DPDP Act vs E-Waste Rules: Two Laws, One Retired Laptop
Two laws, two different questions
When a company retires a laptop, two Indian laws are in play at once. The Digital Personal Data Protection Act, 2023 asks what happened to the personal data on it. The E-Waste (Management) Rules, 2022 ask what happened to the hardware. A vendor can satisfy one and ignore the other, which is how most disposal gaps start.
Side by side
| DPDP Act and Rules | E-Waste (Management) Rules, 2022 | |
|---|---|---|
| What it governs | Personal data on the device | The device as electronic waste |
| Who it binds | Every Data Fiduciary, of any size | Bulk consumers, producers, refurbishers and recyclers |
| Your core duty | Reasonable security safeguards; erase data once its purpose is served; keep data and logs for at least a year | Hand e-waste only to a registered producer, refurbisher or recycler |
| In force | Most duties from 13 May 2027 | Since 1 April 2023 |
| Penalty | Up to ₹250 crore for failed safeguards | Environmental compensation under the Rules |
| Proof | Erasure reports, destruction certificates | Handover to a registered recycler, recycling certificate |
Are you a bulk consumer?
Rule 3 of the E-Waste Rules defines a bulk consumer as an entity that has used at least 1,000 units of the listed electrical and electronic equipment, which includes laptops, PCs, printers and copiers, at any point in a financial year. Most mid-size and large offices qualify.
Rule 8 then gives bulk consumers one duty: e-waste must be handed over only to a registered producer, refurbisher or recycler. The Rules do not ask bulk consumers to register or file returns; those duties fall on producers, refurbishers and recyclers. Keeping the handover documents is still the only way to show you did it.
Where companies fall between the two
- The recycler that never touches the data. An authorised recycler satisfies the E-Waste Rules, but if drives go into its shredder queue unrecorded, you cannot show what happened to the data.
- The data wipe with no trail for the hardware. A contractor who wipes drives onsite and then sells the machines to an unregistered buyer leaves you exposed under the E-Waste Rules.
- The scrap sale. Selling by the kilo usually fails both laws at once.
Documents that cover both
- A pickup manifest signed at your premises, naming the registered recycler.
- Per-drive erasure reports or destruction certificates with serial numbers.
- A Certificate of E-Waste Recycling for the quantity processed.
With those three, you can answer both laws’ questions from one file. See how a destruction certificate differs from a recycling certificate.
Related reading
