DPDP Act and your visitor register: what Indian offices must do by 13 May 2027

Does the DPDP Act cover your visitor register?

The Act applies to personal data collected in digital form, or collected otherwise and digitised later (section 3). Personal data is any data about an identifiable person (section 2(t)), so a visitor's name, mobile, company, photo, ID details and vehicle number all qualify. At your entrance:

• A visitor app, tablet, QR check-in or kiosk: covered.
• A spreadsheet the desk types names into: covered.
• A logbook the guard photographs and sends on WhatsApp at the end of the shift: covered from the moment it is photographed. This is the most common case we see, and most teams do not realise it.
• A logbook never scanned, photographed or typed up: outside the Act. This is rare, and it fails every other test a security audit applies.

The dates that matter

Rule 1(4) sets the main date at eighteen months after publication, which gives 13 May 2027. Some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027 (and 14 November 2026 for consent managers). A proposal to shorten the timeline to twelve months was floated in January 2026, possibly only for significant data fiduciaries. As of 12 October 2026 no change had been notified; S.S. Rana & Co., writing that day on the Removal of Difficulties Order of 5 October 2026 (wording fixes to sections 9 and 10), still gives May 2027.

Until then, section 43A of the IT Act and the 2011 SPDI Rules still govern sensitive personal data. Section 44(2) of the DPDP Act repeals section 43A from the eighteen-month date.

Your legal basis for visitor data

The Act gives two routes: consent (section 6), or one of the certain legitimate uses in section 7. This is where most published advice goes wrong.

• There is no general security or legitimate interest ground. Several vendor articles claim one. Section 7 does not contain it. Do not rest routine entry logging on the offences exemption in section 17(1)(c) without counsel's view.
• Employees are different. Section 7(i) covers employment and protecting the employer from loss or liability, which commentators read as covering employees, not visitors. Contract labour is unsettled.
• Section 7(a), data a person voluntarily provided, is arguable for visitors who hand over details to get in. JSA calls the meaning of voluntary ambiguous, and we found no regulator guidance applying it to visitor logs.

What the notice at your entrance must say

Before you collect anything, the visitor must see a notice (section 5, Rule 3). It must be:

• understandable on its own, without anything else you have published;
• in clear and plain language, itemising the data you collect and the purpose of each item;
• clear on how to withdraw consent, exercise their rights and complain to the Data Protection Board, with a link to your website or app;
• available, at the visitor's option, in English or any of the 22 languages in the Eighth Schedule to the Constitution (section 5(3)). Whether you must have all 22 ready in advance is unsettled.

A QR code at the door can carry the notice, as long as the visitor sees it before the first question.

Consent that holds up

Consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action (section 6(1)). In a lobby that means:

• a separate choice for each purpose, nothing pre-ticked;
• a real action from the visitor, not silence or a guard ticking a box for them;
• withdrawal as easy as giving consent (section 6(4)), and processing stops within a reasonable time once it is withdrawn, including at your vendor, unless a law requires otherwise (section 6(6)).

Keeping visitor data safe

Section 8(5) requires reasonable security safeguards. Rule 6 sets the minimum:

1. encryption, masking or tokens for the data;
2. access control, including over your vendor's systems;
3. logs of who accessed the data, with monitoring and review;
4. backups and continuity;
5. logs and personal data kept for one year, unless another law says otherwise;
6. security terms in your contract with any processor;
7. appropriate technical and organisational measures.

What a weak lobby looks like:

When something goes wrong: breach notice

A personal data breach includes accidental disclosure (section 2(u)), and there is no harm threshold. If it happens you must tell the Data Protection Board and every affected person (section 8(6), Rule 7):

Lobby scenarios that can count:

• a guard's phone with register photos is lost;
• a reception tablet with the day's check-ins is stolen;
• a visitor list goes to the wrong WhatsApp group;
• a vendor reports an incident in its cloud.

How long to keep visitor records

What the law says:

• Erase when the purpose is served or consent is withdrawn, whichever is earlier, and make your vendor erase too, unless another law requires you to keep the data (section 8(7)).
• But keep personal data, associated traffic data and processing logs for at least one year from the date of processing, for the purposes as specified in the Seventh Schedule (Rule 8(3)). These are State purposes (national security, functions under other laws, and assessing significant data fiduciaries). Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read the rule as binding every data fiduciary, large platform or not. Lakshmikumaran & Sridharan add that it does not cover secondary uses, so it is no licence to reuse the data.
• The 48-hour we are about to erase your data notice does not apply to you. It covers only the large e-commerce, social media and gaming platforms in the Third Schedule, which several articles miss.

Section 8(7) gives way to retention another law requires, so Rule 8(3) governs the first year. Nobody has yet tested how far it reaches into details such as photos. Vendor articles that say delete visitor photos within 24 hours rarely mention the one-year rule. Shorter is safer for the visitor, and it is a choice to make knowingly.

Visitors under 18

A child is anyone under 18 (section 2(f)). Processing a child's data needs verifiable consent from the parent or lawful guardian (section 9(1), Rule 10), and you may not track or monitor children's behaviour (section 9(3)).

Requests from visitors

Visitors can ask to see, correct or erase their data, and raise a grievance (sections 11 to 14). Publish how, and answer a grievance within a reasonable period of no more than 90 days (Rule 14). Also publish the contact details of a person who can answer questions about their data (Rule 9). If a visitor asks for erasure inside the first year, section 12(3) lets you keep what a law requires; erase everything else, and tell the visitor what you kept and until when.

If you already use a visitor management system

You are still responsible. The Act makes the data fiduciary liable irrespective of any agreement to the contrary, including for its processor (section 8(1)), and you may use a processor only under a valid contract (section 8(2)). Your vendor's compliance badge does not transfer that duty. This is the plan we run with clients in the first 30 days.

1. Map what your system actually collects

   Open the check-in flow as a visitor and list every field, from name and mobile to photo, ID details, vehicle number and signature. Mark which are needed to let someone in; everything else is a candidate to switch off.

2. Check the record-keeping configuration

   Check retention for each data item, whether photos and ID images are kept, who can export visitor lists, whether access is logged, and whether guards' devices store data locally.

3. Ask your vendor these questions in writing

   1. What personal data do you collect, and for which purpose is each item used?
   2. Where is it stored, and in which country and cloud region?
   3. Which subprocessors handle it (messaging, SMS, ID checks, hosting)?
   4. Is it encrypted in transit and at rest, and who holds the keys?
   5. Is every access to a visitor record logged, including your own support staff?
   6. Can we set retention for each data item, and can you prove erasure?
   7. How fast will you tell us about a breach, in hours?
   8. Will you sign our data processing agreement, including breach timelines and audit rights?
   9. What independent evidence can you share, such as audit reports, penetration test summaries and certification scopes?
   10. When we leave, how do we get our data out, and when is it erased?

4. Sign a data processing agreement

   Cover the Rule 6(1)(f) security terms, erasure on your instruction and at exit, stopping processing on withdrawal of consent, breach notice within fixed hours, subprocessor changes and your right to audit.

5. Run a vendor risk assessment

   Rate the inherent risk first (photos, ID data and storage outside your control push it up), then score the vendor's answers, record the residual risk and decide to accept, accept with conditions, or replace. Repeat it yearly and whenever the vendor changes how it processes your data.

6. Fix the front of house

   Update the notice and consent flow, train reception and guards on the desk route, and give the security supervisor the breach runbook.

If you still run a manual register

The fastest improvement is to remove the open register:

1. stop photographing register pages and sharing them in chats;
2. move check-in to a system that shows each visitor only their own entry;
3. put a notice and consent step before the first question;
4. keep the visit record for one year and photos and mobile numbers for days, with erasure on schedule;
5. make sure every access to the records is logged.

Multi-tenant buildings: who is responsible?

The Act does not mention landlords or tenants. The data fiduciary is whoever decides why and how data is processed, alone or with others (section 2(i)), so a building and a tenant can both be fiduciaries for one visit.

• The building runs one lobby for every tenant: whoever decides how that lobby works, usually the owner or its management company, is likely the fiduciary. A facility management firm that only follows the owner's instructions is more likely a processor, like the visitor management vendor.
• A tenant pre-registers its own guests and sees their records: the tenant and the building likely decide together, which can make them joint fiduciaries for those guests; write down who does what.
• Each tenant runs its own reception inside the building: each tenant is the fiduciary for its own register.

Where Orb fits

We built Orb for the gaps above. It fits best when:

Penalties

The Schedule to the Act sets the maximum penalty for each type of breach. The Board decides the amount in each case, weighing the nature, gravity and duration of the breach, the data affected, any repetition, any gain made and any steps taken to limit the harm (section 33(2)).

Your lobby checklist before 13 May 2027

1. List every place visitor data lives: register, spreadsheet, app, tablets, guard phones, chats, tenant emails.
2. Stop photographing or sharing register pages.
3. Collect only what you need to let someone in.
4. Show an itemised notice before the first question, in English, Hindi and your city's main language, with other Eighth Schedule languages on request.
5. Record consent item by item, with the notice version and language.
6. Give visitors who decline the digital flow a desk route.
7. Log every access to visitor records.
8. Keep the visit record and logs for one year, photos and mobile numbers for days, erase on schedule, and keep proof.
9. Sign a data processing agreement with your vendor and run a vendor risk assessment.
10. Write and test a one-page breach runbook with the 72-hour Board deadline.

Questions buyers ask