The Worker CCTV Notice Your Factory Needs Under DPDP (with Template)
Under India's DPDP Act 2023 and the DPDP Rules 2025, worker CCTV footage is personal data and your factory is the data fiduciary. Post a plain-language notice: who records, what, where, why, how long, who can see it, and a named grievance contact. Substantive duties bite 14 May 2027 — your appointment-letter consent clause will not carry you.
If you run a 200–1000 worker plant in Ludhiana, Tiruppur, Hosur or Sanand, this is a one-page document and a laminated board, not a legal project. But the version most factories are using right now is wrong in a way that will not survive a buyer audit, let alone the Data Protection Board.
Key points
- Substantive obligations bite in 2027, not today. The DPDP Rules were notified 13 November 2025 and took effect 14 November 2025; the notice-and-consent, security-safeguard, breach-reporting and Significant Data Fiduciary provisions commence 18 months from publication — 14 May 2027 (Shardul Amarchand Mangaldas). The Data Protection Board has existed since 14 November 2025; its full penalty machinery phases in with the rest.
- Your appointment-letter surveillance clause probably confers nothing. Consent under Section 6 must be free, specific and informed; one argument, made in LiveLaw, is that a clause an applicant cannot refuse without losing the job is void ab initio, not merely risky — unlawful object under Section 23 of the Contract Act. That is commentary, not settled law, but it is the direction of travel.
- Section 7(i) is narrower than vendors claim. The employment "legitimate use" covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information" (Section 7 text). Every named example is defensive. Blanket productivity scoring is not in that list.
- You almost certainly do not need a Data Protection Officer. A DPO is mandatory only for a Significant Data Fiduciary designated by the Central Government on volume, sensitivity and risk — not on a numeric headcount test. Every other Data Fiduciary needs a named grievance contact instead.
- Retention is not "keep everything forever." Rule 6 requires security safeguards including logs of access and processing, retained for one year (DPDP Rules explainer, PIB). Footage itself has no single mandated number — purpose limitation governs: keep it as long as the stated purpose needs, then erase.
- The downside number is a ceiling, not a fine. The Schedule to the Act sets a maximum of ₹250 crore for failing to implement reasonable security safeguards and ₹200 crore for failing to notify a breach (penalty summary). Ceilings are weighed down by gravity and mitigation. A ₹40,000 NVR on the shop floor with a default password is where that exposure actually starts.
- Separately, night-shift law now demands CCTV. The OSH (Central) Rules, 2026 (notified and in force 8 May 2026) require written consent from women workers for night work plus CCTV surveillance, lighting on entry/exit and pathways, and safe pick-up and drop — so you are being pushed to record and to justify recording at the same time.
Why the Factories Act answer you were given is out of date
If your consultant's CCTV note still cites the Factories Act 1948 as live law, throw it away. The four labour codes were brought into effect by a series of notifications on 21 November 2025, and the Occupational Safety, Health and Working Conditions Code, 2020 replaces 13 central labour laws — the Factories Act 1948, the Mines Act 1952 and the Contract Labour Act among them (Acuity Law). The OSH Central Rules followed on 8 May 2026. State factories rules made under the old Act still matter in practice until states re-issue them — check your state gazette rather than assuming.
Practically: your camera obligations now sit in two stacks that pull in opposite directions. OSH says record (welfare, night shift, hazardous areas). DPDP says justify, limit, disclose, erase. The worker notice is the document where those two stacks are reconciled. See our 2026 compliance playbook for the wider picture, what DPDP actually asks of worker CCTV for the duties behind this template, and the Factories Act piece for what changed.
Consent or legitimate use? Decide zone by zone
Do not answer this plant-wide. Answer it per camera, because the answer changes the notice text and the retention period. The retention figures below are common Indian plant practice, not statutory numbers — DPDP requires a defensible number, not a particular one.
| Camera zone | Realistic legal basis | Stated purpose on the notice | Retention in practice |
|---|---|---|---|
| Main gate / material gate | Section 7(i) — loss and liability | Asset protection, vehicle and material movement | 30–45 days |
| Finished-goods store, dispatch bay | Section 7(i) | Prevention of pilferage; dispatch dispute resolution | 60–90 days |
| Press shop, die area, forklift aisles | OSH safety duty + Section 7(i) | Accident investigation, machine-guarding compliance | 30 days; incident clips kept separately |
| Night-shift bays with women workers | OSH (Central) Rules 2026 + written consent | Safety of women workers on night shift | Per your state's notified rule — see the retention checklist |
| Line productivity / output counting | Weak under 7(i); take consent, and anonymise | Line throughput measurement | Keep counts, not faces |
| Canteen, rest rooms, changing areas, prayer room, ICC room | No camera — fails necessity and proportionality | — | — |
| Union office or notice-board area | No camera — industrial-relations risk, not worth the footage | — | — |
The last two rows matter more than the first five. A camera pointed at a changing area or a union meeting is the fact that turns a routine inspection into a case.
The notice itself: what must be in it
One honest distinction most template pages skip. Rule 3 of the DPDP Rules 2025 governs the notice a Data Fiduciary gives when it relies on consent: it must be standalone, in clear and plain language, and set out in an itemised manner the personal data collected, the specific purpose, and how the Data Principal withdraws consent, exercises rights, raises a grievance and complains to the Data Protection Board (EY summary). Cameras running on the Section 7(i) employment route do not formally trigger that consent notice — but Rule 3 is the best available model of what "informed" looks like, it is what an auditor will benchmark you against, and it applies in full the moment you rely on consent for anything (night-shift women workers, any productivity use). Post it either way. It costs a laminated board.
For a factory that translates into seven lines: who is recording, what is recorded, which areas, why, how long, who can see it, and who to complain to. Anything longer will not be read, and an unread notice is not an informed one.
Copy-paste bilingual notice (English / हिन्दी)
Print at A3, laminate, and hang it at every gate, at the time office, and at each shop entrance. Put a small sticker version (first two lines plus the grievance number) under each camera cluster. Replace the bracketed fields.
NOTICE — CCTV RECORDING / सूचना — सीसीटीवी रिकॉर्डिंग
1. Who records / रिकॉर्ड कौन करता है: [Company Pvt Ltd], [plant address]. We are the Data Fiduciary for this footage. [कंपनी प्रा. लि.], [पता] — इस फुटेज के लिए डेटा फ़िड्यूशरी हम हैं।
2. What is recorded / क्या रिकॉर्ड होता है: Video images of persons, vehicles and materials. No audio. No face-recognition database is maintained. व्यक्तियों, वाहनों और सामग्री के वीडियो चित्र। ऑडियो नहीं। चेहरा-पहचान डेटाबेस नहीं रखा जाता।
3. Where / कहाँ: Gates, stores and dispatch, production bays, forklift aisles, hazardous machine zones. Not in toilets, changing rooms, canteen, rest rooms, prayer area or the ICC room. गेट, स्टोर व डिस्पैच, उत्पादन क्षेत्र, फोर्कलिफ्ट गलियारे, ख़तरनाक मशीन क्षेत्र। शौचालय, चेंजिंग रूम, कैंटीन, विश्राम कक्ष, प्रार्थना स्थल और ICC कक्ष में नहीं।
4. Why / क्यों: Safety and accident investigation; protection of company property against loss; statutory safety and night-shift obligations. Not used for individual performance rating or salary deduction. सुरक्षा व दुर्घटना जाँच; कंपनी संपत्ति की हानि से रक्षा; वैधानिक सुरक्षा एवं रात्रि पाली दायित्व। व्यक्तिगत प्रदर्शन रेटिंग या वेतन कटौती के लिए उपयोग नहीं।
5. How long / कितने समय तक: [30] days, then automatic overwrite. Clips saved for an accident or theft investigation are kept only until that matter closes. [30] दिन, उसके बाद स्वतः मिट जाता है। दुर्घटना/चोरी जाँच हेतु सुरक्षित क्लिप केवल मामला बंद होने तक।
6. Who can see it / कौन देख सकता है: [Plant Head], [Security In-charge], [Safety Officer]. Sharing outside the company only on written police/court/inspector requirement, and it is logged. [प्लांट हेड], [सुरक्षा प्रभारी], [सुरक्षा अधिकारी]। कंपनी के बाहर साझा केवल पुलिस/न्यायालय/निरीक्षक की लिखित माँग पर, और उसका रिकॉर्ड रखा जाता है।
7. Your rights and complaints / आपके अधिकार और शिकायत: You may ask what is held about you, ask for correction or erasure, and complain. Grievance Officer: [Name], [mobile], [email], time office window, [timing]. We will acknowledge within [7] working days and close the matter within [90] days. If unsatisfied, you may complain to the Data Protection Board of India. आप पूछ सकते हैं कि आपके बारे में क्या रखा गया है, सुधार या मिटाने की माँग कर सकते हैं, और शिकायत कर सकते हैं। शिकायत अधिकारी: [नाम], [मोबाइल], [ईमेल]। पावती [7] कार्यदिवस में, निपटारा [90] दिन के भीतर। असंतुष्ट होने पर आप भारतीय डेटा संरक्षण बोर्ड को शिकायत कर सकते हैं।
Add the local language of your workforce where it is not Hindi — Tamil in Tiruppur, Gujarati in Sanand, Kannada in Peenya. Migrant-heavy plants in Gujarat and Tamil Nadu should carry Hindi and Odia or Bengali. A notice in a language your workers cannot read is not "informed."
Who is the DPO in a 400-worker plant? Nobody
This is where most vendor blogs mislead. A Data Protection Officer is a statutory role only for a Significant Data Fiduciary, which the Central Government designates on the volume and sensitivity of processing, risk to Data Principals' rights, and risk to public order — not on a numeric threshold. A single-plant manufacturer is not one, and no notification currently reaches ordinary factories. The one thing that can move you up the risk ladder is face recognition, which turns footage into biometric processing.
What you do need is a named human whom a worker can walk up to: a grievance contact with a phone number, a register of complaints with dates, and a published response period — commentary on the Rules works to roughly 90 days as the outer window, so publish a period you can actually meet and meet it. In practice, give this to the HR/IR manager, not the IT vendor. The IT vendor cannot answer "why is there a camera over my machine."
Keep a one-page register: date, complainant, issue, action, closure date. That register is the only evidence you will have if the question is ever asked.
What this notice does not do
Be clear-eyed, because a notice is often sold as a shield.
- It does not legalise a camera that shouldn't exist. Under Puttaswamy the test is legality, necessity and proportionality, with safeguards against misuse. A washroom camera with a beautiful notice under it is still a washroom camera.
- It does not create consent. If workers cannot refuse, the paper is not consent — it is transparency. Transparency is worth having; do not confuse the two.
- It does not fix an unsecured NVR. Default passwords, DVRs exposed on the internet, and the plant WhatsApp group where the security supervisor forwards clips are where the ₹250 crore ceiling actually points. Decide NVR vs cloud VMS with access control in mind.
- It does not cover contractor workers automatically. Your contractor's workers are Data Principals too. Put a clause in the contractor agreement and hand the contractor the same notice for their muster.
- It will not stop a determined dispute. If your union reads the notice as a productivity-monitoring charter, expect it in the next charter of demands. Wording it defensively — safety and asset protection, explicitly not salary deduction — is a cheap way to remove that fight.
General guidance, not legal advice. Confirm your position, and your state's factories rules, with counsel.
FAQ
Do I need written consent from every worker for CCTV in my factory? Not for genuine safety and asset-protection cameras — those are argued to sit under the Section 7(i) legitimate use, which needs transparency and limits rather than signatures. You do need written consent from women workers for night work under the OSH (Central) Rules 2026, and consent is the safer basis for any camera used for individual performance measurement.
When does DPDP actually start applying to my plant? The Rules took effect 14 November 2025 and the Data Protection Board was constituted then. The notice, consent, security-safeguard, breach-reporting and Significant Data Fiduciary obligations commence 18 months from publication — 14 May 2027. Use the runway; buyer audits and customer questionnaires ask well before a regulator does.
How long should I keep factory CCTV footage? There is no single mandated number under DPDP. Set one and write it on the notice — 30 days for general areas, up to 90 for stores and dispatch is common Indian practice — and check your state's night-shift rule, which may prescribe its own minimum. Purpose limitation means the number must be defensible, not maximal. Incident clips are pulled out and held separately until that case closes.
Do I have to appoint a Data Protection Officer? Only if the Central Government designates you a Significant Data Fiduciary, which will not reach a typical single-plant manufacturer. Everyone else appoints a grievance contact — a real person with a phone number, published on the notice, with a response period you publish and honour.
Can I use AI analytics on this footage — PPE detection, line counting? Yes, if it fits the stated purpose. PPE and helmet detection is safety, which you already declared. Individual productivity scoring is a different purpose and needs its own line in the notice — and counting output rather than faces avoids the problem entirely. Face recognition is a bigger step: it makes the data biometric and raises your compliance tier.
What happens if an inspector asks for footage? Give it, and log it: date, who asked, what was given, under what authority. Written requirement only. Rule 6 expects you to keep logs anyway, and the entry is what protects you if the same footage later surfaces somewhere it shouldn't have.