--- title: "Rights, children, employees, CCTV and retention, Ernakulam" description: "Rights, children, employees, CCTV and retention: 18 matters, each with the law, forum, procedure, documents and limitation. DSAR — right to access summary…" url: "https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/" image: "https://advaslam.com/og.png" --- DPDP compliance # Rights, children, employees, CCTV and retention 18 matters from the DPDP compliance index. Each entry sets out the problem, the law, the forum, the procedure, the documents usually needed and the limitation clock. General information only — verify the current position on your facts before acting. **Contents** 1. DSAR — right to access summary, sharing trail and processing note (s.11) 2. Correction cascade — wrong phone, address or name across systems and vendors 3. Erasure — delete me, unless purpose survives or law says keep 4. Nomination — s.14 nominee for death or incapacity 5. Section 15 defence — answering false, frivolous or impersonated requests 6. Age-gating — verifiable parental consent before touching a child's data 7. No tracking, monitoring or targeted ads at children — s.9(3) hard line 8. Notified child-processing classes and verifiably-safe exemption — s.9(4)/(5) watch 9. School-vendor pack — student app, bus GPS and fee-portal checklist 10. HR pack — attendance, payroll and performance data under s.7(i) 11. Ex-employee data — references, dues and deletion after exit 12. CCTV SOP — shop, clinic and apartment cameras with people data 13. Facial recognition on private premises — high-risk memo, default no 14. Retention schedules — purpose-over means delete, unless law says keep 15. PMLA/banking 10-year override — when another law beats erasure 16. Hospital retention — treatment records vs delete-me requests 17. Grievance-first rule — Board will not hear you before the fiduciary does 18. Data Principal duties + Rs.10,000 track — the quiet penalty on individuals ## DSAR — right to access summary, sharing trail and processing note (s.11) Customer asks "what do you hold on me and who did you share it with" and gets silence or a raw database dump. What it involvess.11(1)(a)–(c): summary + processing activities; identities of all other fiduciaries/processors + what was shared; other prescribed info — on request in prescribed manner, where consent (incl. s.7(a)) was the basis. Relevant laws.11; s.11(2) carve-out (withhold sharing details where another fiduciary authorised by law sought it in writing for offence/cyber-incident prevention-detection-investigation or prosecution/punishment). ForumFiduciary intake first; grievance (s.13); Board complaint (s.27(1)(b)). Procedure & stage1) Verify identity. 2) Pull summary + sharing log. 3) Apply s.11(2) screen. 4) Respond without delay via the published means (r.14). 5) Log. RemedyDisclosure + process fix; Board direction/penalty on refusal (to Consolidated Fund of India); damages only by civil suit. High Court connectionKerala principals file grievance/Board digitally; Kerala HC writ only for process illegality, not for re-weighing disclosure adequacy. Documents normally requiredID proof, request copy, sharing log, s.11(2) withholding note with legal reference. LimitationNo separate period in the Act or Rules for the access response itself; r.14(3): the grievance-response period the fiduciary publishes must not exceed 90 days. s.11 and r.14 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Must we reveal a police request?** s.11(2) protects qualifying law-enforcement sharing. Record the written request and legal authorisation; do not volunteer beyond the section. ## Correction cascade — wrong phone, address or name across systems and vendors Corrected at counter but old address persists in courier, SMS and backup lists. What it involvess.12(1)–(2): correct inaccurate/misleading, complete incomplete, update stale data per applicable law; plus s.8(3) accuracy where data feeds decisions/sharing. Relevant laws.12(1)–(2); s.8(2)–(3); s.15(e) (requester must give verifiably authentic info). ForumFiduciary intake → grievance → Board. Procedure & stageVerify requester + authentic proof → correct master → push to processors/other fiduciaries → confirm back → log. RemedyCorrection + cascade proof; penalty track only on significant breach (to Consolidated Fund of India). High Court connectionConsequential loss (e.g., loan denial on wrong data) is a civil-suit claim in Kerala courts; DPDP route fixes the record. Documents normally requiredCorrection request, authentic proof (per s.15(e)), processor push confirmations. LimitationNo specific correction period in the Act or Rules; act without delay; grievance response within the published period under r.14(3) (not exceeding 90 days). **Customer gives forged proof to 'correct' records?** s.15(e) requires verifiably authentic info; false material risks s.15/s.28(12) consequences. Verify before overwriting. ## Erasure — delete me, unless purpose survives or law says keep Ex-customer demands deletion while a warranty, dues recovery or statutory file-retention still runs. What it involvess.12(3) erasure on prescribed request UNLESS retention necessary for specified purpose or legal compliance; paired with s.8(7) erasure track. Relevant laws.12(3) verbatim duty; s.8(7)–(8); s.17 where applicable. ForumFiduciary → grievance → Board. Procedure & stageTest (a) purpose over? (b) law requires keep? → erase + cause processors to erase (s.8(7)(b)) OR give written retention reason citing the exact law/purpose. RemedyErasure confirmation or reasoned retention note; Board direction on dispute. High Court connectionRetention under another statute (e.g., tax, banking) is pleaded with that statute + s.8(7)/s.12(3); writ only for Board-process error. Documents normally requiredErasure request, purpose/retention analysis, processor erasure confirmations. LimitationNo specific erasure period in the Act or Rules; act without delay and cause processors to erase (s.8(7)(b)); grievance response within the published period under r.14(3) (not exceeding 90 days). **Erase means destroy backups too?** On Act text, cause processors to erase and erase what you control unless law requires retention; document backup-cycle deletion technically and honestly. ## Nomination — s.14 nominee for death or incapacity Family cannot access, correct or close accounts of a deceased/incapacitated person's data. What it involvess.14(1) nomination in prescribed manner; s.14(2) incapacity = unsoundness of mind or infirmity of body; nominee exercises principal's rights. Relevant laws.14; succession/other laws continue (s.38). ForumFiduciary nomination desk; Board on denial; succession court separately for estate questions. Procedure & stageOffer nomination field at onboarding + later addition → verify trigger (death certificate / medical proof) → act on nominee's s.11–13 requests. RemedyNominee recognised; refusal becomes a grievance → Board complaint. High Court connectionKerala succession/guardianship orders (if needed) come from competent Kerala courts; DPDP nomination operates alongside, not instead of, succession law. Documents normally requiredNomination form, ID, death/medical proof, nominee ID. LimitationNone in Act. Rules r.14(4): nomination of one or more individuals per the fiduciary's terms of service and applicable law, using the means and particulars the fiduciary requires. **Is this like a bank nominee?** Functionally similar: a stand-in for DPDP rights only, not ownership of property. ## Section 15 defence — answering false, frivolous or impersonated requests Business hit with impersonated DSARs, suppressed identity facts, or repeat troll complaints. What it involvess.15(a)–(e) duties: obey law; no impersonation; no suppression for State-issued IDs; no false/frivolous grievance/complaint; only verifiably authentic correction info. Schedule Sl.5: up to Rs.10,000 on the principal. Relevant laws.15; Schedule Sl.5 (s.33); s.28(12) (Board may warn/impose costs for false/frivolous complaints). ForumFiduciary screening; Board (costs/warning + Rs.10k track). Procedure & stageIdentity-verify every request → flag impersonation/frivolity with evidence → reply briefly → place s.15 + s.28(12) on record before Board if escalated. RemedyComplaint closure with warning/costs; Rs.10k penalty (to Consolidated Fund of India). Genuine requesters unaffected. High Court connectionCosts/warning challenged via TDSAT (60 days); writ only for perversity or natural-justice breach. Documents normally requiredID verification log, request pattern evidence, prior disposals. LimitationTDSAT 60 days if appealed. **Can we ignore a rude request?** No. Rudeness is not frivolity. Test impersonation/falsity on evidence, respond promptly (grievances within your published r.14(3) period), and record reasons. ## Age-gating — verifiable parental consent before touching a child's data Edtech, gaming or school app onboards under-18s with a single "I agree" tap. What it involvess.9(1): before processing a child/person-with-disability-with-guardian's data, obtain verifiable consent of parent/lawful guardian in prescribed manner. Relevant laws.9(1) + Expl.; s.2(f) child = under 18; Rules r.10 (verifiable parental consent: due diligence that the parent is an identifiable adult, by reference to reliable identity/age details already held, or identity/age details or a virtual token from an authorised entity, incl. via a Digital Locker service provider) and r.11 (lawful guardian of person with disability); s.33 Schedule Sl.3: up to Rs.200 crore for s.9 breach (to Consolidated Fund of India). ForumDesign compliance; Board inquiry on complaint/intimation. Procedure & stageAge gate → guardian authentication → verifiable-consent record → segregate child flows → no s.9(3) tracking/ads (see next). RemedyCompliant onboarding; penalty/direction on breach; victim damages only by civil suit. High Court connectionKerala schools/clinics with under-18 users build this into admission/app flows; disputes go Board → TDSAT (60 days). Documents normally requiredAge-gate screens, guardian-verification method, consent logs. Limitations.9 and r.10 commence May 2027 (18 months after the 13 Nov 2025 commencement notification); act now in new builds. **Is 16+ old enough to consent alone?** On Act text, no: a child is anyone under 18 (s.2(f)). Relief exists only for the classes/purposes in Rules r.12 + Fourth Schedule, or for a fiduciary covered by a s.9(5) age notification. ## No tracking, monitoring or targeted ads at children — s.9(3) hard line "Kids mode" still runs behavioural ads and cross-app tracking. What it involvess.9(2) (no processing likely to cause detrimental effect on well-being) + s.9(3) (no tracking/behavioural monitoring/targeted advertising directed at children). Relevant laws.9(2)–(3); Rules r.12 + Fourth Schedule (limited, conditioned exceptions to s.9(1) and (3)); Schedule Sl.3 (up to Rs.200 crore). ForumBoard; TDSAT. Procedure & stageStrip trackers/ads SDKs from child flows → contextual-only content → document s.9(2) well-being review. RemedyDirection + penalty (Consolidated Fund of India); civil suit for loss. High Court connectionKerala HC writ available for interim Board overreach; merits to TDSAT. Documents normally requiredSDK list, ad-targeting settings, child-flow build notes. Limitations.9 commences May 2027 (18 months after the 13 Nov 2025 commencement notification). **Contextual ad on a kids page — barred?** s.9(3) bars targeted advertising directed at children and tracking/behavioural monitoring of children. Get a build-specific review; do not self-certify. ## Notified child-processing classes and verifiably-safe exemption — s.9(4)/(5) watch Health, education or transport service argues children cannot be served without relaxed consent/ads rules. What it involvess.9(4) (classes of fiduciaries/purposes, with conditions, "as may be prescribed" — now Rules r.12 + Fourth Schedule) and s.9(5) (Government may notify an age above which a fiduciary with verifiably safe processing is exempt). Relevant laws.9(4)–(5); Rules r.12 + Fourth Schedule — Part A classes: clinical/mental-health establishments and healthcare professionals, allied healthcare professionals, educational institutions, crèche/day-care carers, child-transport providers engaged by those institutions; Part B purposes: legal functions in a child's interest, State subsidy/benefit under s.7(b), email-only accounts, real-time location for safety, blocking detrimental content, confirming a user is not a child. Each is restricted by its stated condition. ForumFourth Schedule check + s.9(5) notification watch; Board applies only the stated conditions. Procedure & stageMap the service to a Fourth Schedule entry and its condition → outside it, assume full s.9(1)+(3) → s.9(5) relief only by notification. RemedyExemption only as notified and conditioned. High Court connectionExemption-notification vires tested in constitutional courts; Kerala cause of action → Kerala HC Art.226. Documents normally requiredService necessity note, safety measures file, notification tracker. Limitationr.12 and s.9 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Government school portal — automatically exempt?** No automatic exemption. Fourth Schedule Part A covers an educational institution only for tracking/behavioural monitoring for its educational activities or children's safety, and Part B covers State subsidy/benefit processing only to the extent necessary. Anything beyond needs parental consent. ## School-vendor pack — student app, bus GPS and fee-portal checklist Kerala school uses attendance app, bus tracker and fee gateway with no role or consent paperwork. What it involvess.9 (children) + ss.5–6 (notice/consent via guardian) + s.8(2) processor contracts + s.8(5)–(6) security/breach. Relevant lawss.5, 6, 8, 9; Rules r.12 + Fourth Schedule Part A items 3 and 5 (school tracking/monitoring for education or safety; school-transport location tracking during travel) relax s.9(1) and (3) only within those conditions; s.16 if servers abroad. ForumSchool compliance file; Board on parent complaint. Procedure & stageGuardian-facing notice (EN+ML) → verifiable consent → s.8(2) DPAs with each vendor → kill tracking/ads SDKs → retention + breach sheet. RemedyAudit-ready pack; Board mitigation credit (s.33(2)(e)). High Court connectionFee/transport disputes stay in Kerala consumer/civil fora; DPDP layer goes Board → TDSAT. Documents normally requiredVendor list + DPAs, notice/consent copies, SDK audit, retention sheet. LimitationDuties commence May 2027 (18 months after the 13 Nov 2025 commencement notification); new academic-year onboarding is the practical window. **Can the school rely on admission-form consent for all apps?** Only if each specified purpose + data was stated. New app/new purpose needs fresh notice/consent. ## HR pack — attendance, payroll and performance data under s.7(i) Kerala SME/HR has no paper for biometric attendance, payroll processing or background checks. What it involvess.7(i) (employment / safeguarding employer: espionage prevention, trade-secret/IP confidentiality, service/benefit to employee) plus consent track where purpose exceeds employment necessity. Relevant laws.7(i); ss.4–6 for non-employment purposes; s.8 duties throughout. ForumInternal HR file; Board on employee complaint; labour fora for the employment dispute itself. Procedure & stagePurpose-map each HR flow → s.7(i) necessity memo or s.6 consent → limit access → retention + leaver deletion (see next). RemedyDefensible basis per flow; penalty reduced by records (s.33(2)). High Court connectionKerala labour/civil disputes decide the employment merits; DPDP basis is pleaded with HR records before the Board if escalated. Documents normally requiredHR data map, s.7(i) memos, consent texts for extras, access matrix. Limitationss.7–8 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can HR read staff email freely under 7(i)?** Only as far as necessary for the stated employment/safeguarding purpose and proportionate. Blanket reading is not covered. Take advice. ## Ex-employee data — references, dues and deletion after exit Resigned staff demand deletion while full-and-final, PF/ESI records and dispute limitation still run. What it involvess.8(7)/s.12(3) retention-only-if-necessary + s.7(i)/s.17(1)(a) where dues/claims persist + labour/tax retention statutes. Relevant lawss.7(i), 8(7), 12(3), 17(1)(a); other retention laws continue (s.38). ForumHR + Board on complaint; labour/civil courts for dues. Procedure & stageExit checklist → what law/claim requires keeping → delete the rest + instruct processors → give written retention reason for what stays. RemedyClean leaver file; Board complaint closed on reasoned retention. High Court connectionDues/reference suits in Kerala courts; DPDP retention reason travels with that file. Documents normally requiredExit form, retention analysis citing exact law, processor deletion confirmations. LimitationPer the retention statute + limitation for the underlying claim. **Must we delete a reference on demand?** If no purpose or law requires keeping it, erase. If a live dispute/dues file needs it, retain narrowly with reasons. ## CCTV SOP — shop, clinic and apartment cameras with people data Cameras record customers/staff/visitors with no signage, no purpose note and years of footage. What it involvess.5 notice (data + purpose + rights + Board path), s.6/s.7 basis selection, s.8(5) safeguards, s.8(7) deletion when purpose over. Relevant lawss.4–8; s.17(1)(c) where footage is needed for offence prevention/detection/investigation/prosecution (bounded). ForumInternal SOP; Board on complaint; criminal courts for the underlying offence footage. Procedure & stageSignage (EN+ML) + written SOP (angle minimisation, access, retention e.g., 30/60/90 days per risk) → auto-delete → incident-hold protocol → access log. RemedyCompliant SOP + logs; penalty/direction risk contained. High Court connectionFootage admissibility stays under BSA 2023 s.63 (dual certificates; BSA in force 01.07.2024)/BNSS; DPDP governs collection-retention legality alongside. Documents normally requiredSignage photo, SOP, retention setting proof, access/incident logs. LimitationSOP in place before May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can we keep footage 'just in case' for a year?** s.8(7) says erase when purpose over unless law requires keeping. Fix a reasoned cycle, not indefinite storage. ## Facial recognition on private premises — high-risk memo, default no Apartment, tuition centre or showroom wants face-based entry/attendance without assessing proportionality. What it involvesNo standalone "ban" section in the Act; risk concentrates in ss.4–6 (lawful/specific/necessary purpose), s.8(3) (decisions affecting persons must rest on complete/accurate data), s.8(5) (safeguards), s.9 (if children), s.10/SDF lens if notified. Relevant lawss.4, 5, 6, 8(3)/(5), 9; Art.21 privacy backdrop (Puttaswamy) for proportionality — pleaded in writs, not as DPDP text. ForumPre-deployment review; Board on complaint; constitutional writ in exceptional cases. Procedure & stageNecessity/proportionality memo → less-intrusive alternative test (card/QR) → explicit notice + consent → accuracy/bias and access controls → retention/deletion. RemedyDeploy-only-if-justified memo; otherwise use non-biometric means. High Court connectionKerala HC Art.226 tests State-linked deployments for legality/proportionality; private deployments face Board + civil-suit risk. Documents normally requiredNecessity memo, alternatives analysis, notice/consent, accuracy + access records. LimitationPre-deployment; duties commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Vendor says FR is 'DPDP-certified' — enough?** No certification exists under the Act. The fiduciary still proves ss.4–8 compliance. ## Retention schedules — purpose-over means delete, unless law says keep Old enquiry, order and marketing lists pile up with no deletion rule. What it involvess.8(7) erasure duty + marketplace/bank Illustrations; s.8(8): purpose deemed over after prescribed inactivity — Rules r.8 + Third Schedule prescribe 3 years only for e-commerce entities and social media intermediaries with 2 crore+ registered users in India and online gaming intermediaries with 50 lakh+. Relevant laws.8(7)–(8), (11); s.12(3); Rules r.8(1)–(2) + Third Schedule (inactivity erasure; 48-hour prior intimation), r.8(3) (minimum one-year retention of personal data, traffic data and processing logs for Seventh Schedule purposes). ForumInternal schedule; Board on hoarding complaint. Procedure & stagePer-purpose clock (inactivity period) → auto-delete job → processor cascade → legal-hold override with citation. RemedySchedule + deletion logs; mitigation credit (s.33(2)(e)). High Court connectionDisputes over "law requires keeping" cite that exact statute + s.8(7) before the Board; writ only for process error. Documents normally requiredRetention matrix, deletion logs, processor confirmations, hold register. LimitationThird Schedule 3-year inactivity periods (listed large platforms only); others set a purpose-linked period. s.8 and r.8 commence May 2027 (18 months after the 13 Nov 2025 commencement notification). **Can the notice say 'we keep data indefinitely'?** That defeats s.8(7). State a period or a purpose-linked trigger and delete on it. ## PMLA/banking 10-year override — when another law beats erasure Closed-account customer demands full deletion including KYC/transaction trails. What it involvess.8(7) Illust.(II) (bank keeps client-identity records for the period banking law requires; the Illustration uses ten years) + s.12(3) "unless … for compliance with any law." Relevant lawss.8(7), 12(3); PMLA s.12(1)(a), (e), (3)–(4) + applicable RBI KYC directions (cite exact rule in the reply); DPDP does not override that retention (s.38 addition, DPDP prevails only on conflict — here they align: retain). ForumBank/NBFC grievance → Board on DPDP complaint; banking ombudsman for service aspect. Procedure & stageIdentify the exact retention rule → retain narrowly → erase marketing/optional data → reply with citation + deletion scope. RemedyReasoned partial-retention; complaint closed if citation holds. High Court connectionKerala HC writ tests only legality of Board/bank process; merits of retention cite the PMLA/RBI instrument. Documents normally requiredClosure request, KYC/transaction retention citation, deletion scope note. LimitationPMLA s.12(3)–(4): transaction records five years from the transaction; identity records, account files and client correspondence five years after the relationship ends or the account closes, whichever is later. Cite any longer period only from the RBI direction that applies. **Keep everything because 'PMLA says so'?** No. Keep what that law requires, for as long as it requires. Marketing and optional data still goes. ## Hospital retention — treatment records vs delete-me requests Patient seeks deletion of OP/IP records the hospital must keep for care continuity, MCI/NMC, insurance or limitation reasons. What it involvess.12(3)/s.8(7) "unless necessary for specified purpose or legal compliance" applied to clinical, medico-legal and insurance files. Relevant lawss.8(7), 12(3); State/central health-record retention norms (cite exact instrument); s.7(f)–(g) for emergency/public-health processing history. ForumHospital grievance → Board; consumer fora for deficiency claims separately. Procedure & stageTriage: active-care file vs statutory file vs marketing data → retain first two narrowly with citation → erase the third → reply. RemedyReasoned retention + deletion balance. High Court connectionMedical-negligence suits in Kerala consumer/civil fora decide damages; DPDP decides retention legality. Documents normally requiredRetention policy citing exact norms, deletion scope, processor (lab/billing) cascade. LimitationPer the health-record retention instrument that binds the hospital (cite it) + limitation for foreseeable claims. **Can a hospital sell patient lists to a pharmacy?** No. That is a new purpose needing fresh s.5 notice + s.6 consent. Retention permission is not reuse permission. ## Grievance-first rule — Board will not hear you before the fiduciary does Principal jumps straight to the Board after one unanswered email to a generic info@ address. What it involvess.13(1) readily-available grievance means; s.13(2) prescribed response period; s.13(3) must exhaust before approaching Board; s.8(9)–(10) contact + mechanism. Relevant lawss.8(9)–(10), 13; s.27(1)(b) Board intake. ForumFiduciary/Consent Manager grievance → Board. Procedure & stageFile to published DPO/authorised contact → keep receipt + response window → escalate to Board with exhaust proof. RemedyBoard screens out premature complaints (s.28(3)–(4)); well-documented escalation proceeds. High Court connectionKerala complainants keep proof of Kerala-addressed grievance for Art.226(2) cause-of-action record if writ later needed. Documents normally requiredGrievance copy, delivery proof, response/waiting proof, DPO contact capture. LimitationResponse within the period the fiduciary publishes under Rules r.14(3), not exceeding 90 days; escalate to the Board after that window (s.13(3)). **No grievance contact published — can we go straight to the Board?** Document the absence (s.8(9)–(10) breach itself), send to recommended contact, then escalate with that proof. ## Data Principal duties + Rs.10,000 track — the quiet penalty on individuals Individuals file impersonated, suppressed-fact or bulk-troll requests believing only companies face consequences. What it involvess.15(a)–(e) + Schedule Sl.5 (up to Rs.10,000) + s.28(12) warning/costs for false/frivolous Board complaints. Relevant lawss.15, 28(12), 33 + Schedule Sl.5. ForumBoard. Procedure & stageFiduciary flags with evidence; Board hears the person (natural justice, s.28(6)) before warning/costs/penalty. RemedyWarning/costs/Rs.10k (to Consolidated Fund of India). Genuine complaints unaffected. High Court connectionTDSAT appeal (60 days) or writ on perversity/unfair hearing only. Documents normally requiredImpersonation/falsehood evidence, hearing record. LimitationTDSAT 60 days (s.29(2)). **Rs.10,000 — is that compensation to the company?** No. It is a State-levied penalty (s.34). Company loss needs a civil suit. More in this area ## Data protection & DPDP compliance: other matters - [Applicability, data fiduciaries, notices and consent](https://advaslam.com/practice/data-protection/matters/applicability-fiduciary-notices-consent/) - Rights, children, employees, CCTV and retention - [Vendors, security, breach and grievances](https://advaslam.com/practice/data-protection/matters/vendor-security-breach-grievance/) - [Significant data fiduciaries, the Board, TDSAT, e-sign and domains](https://advaslam.com/practice/data-protection/matters/sdf-board-tdsat-esign-domain/) - [AI governance and compliance](https://advaslam.com/practice/data-protection/matters/ai-governance/) [Every matter in this area, on one page →](https://advaslam.com/practice/data-protection/matters/) [Data protection & DPDP compliance: the practice area →](https://advaslam.com/practice/data-protection/) Procedure guides - [DPDP Readiness Checklist for Small Business](https://advaslam.com/guides/dpdp-readiness-checklist-small-business/) Contact [WhatsApp](https://wa.me/919497240215?text=Hello%2C%20I%20found%20advaslam.com%20and%20would%20like%20to%20discuss%20a%20matter.) [contact@advaslam.com](mailto:contact@advaslam.com) [+91 94972 40215](tel:+919497240215) 3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction, Ernakulam, Kerala 682031 · Monday – Saturday, 10:00 – 18:30 (by appointment) ```json {"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://advaslam.com/#website","url":"https://advaslam.com","name":"Adv. K J Muhammed Aslam","alternateName":"advaslam.com","publisher":{"@id":"https://advaslam.com/#person"},"inLanguage":"en-IN"},{"@type":"Person","@id":"https://advaslam.com/#person","name":"K J Muhammed Aslam","alternateName":["Adv. K J Muhammed Aslam","Advocate K J Muhammed Aslam","Muhammed Aslam K J","Adv. Aslam"],"honorificPrefix":"Adv.","jobTitle":"Advocate","description":"Advocate enrolled with the Bar Council of Kerala, practising from High Court Junction, Ernakulam: cyber and technology law, data protection (DPDP), business, banking and IPR, and litigation before the High Court of Kerala and the courts at Ernakulam.","url":"https://advaslam.com/profile/","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"alumniOf":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"memberOf":[{"@type":"Organization","name":"Bar Council of Kerala","url":"https://barcouncilkerala.org/lawyer-registry-list"},{"@type":"Organization","name":"Kerala High Court Advocates' Association","url":"https://khcaa.com/"}],"identifier":[{"@type":"PropertyValue","propertyID":"Bar Council of Kerala Enrolment No.","value":"K/001823/2026"},{"@type":"PropertyValue","propertyID":"KHCAA Membership No.","value":"OAJ 358"}],"knowsAbout":["Information Technology Act 2000","Cyber crime law","Technology law and technology contracts","Digital Personal Data Protection Act 2023","DPDP compliance","Data protection and privacy law","Business and commercial law","Contract drafting and negotiation","Banking and finance law","Negotiable Instruments Act cheque dishonour","SARFAESI Act","Intellectual property law","Copyright and trademark law","Patent infringement","GST and income-tax law","Blockchain and cryptocurrency technology","Web3 wallets and NFTs","Drone regulation and DigitalSky framework","Writ petitions under Article 226","Criminal law","Civil and consumer litigation","Family and succession law","Service and labour law","Legal drafting","Mediation and dispute resolution"],"knowsLanguage":["en","ml"],"workLocation":{"@id":"https://advaslam.com/#practice"},"hasCredential":[{"@type":"EducationalOccupationalCredential","credentialCategory":"Enrolment as an advocate","identifier":"K/001823/2026","recognizedBy":{"@type":"Organization","name":"Bar Council of Kerala"},"description":"Enrolled as an advocate with the Bar Council of Kerala (K/001823/2026), 2026"},{"@type":"EducationalOccupationalCredential","credentialCategory":"degree","educationalLevel":"Bachelor","recognizedBy":{"@type":"CollegeOrUniversity","name":"Bharata Mata School of Legal Studies"},"description":"BBA LLB (Hons.), Bharata Mata School of Legal Studies (2025)"},{"@type":"EducationalOccupationalCredential","credentialCategory":"Remote Pilot Certificate","recognizedBy":{"@type":"Organization","name":"Directorate General of Civil Aviation, India"},"description":"DGCA Remote Pilot Certificate, issued 2022"}],"subjectOf":[{"@type":"CreativeWork","name":"Govind Babu v. State of Kerala (Crl.M.C. No. 5640 of 2026, 2026:KER:69496)","url":"https://indiankanoon.org/doc/151180872/","datePublished":"2026-09-10","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Viji Sagar v. State of Kerala (Crl.M.C. No. 1603 of 2026, 2026:KER:20803)","url":"https://indiankanoon.org/doc/193042273/","datePublished":"2026-03-09","publisher":{"@type":"Organization","name":"High Court of Kerala"}},{"@type":"CreativeWork","name":"Anjana v. Manoharan A.P. (C.R.P. No. 442 of 2025, 2026:KER:10054)","url":"https://indiankanoon.org/doc/68585852/","datePublished":"2026-02-05","publisher":{"@type":"Organization","name":"High Court of Kerala"}}],"sameAs":["https://www.linkedin.com/in/azlubro","https://portal.khcaa.com/advocate?id=10480","https://lexosys.com"]},{"@type":"LegalService","@id":"https://advaslam.com/#practice","name":"Adv. K J Muhammed Aslam — Advocate, Ernakulam","url":"https://advaslam.com","image":"https://advaslam.com/og.png","telephone":"+919497240215","email":"contact@advaslam.com","address":{"@type":"PostalAddress","streetAddress":"3rd Floor, Lalan Towers (KGL Builders), Vanchi Square, High Court Junction","addressLocality":"Ernakulam","addressRegion":"Kerala","postalCode":"682031","addressCountry":"IN"},"geo":{"@type":"GeoCoordinates","latitude":9.9889,"longitude":76.2748},"hasMap":"https://www.google.com/maps/search/?api=1&query=Lalan+Towers+High+Court+Junction+Ernakulam","areaServed":[{"@type":"City","name":"Ernakulam"},{"@type":"City","name":"Kochi"},{"@type":"State","name":"Kerala"},{"@type":"Country","name":"India"}],"openingHoursSpecification":{"@type":"OpeningHoursSpecification","dayOfWeek":["Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],"opens":"10:00","closes":"18:30"},"founder":{"@id":"https://advaslam.com/#person"},"knowsAbout":["Cyber crime and IT Act matters","Data protection and DPDP Act compliance","Business, banking, intellectual property and tax","Legal drafting","Criminal law: bail, quash and appeals","Writ petitions before the High Court of Kerala","Civil, property and consumer matters","Family and succession matters","Service and labour matters"]},{"@type":"CollectionPage","name":"Rights, children, employees, CCTV and retention","description":"Rights, children, employees, CCTV and retention: 18 matters, each with the law, forum, procedure, documents and limitation. DSAR — right to access summary…","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/","inLanguage":"en-IN","dateModified":"2026-09-28T00:00:00.000Z","isPartOf":{"@id":"https://advaslam.com/#website"},"author":{"@id":"https://advaslam.com/#person"},"mainEntity":{"@type":"ItemList","numberOfItems":18,"itemListElement":[{"@type":"ListItem","position":1,"name":"DSAR — right to access summary, sharing trail and processing note (s.11)","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#dsar-right-to-access-summary-sharing-trail-and-processing-note-s11"},{"@type":"ListItem","position":2,"name":"Correction cascade — wrong phone, address or name across systems and vendors","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#correction-cascade-wrong-phone-address-or-name-across-systems-and-vendors"},{"@type":"ListItem","position":3,"name":"Erasure — delete me, unless purpose survives or law says keep","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#erasure-delete-me-unless-purpose-survives-or-law-says-keep"},{"@type":"ListItem","position":4,"name":"Nomination — s.14 nominee for death or incapacity","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#nomination-s14-nominee-for-death-or-incapacity"},{"@type":"ListItem","position":5,"name":"Section 15 defence — answering false, frivolous or impersonated requests","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#section-15-defence-answering-false-frivolous-or-impersonated-requests"},{"@type":"ListItem","position":6,"name":"Age-gating — verifiable parental consent before touching a child's data","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#age-gating-verifiable-parental-consent-before-touching-a-childs-data"},{"@type":"ListItem","position":7,"name":"No tracking, monitoring or targeted ads at children — s.9(3) hard line","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#no-tracking-monitoring-or-targeted-ads-at-children-s93-hard-line"},{"@type":"ListItem","position":8,"name":"Notified child-processing classes and verifiably-safe exemption — s.9(4)/(5) watch","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#notified-child-processing-classes-and-verifiably-safe-exemption-s945-watch"},{"@type":"ListItem","position":9,"name":"School-vendor pack — student app, bus GPS and fee-portal checklist","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#school-vendor-pack-student-app-bus-gps-and-fee-portal-checklist"},{"@type":"ListItem","position":10,"name":"HR pack — attendance, payroll and performance data under s.7(i)","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#hr-pack-attendance-payroll-and-performance-data-under-s7i"},{"@type":"ListItem","position":11,"name":"Ex-employee data — references, dues and deletion after exit","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#ex-employee-data-references-dues-and-deletion-after-exit"},{"@type":"ListItem","position":12,"name":"CCTV SOP — shop, clinic and apartment cameras with people data","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#cctv-sop-shop-clinic-and-apartment-cameras-with-people-data"},{"@type":"ListItem","position":13,"name":"Facial recognition on private premises — high-risk memo, default no","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#facial-recognition-on-private-premises-high-risk-memo-default-no"},{"@type":"ListItem","position":14,"name":"Retention schedules — purpose-over means delete, unless law says keep","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#retention-schedules-purpose-over-means-delete-unless-law-says-keep"},{"@type":"ListItem","position":15,"name":"PMLA/banking 10-year override — when another law beats erasure","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#pmlabanking-10-year-override-when-another-law-beats-erasure"},{"@type":"ListItem","position":16,"name":"Hospital retention — treatment records vs delete-me requests","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#hospital-retention-treatment-records-vs-delete-me-requests"},{"@type":"ListItem","position":17,"name":"Grievance-first rule — Board will not hear you before the fiduciary does","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#grievance-first-rule-board-will-not-hear-you-before-the-fiduciary-does"},{"@type":"ListItem","position":18,"name":"Data Principal duties + Rs.10,000 track — the quiet penalty on individuals","url":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#data-principal-duties-rs10000-track-the-quiet-penalty-on-individuals"}]}},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://advaslam.com/"},{"@type":"ListItem","position":2,"name":"Practice","item":"https://advaslam.com/practice/"},{"@type":"ListItem","position":3,"name":"Data protection & DPDP compliance","item":"https://advaslam.com/practice/data-protection/"},{"@type":"ListItem","position":4,"name":"Matters","item":"https://advaslam.com/practice/data-protection/matters/"},{"@type":"ListItem","position":5,"name":"Rights, children, employees, CCTV and retention","item":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/"}]},{"@type":"FAQPage","@id":"https://advaslam.com/practice/data-protection/matters/rights-children-employee-cctv-retention/#faq","isPartOf":{"@id":"https://advaslam.com/#website"},"mainEntity":[{"@type":"Question","name":"Must we reveal a police request?","acceptedAnswer":{"@type":"Answer","text":"s.11(2) protects qualifying law-enforcement sharing. Record the written request and legal authorisation; do not volunteer beyond the section."}},{"@type":"Question","name":"Customer gives forged proof to 'correct' records?","acceptedAnswer":{"@type":"Answer","text":"s.15(e) requires verifiably authentic info; false material risks s.15/s.28(12) consequences. Verify before overwriting."}},{"@type":"Question","name":"Erase means destroy backups too?","acceptedAnswer":{"@type":"Answer","text":"On Act text, cause processors to erase and erase what you control unless law requires retention; document backup-cycle deletion technically and honestly."}},{"@type":"Question","name":"Is this like a bank nominee?","acceptedAnswer":{"@type":"Answer","text":"Functionally similar: a stand-in for DPDP rights only, not ownership of property."}},{"@type":"Question","name":"Can we ignore a rude request?","acceptedAnswer":{"@type":"Answer","text":"No. Rudeness is not frivolity. Test impersonation/falsity on evidence, respond promptly (grievances within your published r.14(3) period), and record reasons."}},{"@type":"Question","name":"Is 16+ old enough to consent alone?","acceptedAnswer":{"@type":"Answer","text":"On Act text, no: a child is anyone under 18 (s.2(f)). Relief exists only for the classes/purposes in Rules r.12 + Fourth Schedule, or for a fiduciary covered by a s.9(5) age notification."}},{"@type":"Question","name":"Contextual ad on a kids page — barred?","acceptedAnswer":{"@type":"Answer","text":"s.9(3) bars targeted advertising directed at children and tracking/behavioural monitoring of children. Get a build-specific review; do not self-certify."}},{"@type":"Question","name":"Government school portal — automatically exempt?","acceptedAnswer":{"@type":"Answer","text":"No automatic exemption. Fourth Schedule Part A covers an educational institution only for tracking/behavioural monitoring for its educational activities or children's safety, and Part B covers State subsidy/benefit processing only to the extent necessary. Anything beyond needs parental consent."}},{"@type":"Question","name":"Can the school rely on admission-form consent for all apps?","acceptedAnswer":{"@type":"Answer","text":"Only if each specified purpose + data was stated. New app/new purpose needs fresh notice/consent."}},{"@type":"Question","name":"Can HR read staff email freely under 7(i)?","acceptedAnswer":{"@type":"Answer","text":"Only as far as necessary for the stated employment/safeguarding purpose and proportionate. Blanket reading is not covered. Take advice."}},{"@type":"Question","name":"Must we delete a reference on demand?","acceptedAnswer":{"@type":"Answer","text":"If no purpose or law requires keeping it, erase. If a live dispute/dues file needs it, retain narrowly with reasons."}},{"@type":"Question","name":"Can we keep footage 'just in case' for a year?","acceptedAnswer":{"@type":"Answer","text":"s.8(7) says erase when purpose over unless law requires keeping. Fix a reasoned cycle, not indefinite storage."}},{"@type":"Question","name":"Vendor says FR is 'DPDP-certified' — enough?","acceptedAnswer":{"@type":"Answer","text":"No certification exists under the Act. The fiduciary still proves ss.4–8 compliance."}},{"@type":"Question","name":"Can the notice say 'we keep data indefinitely'?","acceptedAnswer":{"@type":"Answer","text":"That defeats s.8(7). State a period or a purpose-linked trigger and delete on it."}},{"@type":"Question","name":"Keep everything because 'PMLA says so'?","acceptedAnswer":{"@type":"Answer","text":"No. Keep what that law requires, for as long as it requires. Marketing and optional data still goes."}},{"@type":"Question","name":"Can a hospital sell patient lists to a pharmacy?","acceptedAnswer":{"@type":"Answer","text":"No. That is a new purpose needing fresh s.5 notice + s.6 consent. Retention permission is not reuse permission."}},{"@type":"Question","name":"No grievance contact published — can we go straight to the Board?","acceptedAnswer":{"@type":"Answer","text":"Document the absence (s.8(9)–(10) breach itself), send to recommended contact, then escalate with that proof."}},{"@type":"Question","name":"Rs.10,000 — is that compensation to the company?","acceptedAnswer":{"@type":"Answer","text":"No. It is a State-levied penalty (s.34). Company loss needs a civil suit."}}]}]} ```