Contractor management under the OSH Code: what principal employers check at the gate

What is a contractor management system, and how is it different from visitor management?

A visitor management system handles a visit: who came, who approved, when they left. A contractor management system handles a relationship that can last years, with four checkpoints:

1. Before award: is the firm licensed where the law needs it, and may this work go to contract labour at all?
2. Before first entry: who is coming, are they inducted, and is identity verified where your policy calls for it?
3. Every day at the gate: is this worker on a current list, with a valid pass, and in the headcount?
4. At close: the pass ends with the work order and the records you must keep are kept.

What does the OSH Code 2020 ask of a principal employer?

The Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025 and replaced thirteen labour laws, including the Contract Labour (Regulation and Abolition) Act, 1970 (Trilegal). Contract labour sits in Part I of Chapter XI. In our words:

Security, housekeeping, canteen, transport and similar support work is non-core unless the establishment was set up for it (section 2(1)(p)). Section 97 makes contravening any provision of the Code or its rules, or an order regulating the employment of contract labour, liable to a penalty of ₹50,000 to ₹1 lakh; a second conviction under the same provision can bring up to three months’ imprisonment, a fine of up to ₹2 lakh, or both. Failing to keep registers or file returns carries its own penalty of ₹50,000 to ₹1 lakh (section 96).

Does the OSH Code apply to offices and tech parks, or only plants?

It applies to offices. An “establishment” includes any place where “any industry, trade, business, manufacturing or occupation is carried on” with ten or more workers (section 2(1)(v)). Housekeeping, security, cafeteria, drivers and technicians from four or five vendors can pass 50 contract workers unnoticed. Three points catch offices out:

• Who is the principal employer? In a multi-tenant tower the landlord or its facility manager usually engages common-area housekeeping and security; each tenant engages its own pantry staff and fit-out crews. See our guide to multi-tenant towers.
• Fit-outs can be construction work. “Building or other construction work” includes alteration, repairs and maintenance (section 2(1)(h)), one of the activities where section 6(1)(h) makes the employer answer for everyone on the premises.
• Central or state rules. The Central Rules govern where the Centre is the appropriate government: banks, insurance, telecom, air transport, major ports, railways, mines and central public sector enterprises (Lakshmikumaran & Sridharan; Anhad Law). Most private offices and plants follow state rules.

The OSH (Central) Rules 2026 and state rules: licences, forms and returns

The OSH (Central) Rules, 2026 were notified as G.S.R. 345(E) on 8 May 2026 and came into force on publication, superseding fifteen older sets of central rules, including the Contract Labour (Regulation and Abolition) Central Rules, 1971. The contract labour rules are rules 85 to 101 of the Gazette text.

• Licence: a contractor within one state applies in FORM-XXI on the Shram Suvidha portal (rule 87); a single licence for several states or all of India is decided within 45 days, or deemed granted, and is valid for five years (rule 88).
• Threshold and deposit: the licence fee table says no licence is required up to 49 contract workers (rule 90(4)); before a licence issues the contractor lodges a bank guarantee of ₹1,000 per worker (rule 90(1)).
• Work orders: the contractor reports each work order on the portal within 15 days, with the principal employer’s name, the premises, start date, worker numbers and duration (rule 94).
• Welfare: where contract labour works on its premises, the principal employer provides toilets, washrooms, drinking water, bathing facilities if required, a changing room, a first aid box, a canteen and a crèche; the contractor provides everything else (rule 86(1)(iii) and (iv)).
• Wages: if the contractor has not paid within seven days of the end of the wage period, the principal employer pays in full or the unpaid balance within 15 days, then recovers (rule 98(8)). The contractor files a half-yearly return in FORM-XVIII (rule 98(7)).
• Grievances: the principal employer sets up a committee, with the contractor represented, that settles contract workers’ grievances on health, working conditions and wages within 30 days (rule 184).
• Core activity disputes: an aggrieved party applies to the Central Government, and no adverse action is taken while the question is pending (rule 101). A Ministry order of 7 July 2026 gives a designated authority 60 days to report and the Ministry 30 days after that to decide (SCC Online).
• Registers and returns: every employer keeps an employee register (FORM XIII), an attendance register-cum-muster roll (FORM XIV) and a wages register (FORM XV), electronically or otherwise, for five calendar years from the last entry (rule 72). The principal employer files Part III of the annual return in FORM-XVII by the last day of February, except for contracts to produce a given result (rule 98(9)). It asks for each contractor’s name, address and LIN, the work, the maximum contract workers, wage bill payments and any wages you paid directly.

The 2026 Rules drop the 1971 rules’ register of contractors (Form XII; Lakshmikumaran & Sridharan). Instead, the establishment’s registration in FORM-I (rule 3) lists each contractor’s name, contact details, work, maximum contract labour and dates, and rule 3(8) asks for changes to FORM-I to be updated on the portal within 30 days.

State rules. Trilegal reads the Ministry’s transition statement as keeping rules under the old Acts in force, where consistent with the Codes, until a state notifies its own. Rajasthan, Bihar and Andhra Pradesh notified final OSH rules between June and August 2026, while Maharashtra, Karnataka, Tamil Nadu and Delhi still had drafts (Lakshmikumaran & Sridharan state tracker). Check your state’s status before you print any form.

Contractor onboarding checklist: before the first day

1. Count contract workers across all contractors on your busiest day of the last twelve months, and record whether section 45 applies.
2. For each contractor that needs a licence (under the Central Rules, one with 50 or more contract workers), get a copy and check its validity, its maximum number of workers and that it covers this work. Where a smaller contractor works at a site where Part I applies, ask counsel whether your state’s rules need one.
3. Ask for proof that the contractor reported your work order on the portal within 15 days, and update the contractor details in your own registration within 30 days (Central Rules, rules 94 and 3(8)).
4. Record why the work is not a core activity under section 57, or which exception applies.
5. Check specialist licences, such as a security agency’s licence under the Private Security Agencies (Regulation) Act, 2005 (MHA portal).
6. Get a named worker list with roles, supervisor and emergency contact, and agree that changes reach you before the worker does.
7. Verify identity where your policy calls for it; record who verified and when, not a copy of the document.
8. Complete the safety induction and site rules (photography, phones, escorts, confidentiality) before first entry, in a language each worker reads.
9. Decide areas, shifts and pass end date, matched to the work order end date.
10. Link permit-to-work to the induction record for hot work, height, confined space or electrical isolation.
11. Confirm contract workers can use your welfare facilities.
12. Agree monthly proof of electronic wage payment and of PF and ESI contributions, and a copy of each half-yearly return.
13. Put data protection terms in the contract: who decides what about each worker’s data, retention and deletion at exit.

Contractor safety induction: what to cover and what to record

The Code’s duty to give employees information, instruction, training and supervision sits in section 6(2)(c), framed particularly for factories, mines, dock work, construction and plantations; the contractor, also an “employer” (section 2(1)(u)), owes its own workers the same. ISO 45001:2018 asks organisations to coordinate with contractors on hazards running both ways and to others, and to apply OH&S criteria when selecting contractors (clause 8.1.4.2, under procurement; Ecesis). As of October 2026 the 2018 edition is current; the revision, at draft stage, is expected no earlier than April 2027 (SQS).

What a contractor induction should cover

1. Site layout, exits, assembly points, alarm sounds, and who counts them in an evacuation.
2. Hazards of their work areas, and areas they may not enter.
3. PPE required, and where to get it.
4. Permit-to-work: which jobs need one and who issues it.
5. Reporting injuries, near misses and unsafe conditions.
6. House rules: smoking, alcohol, phones, photography, escorts, confidentiality.
7. Welfare facilities and first aid.

What the induction record holds

Contractor gate pass format

One pass per contract worker; placeholders are in brackets. Material, vehicle and visitor passes are separate: see our gate pass format templates, and for the guard’s side of the check, our security guard SOP for visitor entry.

The daily gate log adds time in, time out and gate; headcounts and wage disputes rest on those times.

At the gate: three scenarios

6:45 am, housekeeping shift change at a tech park office. A replacement arrives for a worker on leave, and Kavita Nair, the facility executive, sees the name is not on the list. The supervisor adds the worker, who completes the induction on a phone in the lobby; the host approves.

11:30 am, a fit-out crew on the ninth floor. A tenant’s interior contractor brings fourteen workers. The guard checks each against the list and induction record; the landlord’s hot-work permit names the four who will cut. The tenant engaged the crew, so it is usually their principal employer.

9:10 pm, an AMC technician at a data centre. The UPS vendor’s engineer arrives for a fault. The host is off shift, so the named backup approves; the engineer is escorted and stays in the headcount until he leaves.

Contract worker data under the DPDP Act

Contractor lists, induction records and gate logs are digital personal data. Most duties under the DPDP Rules 2025 apply from 13 May 2027 (Rule 1(4)); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027. A proposal to shorten the timeline was floated in January 2026 (Business Standard); as of 12 October 2026 no change had been notified (S.S. Rana & Co.).

• Who decides what. PSA Legal (August 2026) treats the contractor as data fiduciary for payroll and deployment records, and the principal employer as one in its own right for site access, CCTV and safety training.
• Notice. Give an itemised notice in English or any Eighth Schedule language the worker chooses (section 5(3)); we advise English, Hindi and the state’s main language at the gate.
• Retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and processing logs “for the purposes as specified in the Seventh Schedule”, which Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read as binding every data fiduciary. Keep the visit record and its logs for one year, and photos and mobile numbers for days, as a decision your DPO and counsel sign off. Registers another law requires follow that law (section 8(7)).

Common mistakes in contractor management

• Counting one contract at a time. Four vendors with 15 workers each make 60 contract workers.
• Stale lists. Replacements arrive and the gate list is months old.
• Contractors outside the headcount. Employees are counted at the assembly point; the housekeeping crew is not. See our evacuation roll call guide.
• Monthly passes with no end date, still valid after the work order ends.
• ID copies in a drawer, or the register photographed for a WhatsApp group.

Where Orb fits

Orb, our visitor management system, runs the gate side of contractor management with nothing to install on site.

Questions buyers ask