What changed for visitor management in India in 2025 and 2026: a dated change log

The 2025 and 2026 change log at a glance

Newest first; each change has a section below.

Coming next: DPDP Rule 4 (consent managers) from 13 November 2026, then the CEA power sector regulations from 1 April 2027 and the core DPDP duties from 13 May 2027.

DPDP Rules 2025 timeline: what is in force and the October 2026 order

• What changed: the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) gave the DPDP Act 2023 its working detail. The DPDP (Removal of Difficulties) Order 2026 (S.O. 5458(E), 5 October 2026) only adjusted wording in sections 9(1) and 10(2)(c)(ii), changes S.S. Rana & Co. calls “largely clarificatory”.
• Dates: definitions and the Data Protection Board rules from 13 November 2025; Rule 4 (consent managers) from 13 November 2026; Rules 3, 5 to 16, 22 and 23, covering notice, security, breach, retention, children and rights, from 13 May 2027 (SCC Online). Rule 1(4) says eighteen months after publication; Cyril Amarchand Mangaldas counts from the next day and gives 14 May 2027.
• The proposal: on 22 January 2026 Business Standard reported that MeitY might cut the runway to 12 months for significant data fiduciaries and bring the one-year retention duty in within 90 days of an amendment. As of 12 October 2026 no change had been notified; S.S. Rana & Co.’s note on the October order still gives May 2027 for the core duties.
• Who it applies to: any organisation whose visitor records are digital or digitised, including spreadsheets and logbooks photographed for WhatsApp.

At the front desk and gate. From May 2027 each visitor sees a standalone notice in clear language before giving details (Rule 3), available in English or any of the 22 Eighth Schedule languages (section 5(3)). Rule 8(3) asks for personal data, associated traffic data and processing logs to be kept for at least one year “for the purposes as specified in the Seventh Schedule”; Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. A breach goes to the Board without delay, with a full report within 72 hours (Rule 7). Schedule penalties reach ₹250 crore for security safeguards, as maximums the Board sizes under section 33(2).

OSH Code contractor safety: what the labour codes mean at the gate

• What changed: the Occupational Safety, Health and Working Conditions Code, 2020 came into force on 21 November 2025 with the other three labour codes, consolidating laws including the Factories Act and the Contract Labour Act (India Code; Trilegal). The OSH (Central) Rules 2026, G.S.R. 345(E), came into force on 8 May 2026 (Taxmann; SCC Online).
• Who it applies to: the Central Rules cover central-sphere establishments such as railways, mines, major ports, banking and insurance; most private sites depend on state rules (Anhad Law), and Trilegal reads the old rules as continuing until states notify new ones. Maharashtra’s draft rules took objections until 14 June 2026 (Lexplosion); we found no final version.
• People on site: for factories, mines, dock work, construction and plantations, section 6(1)(h) makes the employer responsible for the safety and health of “employees, workers and other persons who are on the work premises”, “with or without his knowledge”; section 6(2)(c) adds “information, instruction, training and supervision” for “all employees at work”. The contract labour chapter now starts at 50 contract workers, up from 20, and welfare facilities move to the principal employer (Lakshmikumaran & Sridharan).

At the front desk and gate. A contractor, AMC technician or visiting auditor on the shop floor is someone the employer answers for. Brief them before they reach the work area, record it, and know how many contract workers are inside for the evacuation count.

NBCS 2026: the new building code and fire safety in your lobby

• What changed: on 30 April 2026 the Bureau of Indian Standards established SP 7:2026, the National Building Construction Standards 2026, and withdrew NBC 2016 (Gazette of India).
• Three changes that matter: the high-rise threshold moves from 15 m to 24 m (Part F, clause 2.39), though several states set 15 m in their own fire laws and development rules, which NBCS 2026 does not override (Sparrow RMS). Part F has no fire drill and evacuation annex; Annex D now covers “Additional requirements for high rise buildings”. The foreword says the document “is voluntary in nature and is non-binding”.
• Who it applies to: buildings where a state, local body or contract adopts it. Inspectors enforce state fire laws, byelaws and NOC conditions, many written against NBC 2016.

At the front desk and gate. Nothing here lowers the need to know who is inside. Keep a live register of visitors and contractors, and keep drilling: NBC 2016 Annex D asked high-rise buildings to drill every three months in their first two years and every six months after that, and to keep drill records for three years. Goa’s factory inspectorate set drills “at least once in every three months” for factories in December 2025. In a real alarm, report anyone unaccounted for to the fire service at once, sweep only where it is safe, and let only the fire officer in charge clear re-entry.

ISO 27001:2013 certificates ended and the IAF closed

• What changed: under IAF MD 26, “All certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period”, which closed on 31 October 2025 (INAB). The International Accreditation Forum ceased operations on 1 January 2026, when the Global Accreditation Cooperation Incorporated (Global ACI) began full operations; accreditations under the IAF MLA continue to be recognised (IAF). ISO/IEC 27701:2025, published in October 2025, is now a standalone privacy management standard (ISO).
• Who it applies to: ISO 27001 certified organisations.

At the front desk and gate. Auditors test the lobby against Annex A 7.2, “Physical entry”, which also absorbed the old delivery and loading areas control. Policies, contracts and Statements of Applicability that still cite A.11.1.2 signal an ISMS that has not been maintained.

Immigration and Foreigners Act 2025 reporting: who must report foreigners

• What changed: the Immigration and Foreigners Act, 2025 (Act 13 of 2025) came into force on 1 September 2025 (SCC Online), and section 36 repeals four older laws, including the Foreigners Act 1946. The Immigration and Foreigners Rules, 2025 (G.S.R. 596(E)) and Order, 2025 (S.O. 3986(E)) are dated the same day.
• Who must report: keepers of accommodation, meaning “a temporary or permanent premises of any nature” (sections 2(a) and 8, with a proviso for non-commercial residential premises), which Rule 17 extends to hostels, rented rooms, home stays and religious premises; any “institution admitting any foreigner” (section 9); and hospitals and nursing homes, for foreign inpatients and attendants (section 10).
• Other duties: private power, water and petroleum undertakings, and firms in sectors such as defence, space and nuclear energy, must give the civil authority details of the foreigners they employ (Order, paragraph 9(5)). In protected or restricted areas and prohibited places, the civil authority can require anyone to report foreigners on their premises (paragraphs 14(6)(c) and 15(5)). Anyone living in India must answer an officer’s request for information about a foreigner (Rule 12(6)).
• Deadlines: accommodation keepers send Form III “as soon as may be but not beyond twenty-four hours” after a foreigner arrives (Rule 17(5)), and again on departure; hospitals likewise on admission (Rule 18(5)). Institutions file Form II within 24 hours of admission, plus Form III for hostel residents (Rule 16). Records are kept electronically for at least one year (Rule 17(1)); filing is through indianfrro.gov.in (DIPR Nagaland). A contravention can draw up to three years’ imprisonment, a fine of up to ₹3 lakh, or both (section 23(b)).

At the front desk and gate. On our reading, a foreign client at a day meeting does not bring an office under sections 8 to 10. A campus guest house, hostel, hospital admission desk or company transit house may well be covered, and the desk that books the room or admits the patient starts the 24-hour clock. Paragraph 15 of the Order also bars foreigners from prohibited places without permission, which matters at critical infrastructure sites. Foreign engineers coming for installation, commissioning or maintenance may fall under the e-B-4 production investment visa announced in December 2025 (PTI).

CERT-In in 2025: new audit guidelines, same 2022 Directions

• What changed: on 25 July 2025 CERT-In issued its Comprehensive Cyber Security Audit Policy Guidelines (version 1.0). Audits should run “at least once in a year” (13.1.2(i)), the audit types listed include physical security testing and log management (section 6), and every audit must check compliance with the Directions of 28 April 2022 (15.2.1(iv)).
• What did not change: the 2022 Directions still require listed incidents, including data breaches and leaks, to be reported “within 6 hours of noticing”, and ICT system logs to be kept for a rolling 180 days; CERT-In’s FAQ (Q35) lets the logs sit outside India if they can be produced to it.
• Who it applies to: service providers, intermediaries, data centres, body corporates and government bodies (Directions); organisations audited by CERT-In empanelled auditors, which RBI and SEBI require of the entities they regulate (AZB & Partners).

At the front desk and gate. A cloud visitor system is an ICT system: its access logs fall under the 180 days, and a leak of visitor data can start the CERT-In six-hour clock and, from May 2027, the DPDP one.

CEA cyber security regulations 2026 for power utilities

• What changed: the Central Electricity Authority notified the CEA (Cyber Security in Power Sector) Regulations, 2026 on 31 July 2026. They replace the 2021 Guidelines from 1 April 2027 (PwC).
• Who it applies to: generation, transmission and distribution utilities, load despatch centres, power exchanges and other covered power sector enterprises (PwC).

PCI DSS 4.0.1 changes: “visitor logs” and the March 2025 deadline

• What changed: PCI DSS v4.0.1 was published on 11 June 2024 with “no additional or deleted requirements”; v4.0 was retired on 31 December 2024, and the future-dated requirements took effect on 31 March 2025 (PCI SSC). The Summary of Changes clarifies requirement 9.3.4 to “visitor logs” rather than “a visitor log”, covering visitor activity “both” within the facility and within sensitive areas, and adds a glossary definition of “visitor”. The visitor log itself is not new: in v3.2.1 it was requirement 9.4.4 (Cloudaware).
• Who it applies to: entities that store, process or transmit cardholder data, and service providers that can affect its security. PCI SSC sought comments from 3 June to 20 July 2026 to start the next version; we found no publication date as of October 2026.

At the front desk and gate. Keep one log at reception and another at each data centre or server room door, each with name, organisation, date and time, and who authorised access, kept for at least three months.

What did not change, and common mistakes in published advice

• District orders on guest identity. District Magistrates use their urgent-order power under section 163 of the Bharatiya Nagarik Suraksha Sanhita, in force since 1 July 2024 (All India Radio), to make hotels, guest houses and landlords verify guests’ identity, as South Goa did in July 2024. Check your district.
• ”The DPDP Act applies from November 2026.” Only consent managers start then.
• ”Delete visitor data at check-out.” Rule 8(3) points the other way once it applies.
• ”No drills needed now NBC 2016 is withdrawn.” State fire rules, NOC conditions and factory rules still apply.

Visitor management compliance checklist for 2026

1. Settle your visitor notice and consent for 13 May 2027; keep visit records and logs one year, and photos and mobile numbers for days.
2. Ask your fire consultant which code edition your state and NOC use, and keep drilling.
3. Make contractor induction a condition of entry, with a live count of contract workers inside.
4. If you house, enrol, admit or employ foreigners in a covered sector, name an owner for each report and test the 24-hour handover.
5. Replace A.11.1.2 with Annex A 7.2, and check your certificate names ISO/IEC 27001:2022.
6. Keep PCI visitor logs at reception and at each sensitive area door.
7. Put CERT-In, Board and visitor notifications into one breach runbook.

Where Orb fits

Orb, our visitor management system, is built for India’s DPDP Act 2023 and Rules 2025 and the audits around them.

Questions buyers ask