so a fingerprint template carries no special tier and no separate permission requirement.

What you do owe is security over the template itself, under the safeguards the Rules set out, and a retention answer for it once a worker leaves.

ACT · Sections 4, 7(i) and 8(5); RULES · Rule 6.

Can we keep cameras over the polishing tables and the strong room?

Yes, and the Act gives you the words. The legitimate use covers processing related to safeguarding the employer from loss or liability, and it names prevention of corporate espionage and confidentiality of trade secrets as examples. A cutting and polishing floor is the paradigm case.

The limit is what you then do with the footage. Watching for stock protection is covered. Using the same recordings to settle an unrelated dispute, or keeping every frame with no end date, is not.

ACT · Sections 4, 7(i) and 8(7).

How long can we keep CCTV footage?

The Act does not set a number for footage. It sets a test: erase when the specified purpose is no longer being served, unless retention is necessary for compliance with a law in force. For stock protection that usually means a rolling window long enough to investigate an incident, not an archive.

The one year figure people quote comes from a different place. The Rules require security logs and the related personal data to be retained for one year to enable detection and investigation, and that is a minimum floor for those logs, not a deadline for your cameras.

ACT · Section 8(7); RULES · Rule 6(1).

A worker asked us to delete everything we hold on him. Do we have to?

Not automatically, for two reasons. His records are not being processed on the basis of his consent, so there is nothing for him to withdraw. And the erasure duty itself yields wherever retention is necessary for compliance with any law in force, which covers wage registers, provident fund and income tax records.

He does have real rights you must answer: a summary of what you hold and who it went to, correction of anything inaccurate, and a grievance route. Answer those, and explain what you are retaining and why.

ACT · Sections 7(i), 8(7), 11, 12 and 13; RULES · Rule 14(3).

A fingerprint is sensitive data, so biometric attendance needs special permission.

The Act has no sensitive data category at all. There is no separate tier for biometrics, and a fingerprint sits on exactly the same footing as a name. Employment processing already covers attendance, so what you actually owe is security over the stored template, not a special consent form.

Cameras on the polishing floor are illegal now.

Safeguarding the employer from loss or liability is a stated legitimate use, and the Act itself names trade secrets and corporate espionage as examples of it. Cameras for stock protection are on firm ground. What is not on firm ground is repurposing that footage, or keeping it with no end date.

Footage is not personal data because we never write anyone's name on it.

Footage of an identifiable person is data about her. Naming is not the test. Being identifiable by or in relation to the data is the test, and a face on a recording meets it.

If a worker withdraws permission we have to wipe his record straight away.

Employment processing is not running on permission, so there is nothing to withdraw. Even where permission is the basis, the erasure duty yields where retention is necessary for compliance with any law in force, and wage, provident fund and tax records are exactly that.