Can Workers Refuse Factory CCTV in India? Consent vs Notice vs Legitimate Use Under DPDP
Can a worker refuse factory CCTV in India? As of 14 Oct 2026, the DPDP Act's consent and legitimate-use sections are not yet in force; they start on 14 May 2027. From then, a camera resting on Section 7(i) ("purposes of employment") needs no consent, so there is nothing to withdraw. On the consent route, Section 6(4) allows withdrawal at any time.
Last checked: 14 Oct 2026
By the Mama Editorial Team. For all of a factory's DPDP duties, see DPDP and worker CCTV; for printable wording, the worker CCTV notice template. Not legal advice.
Verified against
- Digital Personal Data Protection Act, 2023 (No. 22 of 2023), official text, MeitY: sections 3, 4, 5, 6, 7, 8, 11, 12, 13, 15, 38 and the Schedule.
- DPDP Act commencement notification, G.S.R. 843(E), dated 13 Nov 2025, e-Gazette 267647.
- DPDP Rules, 2025, G.S.R. 846(E), dated 13 Nov 2025, e-Gazette 267650: Rules 1, 3, 6, 8, 9 and 14, and the Seventh Schedule.
- Industrial Relations Code, 2020, e-Gazette 222118: sections 3, 28 and 40, and the Third Schedule.
- Model Standing Orders, 2026, S.O. 2312(E), dated 8 May 2026, e-Gazette 272341.
- Personal Data Protection Bill, 2019, as introduced in Lok Sabha (Bill No. 373 of 2019): clause 13.
- Checked 14 Oct 2026.
Consent, notice and legitimate use: the three routes
Section 4(1) of the Act allows processing on only two grounds: the person's consent, or "certain legitimate uses". Notice is not a third ground. Under Section 5(1), the formal notice must "accompany or precede" a request for consent made under Section 6.
Section 7(i) is the legitimate use that matters for employers. It covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability, such as prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information or provision of any service or benefit sought by a Data Principal who is an employee."
| Question | Section 7(i) legitimate use | Consent (Sections 5–6) |
|---|---|---|
| Worker's agreement needed | No | Yes. Consent must be "free, specific, informed, unconditional and unambiguous" (s.6(1)) |
| Can the worker refuse or withdraw? | The Act gives no opt-out on this route | Yes, "at any time", and withdrawing must be as easy as giving consent (s.6(4)) |
| Formal notice | Not triggered by the text of s.5 | Required. Rule 3 sets the content |
| Access to data (s.11) and correction/erasure (s.12) | Both sections are worded for data the worker "has previously given consent" for, including consent under s.7(a); s.7(i) is not named in them | Yes |
| Grievance to the factory (s.13) | Yes. It covers "any act or omission" of the fiduciary | Yes |
| Erase once the purpose is served (s.8(7)) | Yes | Yes, and also on withdrawal |
| These sections and Rules apply from (date) | 14 May 2027 | 14 May 2027 |
The 14 May 2027 date has two sources. G.S.R. 843(E) of 13 Nov 2025 brings Sections 3 to 17 of the DPDP Act into force on 14 May 2027, with the Board's powers in Sections 27 to 34; only s.6(9), Consent Manager registration, starts earlier, in Nov 2026. Rule 1(4) of the DPDP Rules does the same for Rules 3 (notice), 6 (security), 8 (retention), 9 (contact person), 14 (rights) and 15 (transfers abroad). Until 14 May 2027, the IT Act's Section 43A stays in force; DPDP s.44(2), which omits it, starts on the same date.
So, can a worker refuse? Four situations
1. The camera covers gates, stores, dispatch or press guards for loss and safety. The purpose matches 7(i)'s own words, "safeguarding the employer from loss or liability". The Act gives no veto. From 14 May 2027 a worker can still raise a grievance under s.13, and under s.13(3) they must exhaust that route before going to the Data Protection Board.
2. You chose consent as your basis. Under s.6(6), on withdrawal you must stop processing within a reasonable time, unless processing without consent is "required or authorised" under the Act, the Rules or any other law. Under s.6(5), "the consequences of the withdrawal" fall on the worker. Consent made a condition of the job is hard to square with the word "unconditional" in s.6(1).
3. The footage is used to score attendance or output. Clause 13(1)(c) and (d) of the 2019 Bill named "verifying the attendance" and "assessment of the performance" as employment purposes that needed no consent where consent was "not appropriate" (cl.13(2)). The 2023 Act kept only "purposes of employment" and names neither attendance nor performance. For scoring, consent is the route that does not depend on how "purposes of employment" is read.
4. The camera points into a changing room, washroom or creche. We see no DPDP route that makes that defensible. Other laws apply too, because s.38(1) makes the Act "in addition to and not in derogation of" other law. See where you may never put a camera.
What the Act and Rules do not say
We searched the English text of both for each term.
| Term searched | Act, 2023 (occurrences) | Rules, 2025 English text (occurrences) |
|---|---|---|
| "CCTV" or "camera" | 0 | 0 |
| "surveillance" | 0 | 0 |
| "biometric" | 0 | 0 |
| "sensitive" (no sensitive-data tier) | 0 | 0 |
| "trade union" | 0 | 0 |
| "video" | 1 (a bank KYC illustration) | 0 |
Counts taken 14 Oct 2026 from the MeitY Act PDF and e-Gazette 267650. The Rules contain no employer-specific provision.
The Act also does not:
- require a signed consent form from each worker on the 7(i) route
- fix a CCTV retention period in days
- set a headcount or turnover threshold for factories
- list the places where cameras are banned
- require consultation with a union or works committee
Retention: two one-year rules. Rule 6(1)(e) asks fiduciaries to keep "such logs and personal data for a period of one year" for breach detection. Rule 8(3) requires every fiduciary to keep personal data, traffic data and processing logs for at least one year, for the State-access purposes in the Seventh Schedule. Neither rule mentions CCTV. Our footage retention guide handles the practical numbers.
The labour-law layer: standing orders and notice of change
- Model Standing Orders, 2026 (S.O. 2312(E), 8 May 2026). They do not mention CCTV, cameras, surveillance or video (English gazette text, checked 14 Oct 2026). Para 9(4) of the manufacturing schedule regulates attendance "by means of identity card, biometrics or any other system as has been notified".
- Standing orders threshold. The IR Code's standing-orders chapter applies to establishments with 300 or more workers (s.28).
Notice of change. IR Code s.40 bars changing a Third Schedule service condition without notice, or within 21 days of giving it. Item 9 of the Third Schedule is "introduction of new rules of discipline, or alteration of existing rules". Cameras are not listed. If footage becomes a new basis for discipline outside your standing orders, check item 9 and the 21-day notice before you start.
What an owner should do before 14 May 2027
| Step | Legal hook |
|---|---|
| Write one purpose per camera zone: loss, safety or gate control | s.7(i), s.8(7) |
| Choose a route per zone and avoid mixing them. Consent asked "just in case" on 7(i) cameras brings notice duties and can be withdrawn at any time | s.4, s.6(4) |
| Put up signage in the workers' languages | Good practice; s.5(3) language option on the consent route |
| Name a contact person and publish a grievance timeline on your website (Rule 14(3) caps it at 90 days) | Rules 9, 14 |
| Turn off or re-aim cameras in banned areas | s.38; other law |
| Fix retention, access control and an export log | s.8(5), Rule 6 |
| Keep productivity analysis aggregate, with no named individuals: s.7(i) names no performance purpose | s.7(i) |
From 14 May 2027, per the Act's Schedule, penalties reach ₹250 crore for weak security safeguards and ₹50 crore for "any other provision"; a worker's false or frivolous grievance can draw up to ₹10,000 (s.15(d)).
Where this page stops
State public-safety Acts and night-shift rules may add CCTV duties; see do you need permission to install CCTV. Microphones raise a separate question: is audio recording on factory CCTV legal.
Where Mama fits
Mama reads a factory's existing cameras over RTSP/ONVIF and tells the owner where machine hours were lost yesterday. It counts people only in aggregate, with no names or ranking. For a camera plan with a purpose for each zone: Leave an email or phone in the form below.
FAQ
Can an employer install CCTV without employee consent in India? Yes, on the Section 7(i) "purposes of employment" route, which takes effect with the rest of the Act's core sections on 14 May 2027. Purpose, security and erasure duties still apply.
Can employees refuse to be recorded at work? Only if the employer relies on consent; Section 6(4) then allows withdrawal at any time. On the Section 7(i) route there is no opt-out, but from 14 May 2027 a worker can file a Section 13 grievance, then go to the Board.
Do workers have to sign a CCTV consent form under DPDP? Not on the Section 7(i) route. A signed form signals reliance on consent, with notice and withdrawal duties; s.6(10) then makes the factory prove both.