DPDP Act Compliance for Maritime and Shipping
Seafarer data governance for shipowners, managers, and manning agents
India supplies among the largest seafarer workforces in the world. Manning agents, shipowners, and maritime training institutes process CDC and INDoS identifiers, medical fitness records, and employment histories that flow to foreign owners and flag states — all now under the DPDP Act. TruePrivacy governs the seafarer data lifecycle end to end.
What DPDP Act requires of maritime & shipping
Consent beyond the employment purpose
Recruitment-necessary processing differs from talent-pool databases, marketing to candidates, and sharing beyond the engaged vessel — the latter need itemised consent.
Seafarer identity and medical records
CDC, INDoS, passport, and medical fitness data demand the Act's reasonable security safeguards at their highest — breach penalties reach ₹250 crore.
Erasure vs Merchant Shipping retention
Articles of agreement, crew records, and RPSL placement registers carry statutory retention under DG Shipping rules — erasure requests must split, not be refused wholesale.
Global disclosure chains
Seafarer data flows to foreign owners, flag administrations, P&I clubs, and port agents — each a recipient the access right requires you to disclose.
Cross-border transfers under Section 16
Crew data routinely leaves India to owners and registries worldwide — permitted today under the blacklist model, but restricted-country notifications must be monitored.
Notify-everything breach regime
Every breach of seafarer data triggers intimations to affected crew and the Data Protection Board, the 72-hour detailed report, and CERT-In's 6-hour clock.
How TruePrivacy helps
Seafarer data inventory
CDC, INDoS, certificates, medical records, and employment histories classified across crewing systems, with every processing purpose mapped to consent or legitimate use.
Multilingual consent capture
Itemised consent at registration and placement, with notices in scheduled languages matching your crew's home states — recorded immutably per purpose.
DG Shipping retention matrix
Crew agreements, placement registers, and medical classes mapped to their Merchant Shipping and RPSL provisions, with holds enforced and expiry-triggered deletion evidenced.
Recipient and transfer mapping
Foreign owners, flag states, P&I clubs, and agents modelled as recipients — powering accurate access-request disclosures and Section 16 transfer monitoring.
Crew rights and breach workflows
Verified access, correction, and erasure requests with split responses, plus one incident record driving CERT-In, Board, and crew intimations.
“Twenty years of crew files, three crewing offices, and every placement shared with a different foreign owner — we couldn't have answered a single access request honestly. TruePrivacy mapped the whole chain, and now a seafarer's request returns exactly who received what, with retention cited where DG Shipping rules apply.”
Frequently asked questions
Can a seafarer demand deletion of their placement and service records?
Not while Merchant Shipping rules and RPSL obligations require them — those records are held with the provision documented, while talent-pool profiles, marketing data, and lapsed applications are erased. TruePrivacy generates the split response and schedules deletion when statutory periods expire.
We share crew data with foreign shipowners. Is that allowed under DPDP?
Yes — Section 16 permits transfers to any country not on a notified restriction list, and no list has been notified as of mid-2026. But recipients must be disclosed in access responses and the purpose covered by consent or the employment relationship. TruePrivacy inventories every flow and monitors for restriction notifications.
Are manning agents fiduciaries or processors?
An RPSL agent deciding how candidate pools are built and marketed is a fiduciary for that processing; when handling data strictly on an owner's instructions, it acts closer to a processor. TruePrivacy documents the role per relationship so obligations — consent, notices, breach duties — sit with the right entity.
What about medical fitness records from company-mandated examinations?
They're personal data processed for the employment purpose, held under statutory and MLC-aligned retention, and demand the strongest safeguards. TruePrivacy quarantines medical classes behind role-based access, logs every retrieval, and includes them in access responses with retention explained.
Get DPDP Act-ready
Book a 30-minute demo and see how TruePrivacy handles DPDP Act compliance for maritime & shipping.
Free 14-day trial · No credit card required · Setup in minutes