What DPDPA Means for RFID and Barcode Systems
The Digital Personal Data Protection Act 2023 — India's first comprehensive personal data protection legislation — applies to any system that collects or processes personal data of individuals in India. For RFID and barcode systems deployed in visitor management, event access, workforce tracking, campus identification, or any people-facing application, DPDPA changes what you are required to do before, during, and after deployment.
What Counts as Personal Data in an RFID Context
Under DPDPA, "personal data" means any data about an identifiable individual. In an RFID or barcode system context, this includes: a visitor's name linked to an RFID badge or QR code, an employee's identity linked to an access control tag, an attendee's profile linked to an event wristband, vehicle registration data linked to a transponder, and location or movement data linked to any of the above. If the system can identify a specific person through a combination of identifier and associated data, it is processing personal data under DPDPA.
The Three DPDPA Principles That Affect System Design
Consent: The DPDPA requires free, specific, informed, and unambiguous consent before personal data is collected for a specific purpose. For visitor management, this means the consent process at registration is a legal requirement — not a checkbox to be added later.
Purpose limitation: Data collected for one purpose cannot be used for a different purpose without fresh consent. If you collect access control data for building security, you cannot use that data for attendance reporting or marketing without separate consent.
Data minimisation: Collect only the data actually needed for the stated purpose. If a visitor badge system requires only a name and company to grant access, collecting biometric data or mobile number is excess collection that creates legal exposure without operational benefit.
Practical Pre-Deployment Requirements Under DPDPA
Before deploying any people-facing RFID or barcode system, you need: a documented data map covering what data is collected, where it is stored, who has access, and how long it is retained; a consent mechanism that meets DPDPA standards; a data subject rights process for how individuals can access, correct, or withdraw consent; a data processor agreement if using a third-party system provider; and a data retention and deletion policy.
If your current people-tracking system does not have these governance elements in place, DPDPA compliance is a pre-deployment requirement — not a post-deployment task. The compliance framework must be designed into the system, not bolted on afterward.
Frequently Asked Questions
Yes. If an employee RFID access control system stores data that can identify an individual — employee name, employee ID, entry/exit timestamps linked to a specific person — it is processing personal data under DPDPA. This means the system operator must have a legitimate purpose for collecting the data, a mechanism for employee consent or a lawful alternative basis, a data retention policy, and a process for employees to access or correct their data.
Yes. A visitor management system that stores a visitor's name, company, contact details, and entry/exit timestamps — and links those details to an RFID badge or QR code — is processing personal data. The visitor must be informed of what data is collected, why, and how long it is retained. Consent or another lawful basis under DPDPA is required.
Event wristbands linked to a registered attendee profile are processing personal data. DPDPA requires that attendees give free, specific, informed, and unambiguous consent for each purpose for which their data will be used. If the event plans to use wristband data for post-event marketing communications, cashless payment processing, or session analytics, each of those purposes requires explicit consent — ideally captured at registration.
DPDPA does not specify a maximum retention period for all categories of personal data, but it requires that personal data not be retained longer than necessary for the purpose for which it was collected. For RFID access control data in a commercial building, a retention period of 30–90 days is typically considered reasonable for security audit purposes. Retention beyond that requires a specific justification documented in the data retention policy.
Vishal Singh is Business Development Manager at Markss Infotech Ltd, with close to a decade of experience across sales, pre-sales, and project work in RFID and barcode deployments across retail, warehousing, manufacturing, and healthcare in India.
Hello@vishalsinghrfid.com · LinkedIn · Book a Clarity Call