DPDP Compliance: Guides for Factories, Offices, Schools and Hospitals

Published on 10/18/2026 • Updated on 10/22/2026

Banner illustration for the article: DPDP Compliance: Guides for Factories, Offices, Schools and Hospitals

India's Digital Personal Data Protection Act, 2023 changes how a factory gate, a reception desk and a security camera should treat personal data. A visitor's name and phone number, a face on CCTV and a thumbprint on an attendance machine are all personal data, and the organisation that decides why they are collected carries the legal duty.

This hub gathers the VisitorFlow compliance guides in one place: the Rules explained, the timeline, penalties, notices, CCTV, biometrics, breach reporting, erasure requests and sector guides for schools and hospitals.

On this page

What DPDP compliance covers

The Act was enacted on 11 August 2023, and the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, according to a Press Information Bureau release dated 17 November 2025. The Rules bring in the provisions in stages. Rule 1 of the Rules states that most operational obligations, including notice, security safeguards and breach intimation, start eighteen months after publication.

The Act calls the organisation that decides why and how personal data is processed a Data Fiduciary. The person the data is about is a Data Principal. A facility that runs a visitor register, a camera system or an attendance machine is a Data Fiduciary for that data.

Key idea: The Act turns a visitor register from a convenience into a record you must be able to justify, protect and erase.

  • Notice: tell people what you collect and why, in plain language, before you collect it (Rule 3).
  • Security: take reasonable safeguards such as access control, masking and logs (Rule 6).
  • Breach: inform affected people without delay and the Board within 72 hours with details (Rule 7).
  • Erasure: remove personal data once the purpose is served, subject to retention duties in the Rules (Rule 8).
  • Rights: publish how people can ask for access, correction or erasure and answer within the stated period (Rule 14).

A reading map by situation

Readers reach this pillar with different problems. The table maps the common ones to the kind of guide that helps, so you can jump to the right part.

If you are... Start with Why
Needing the overall picture The DPDP Rules explained for HR and admin teams It turns the Rules into a task list.
Planning a project The compliance timeline guide It shows what is due and when.
Briefing management The penalties guide It quotes the Schedule to the Act.
Fixing the gate The visitor consent notice guide It gives sample wording.
Running cameras or biometrics The CCTV and biometric attendance guides They explain when recordings and templates are personal data.
Preparing for the worst The breach reporting and erasure request guides They give step-by-step routines.

Guides in this pillar

The first wave of articles in this pillar is listed by topic. Each one is written to stand alone and ends with a short Q&A.

  • DPDP Rules 2025 explained for HR and admin teams.
  • DPDP compliance timeline 2025 to 2027: what is due when.
  • DPDP Act penalties: what non-compliance can cost.
  • DPDP consent notice for visitors: sample wording.
  • DPDP and CCTV: are camera recordings personal data?
  • DPDP data breach reporting: what facility teams must do.
  • Biometric attendance and the DPDP Act.
  • Handling a visitor's request to delete their data.
  • DPDP compliance for schools, and for hospitals.
  • How long to keep visitor records.

Start with the Rules explainer and the timeline if you need the overall picture, then read the guide that matches the system you actually run: CCTV, biometric attendance, visitor registers or a school or hospital campus. Each guide ends with a short Q&A you can forward to colleagues.

This pillar is written for operations, HR and admin readers, not lawyers. It quotes the Act and the Rules where a statement matters, and it tells you to confirm the details with your own legal adviser before you finalise a policy.

Bring the gate in line before the deadline

VisitorFlow visitor management software supports masked data, access control and a searchable visitor log.

Explore Visitor Management Software

How to put these guides to work

Treat this as a small project with an owner. The steps below follow the order that works at most sites.

Step 01

Make a data inventory

List every place you collect personal data: gate register, CCTV, attendance, courier log, HR forms. Note why you collect each field and how long you keep it.

Step 02

Fix the gate first

Visitor data is collected from strangers, in public view, often on paper. Replace the open register and add a short notice at the gate.

Step 03

Write the breach and erasure routines

Name who decides, who informs the Board and who answers a deletion request. A one-page routine beats a long policy nobody reads.

Common mistakes to avoid

Compliance projects stall in predictable places. These are the ones to avoid while you still have time before the main obligations start.

  • Treating the Act as an IT project when most personal data sits in registers, forms and CCTV that IT does not own.
  • Collecting fields at the gate that have no stated purpose, then storing them with no end date.
  • Assuming a notice on the website covers the gate, the camera and the attendance machine.
  • Leaving breach handling undefined until the day a breach happens.
  • Relying on a vendor's word without reading what the contract says about security and deletion.

Each of these is cheaper to fix now than after an incident. Start with a simple inventory of what personal data you hold and why.

Reader Q&A

What is a Data Fiduciary?

It is the organisation that decides why and how personal data is processed. A company that runs a visitor register is one for the visitor data it collects.

When do the main DPDP obligations start?

Rule 1 of the DPDP Rules, 2025 sets eighteen months from publication for most operational rules. That falls around mid-May 2027. Confirm the exact date with your legal adviser.

Is a paper visitor register covered?

The Act covers digital personal data and personal data digitised later. A paper register that is scanned or typed into a system falls within it. Ask your legal adviser how it applies to your case.

How fast must a breach be reported?

Rule 7 requires intimation to the Board without delay, with detailed information within seventy-two hours, and to affected people without delay.

Is this legal advice?

No. These guides explain the Act and Rules in plain language. Have your own legal adviser confirm what applies to your organisation.

Bottom line

The DPDP Act rewards sites that know what personal data they hold and why. The guides above take you from an inventory to a notice, a breach routine and an erasure routine.

VisitorFlow's visitor management software supports masking and access control, which help with the security safeguards in Rule 6.

Bring the gate in line before the deadline

VisitorFlow runs visitor, material gate pass, courier, maintenance and incident workflows on one cloud platform.

Explore Visitor Management Software See Material Gate Pass Software Book a Free Demo
Author of the Blog Post
Aadeshwar Modi
Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.

Recent Post