Sector reference
DPDP for Textiles, Apparel and Man Made Fibre
- What is processed
- Mostly its own workforce. A spinning, weaving, processing or garment unit holds worker records, attendance including fingerprints, wage and provident fund details, job applications, and the named contact person at each buyer, supplier and transporter. Very little of it is consumer data.
Why it is allowed, and when
Employment sits inside the Act's list of certain legitimate uses, so a mill does not need a worker's permission to run payroll, attendance or access control, and does not owe a consent notice for it either, because the notice duty is triggered by a request for consent. Where the same unit sells directly to the public, through a counter or a website, that side runs on consent instead.
Where the permission stops
A legitimate use removes the need to ask. It removes nothing else. Security safeguards, breach reporting, erasure, the published contact and the worker's own rights all still apply, and none of them care how many looms you run.
Questions people actually ask
Does DPDP apply to us if we have no consumer customers at all?
Yes. The Act applies to digital personal data, and it does not ask whether the person is a customer. Your workers, your job applicants and the named person at each buyer, supplier and transporter are all individuals whose data you hold.
A weaving unit that sells only to other businesses and has never taken a retail order is still inside the Act, because it has a workforce. This is the single most common misreading in an industrial estate.
Do we need our workers to sign a consent form for payroll and attendance?
No. Employment is one of the certain legitimate uses, so processing for the purposes of employment does not run on consent at all. The notice duty follows the same logic, because a notice is owed where a request for consent is made, and here there is no such request.
Relying on a signed form instead is actually the weaker position. Consent can be withdrawn at any time with comparable ease. A legitimate use cannot be withdrawn.
We have three hundred workers and no IT department. What do we actually have to do?
Five things carry most of the weight. Know what personal data you hold and where it sits. Put the security minimums in place over it, which means encryption, access control, logs that somebody reviews, and backups. Be able to report a breach to the Board and to each affected person. Keep only what a live purpose or another law justifies. And publish a named contact who can answer questions about your processing.
None of that requires a platform. It requires decisions, and somebody named to own them.
Is there an exemption for small units or for MSMEs?
There is no turnover threshold, no headcount threshold and no MSME exemption in the Act. Size cuts the other way: it decides whether the Government notifies you as a Significant Data Fiduciary, which adds duties such as an annual impact assessment and audit. It never subtracts them.
The only exemptions of that kind sit elsewhere, and none of them turns on being small.
Buyer contact details are business information. Are they really personal data?
The buying firm is not an individual, so the firm's own details are not personal data. The person you actually deal with is, and her name, mobile number and email are data about an identifiable individual.
That does not make the file unlawful. It usually rests on the fact that she gave you those details voluntarily for that dealing. What it does mean is that the file needs a retention answer and the same security as everything else.
What people get wrong
We are a B2B unit. We do not deal with consumers, so this law does not apply to us.
The Act applies to digital personal data, not to consumer data. Your workers, your job applicants and the named person at each buyer and transporter are all individuals. A unit with three hundred workers and not a single retail customer is squarely inside the Act.
Our workers signed the appointment letter, so permission is covered.
You do not need their permission in the first place. Employment is one of the certain legitimate uses. Leaning on a signature is actually the weaker position, because permission can be withdrawn at any time and a legitimate use cannot.
Only the large mills have to worry. We are a small unit.
There is no turnover threshold, no headcount threshold and no small business exemption anywhere in the Act. Size only decides whether the government notifies you as a Significant Data Fiduciary, and that brings extra duties on top, never fewer.
A buyer's contact details are business information, not personal data.
The buying firm is not an individual, but the named person you actually call is. Her mobile number and email are data about an identifiable person. What makes holding them lawful is that you have a basis, not that you filed them under business.
Related questions
- Does DPDP apply to B2B companies?
- Do I need consent for employee data?
- Does DPDP apply to my small business?
This sector sits inside the full Sector Reference, which covers 26 sectors and 160 questions. To work through your own organisation rather than the general case, the Template Builder starts from your answers.