If you run housekeeping — in-house or as an FM agency — the Digital Personal Data Protection Act, 2023 changes how you onboard staff, capture attendance and prove work. Much of the data involved (Aadhaar, photographs, GPS location, attendance and leave) is personal data of your employees and contract staff. Here is what that means in practice, without the legalese.
1. Aadhaar e-KYC: keep the consent artefact, not the number
Onboarding with Aadhaar e-KYC is fast and stops impersonation — but storing raw Aadhaar numbers or copies of the card is a liability. The clean pattern: capture the candidate’s OTP consent, pull name/DOB/address through the authorised flow, and persist only a consent artefact and a hashed reference. Photocopies on a supervisor’s phone should be a thing of the past.
2. Attendance proof is personal data — minimise and protect it
Selfie + GPS at the gate ends attendance disputes (and under-billing). It is also biometric-adjacent and location data. Tell staff clearly what is captured and why (notice in plain language — and ideally in the staff member’s language), restrict access to supervisors and payroll, set a retention period aligned to wage and statutory records, and make sure geofencing is enforced at the point of capture so you never collect location outside the premises.
3. Photos in QR checklists: capture the place, not the person
Mandatory photos on flagged checklist items are the best proof a washroom was cleaned. Train staff to photograph the asset, not people; blur or avoid faces. Photos are evidence for your client — include their handling in the contract as processor obligations.
4. Leave, rosters, min-wage — the quiet compliance wins
A paperless leave ledger, roster and end-of-shift report are not just convenience: they produce the records the Minimum Wages Act, ESIC/PF filings and client audits require. Automating minimum-wage revisions into the invoice generator removes the most common billing dispute in manpower contracts.
5. Agency or principal — who is the Data Fiduciary?
Usually the agency is the Data Fiduciary for its own employees (it decides purpose and means), and a Data Processor for the client’s data (visitor logs, tenant requests). Your platform provider is your processor. Put this in writing: purposes, retention, security safeguards, breach notification, and what happens to data when a contract ends — and have your counsel confirm the fiduciary/processor mapping for your specific contracts.
6. Breach readiness and grievance redressal
DPDP expects reasonable security safeguards, breach notification to the Data Protection Board and affected individuals, and a grievance mechanism. Operationally: role-based access, module-level grants per user, audit logs on every onboarding, scan, approval and payment, and a named contact staff can reach.
A simple checklist
- Aadhaar e-KYC with consent artefact only; no raw Aadhaar or photocopies stored
- Plain-language notice to staff on attendance, GPS and photo capture
- Geofence enforced at capture; no off-premise location data
- Role-based access; supervisors see their site only
- Retention schedule aligned to wage/statutory records
- Processor terms with clients and platform provider
- Audit log on every onboarding, scan, approval and payment
- Named grievance contact and breach playbook
Facyliti Housekeeping was built around these rules: e-KYC without raw Aadhaar, geofenced QR checklists, selfie+GPS attendance with audit trails, and min-wage-aware invoicing. See the capability or book a demo.
