Who this guide is for
Facility and security heads at landlords, REITs and facility management (FM) companies running towers and tech parks in Bengaluru, Hyderabad, Pune, Gurugram, Noida, Chennai and Mumbai, and admin, infosec and DPO teams at tenants that depend on the building’s lobby. We write as GRC consultants and physical security practitioners. This is not legal advice: confirm data protection and lease points with counsel.
Multi-tenant towers and tech parks at a glance
| Factor | What it usually looks like |
|---|---|
| Visitor volume and peaks | A sharp morning peak, a smaller one after lunch, spikes from interview drives, events and client days |
| Who comes | Guests, candidates, couriers, food delivery riders, vendor engineers, housekeeping staff, auditors, event attendees, cab drivers |
| Entry points | Campus vehicle and pedestrian gates, a lobby per tower, basement lift lobbies, service and loading entrances |
| Turnstiles or access control | Lobby speed gates on the landlord’s access control system, tenants’ own readers at suite doors, face recognition gates at some sites |
| Guard set-up | An agency licensed under the Private Security Agencies (Regulation) Act 2005 (section 4), hired by the owner or FM company |
| Reception | A building help desk in each lobby; tenant receptions on their floors, some unstaffed |
| Main risks | Tailgating at peak, unescorted couriers, visitors missed in an evacuation count, tenants seeing each other’s visitors |
| Rules that apply | DPDP Act 2023 and Rules 2025; state fire rules and the fire NOC; ISO 27001 and PCI DSS for tenants that hold them; SEZ Rule 11B access control in IT/ITeS SEZs with non-SEZ floors; CERT-In’s 2022 Directions |
A day at a tech park lobby: four scenarios
These are composite situations, not real sites.
9:15 am, 400 arrivals in 20 minutes. Around 60 are visitors. Two desk staff write each name in a logbook and phone tenant receptions. The queue reaches the drop-off bay, guards wave people through the wide gate, and nobody knows who went up. The fix is to move work out of the peak: pre-registered visitors arrive with an approved pass, walk-ins check in on their phones while queuing, and the desk handles exceptions.
Saturday, 9:30 am, a walk-in drive for 150 candidates. A tenant on floors 6 and 7 gave two days’ notice; candidates arrive in one wave with no host name. The building needs a candidate visitor type, one HR coordinator as host with a backup, a holding area, lifts limited to two floors and a cut-off time. The tenant decides what candidate data is collected and how long it is kept.
2:40 pm, a courier for the 14th floor. The parcel is for “Priya, 14th floor”, and three tenants share the floor. The habit is to send him up; instead, the parcel goes to a lobby drop desk with a message to the tenant; a signature delivery gets a pass to one reception, valid for minutes.
4:05 pm, a fire alarm with eight tenants. Two tenants run their own reception; six rely on the lobby. The incident controller needs everyone inside, by tenant and floor: tenant wardens count staff, the lobby’s live register lists visitors who have not left, and the FM team counts contractors from permits. Missing people are reported to the fire service at once, wardens sweep only where safe, and after a real alarm nobody re-enters until the fire officer in charge clears it. See our evacuation roll call guide.
All four failures start the same way: the lobby does not know, before arrival, who is expected, by whom and for where. Fix that first.
Who decides what: landlord, facility management company and tenant under the DPDP Act
The owner or REIT sets building rules through the lease, the FM company runs the desk and guards, and each tenant decides whom it invites. The DPDP Act does not mention landlords or tenants; it asks who decides why and how data is processed:
- Data Fiduciary (section 2(i)): any person who “alone or in conjunction with other persons determines the purpose and means of processing of personal data”.
- Data Processor (section 2(k)): any person who processes personal data on behalf of a fiduciary.
Khaitan & Co points out that, unlike Article 26 of the GDPR, the Act has no arrangement for joint fiduciaries to share duties; it reads each fiduciary as independently responsible, and whether a party is a fiduciary, joint fiduciary or processor as “a question of fact in each case”. Our reading of the usual set-ups:
- The owner chooses the lobby process and system: the owner is likely the fiduciary for lobby records; the FM company and the system vendor are likely processors. Put both on written contracts: section 8(2) requires a valid contract where a processor works on activities related to offering goods or services to data principals, and Rule 6(1)(f) expects the contract to require reasonable security safeguards.
- The FM company picks its own system and decides what to collect: it may itself be a fiduciary.
- A tenant pre-registers guests in the building’s system: it is likely a fiduciary for them, possibly in conjunction with the owner.
- A tenant runs its own reception register: the tenant is the fiduciary for that register.
A fiduciary stays responsible “irrespective of any agreement to the contrary” (section 8(1)), including for processing its processors do on its behalf. Contracts can share the work and provide indemnities; they do not move a fiduciary’s responsibility under the Act. Most duties apply from 13 May 2027 (Rule 1(4), eighteen months after publication); some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027. A proposal to shorten the timeline was floated in January 2026; as of 12 October 2026 no change had been notified. See our guide to the DPDP Act and your visitor register.
Put a one-page data roles annexure in every lease and the FM contract: the fiduciary for lobby records and for tenant-registered guests, and who signs the vendor’s data processing agreement. Ask counsel to check that practice matches it.
Tenant visitor pre-registration versus walk-ins at the building desk
Pre-registration: a tenant host enters the guest before the visit; the guest reads the notice, consents on their own phone and arrives with an approved pass.
Walk-ins still happen. Route them in three steps:
- Check in at the lobby: a QR poster at the queue and the desk; staff key in details for anyone who prefers not to use a phone.
- Ask the tenant: the named host, then the tenant’s backup, then its reception or admin.
- Never approve on a tenant’s behalf: if nobody answers, the visitor waits or someone from the tenant comes down.
The notice must be offered in English or any of the 22 Eighth Schedule languages, as the visitor chooses (section 5(3)). Show English, Hindi and the city’s main language at the door (Kannada in Bengaluru, Telugu in Hyderabad) and offer others on request.
Make pre-registration the default in the building rules for meetings booked a day ahead, and track each tenant’s share of walk-ins. In our experience, a high share means hosts are not getting requests where they actually read messages.
Turnstile visitor access in a tech park: QR, access control API or credentials
Visitors cross the same speed gates as staff by one of five routes:
| Option | How it works | Watch for |
|---|---|---|
| Guard-checked visitor lane | The guard scans the pass on a phone and opens a wide gate | The gate left open at peak |
| QR reader at the turnstile | The gate’s reader checks the pass against the visitor system | Screenshotted or expired codes |
| Access control API | Approval creates a temporary credential for the visit’s floors and hours | Who holds API access; deletion after the visit |
| Issued card or RFID credential | The desk hands over a card encoded for the visit | Cards not returned or passed on |
| Face recognition gate | The visitor’s face is enrolled for the visit | When each face template is deleted |
Many installed readers use Wiegand, the reader interface in SIA AC-01 (1996), which sends data one way and in plain text (Axis). OSDP, the Security Industry Association’s protocol, is published as IEC 60839-11-5:2020 and supports AES-128 encryption through its Secure Channel. Ask your integrator to confirm Secure Channel is actually switched on.
Start with a guard-checked lane and a pass the guard can trust; integrate once tenants pre-register reliably. Specify OSDP with Secure Channel for new readers, and keep a staffed wide lane for wheelchair users and trolleys.
Couriers, food deliveries and vendor engineers
For ISO 27001 Annex A 7.2 (physical entry), TCSA describes the concern as “the flow of goods and outsiders” and advises separating goods movement from people movement, including at delivery areas.
- Couriers: a lobby drop desk, a message to the tenant, collection by a tenant runner; signature deliveries get a short pass to one reception.
- Food delivery riders: a pickup counter in the lobby, never above it.
- Vendor engineers: a contractor visitor type with induction and NDA signed before arrival, ID verification where policy calls for it, a named sponsor, a pass limited to the plant rooms or floors in the work order, and a check-out that closes the permit to work.
- IT/ITeS SEZs: where a developer demarcates floors for non-SEZ businesses under SEZ Rule 11B (inserted 6 December 2023), it must have access control for people and goods moving in and out (EY; Trilegal).
Put delivery rules in the house rules, so the guard enforces a written rule instead of arguing with an employee who wants lunch at the desk.
Tenants with ISO 27001 or PCI DSS: why the building’s log is not enough
A tenant’s auditor tests the tenant’s own controls.
- ISO 27001: the landlord controls the lobby, lifts and shared corridors. TCSA advises tenants to treat these as an outer ring “you verify but do not own”, with their own enforceable boundary at the suite door. Your auditor will still ask who was let up to your floor, and who approved them. See our ISO 27001 visitor management guide.
- PCI DSS: requirement 9.3.4 of v4.0.1 asks for visitor logs that keep “a physical record of visitor activity both within the facility and within sensitive areas”, with name, organisation, date and time and the person authorising access, kept at least three months unless law restricts it. If you rely on the building’s log, requirement 12.8.5 asks that information is maintained about which requirements each third-party service provider manages, which you manage and which are shared; agree with your QSA whether the building counts. See our PCI DSS visitor log guide.
- DPDP: Rule 8(3) keeps personal data, traffic data and processing logs for at least one year “for the purposes as specified in the Seventh Schedule” (State purposes); Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary.
A regulated tenant should get in writing its own view of its visitors, an export on request, the access log and retention no shorter than its audits need. Failing that, keep your own record at the suite door.
Who sees whose visitors: data sharing between building and tenants
Consent under the DPDP Act covers “the specified purpose” and only the data necessary for it (section 6(1)).
| Who | Sees | Should not see |
|---|---|---|
| Lobby desk and guards | Photo, name, host, approval and floor, for today | Mobile numbers, ID details, visit history |
| Tenant admin or reception | Its own visitors, for its retention period | Other tenants’ visitors |
| FM manager and control room | Everyone inside now, incidents, roll call | Visit history beyond what an incident needs |
| Owner or REIT | Counts and incident summaries | Named lists, outside an investigation |
Watchlists are personal data too: decide who adds a name, on what grounds and for how long, and show the guard a quiet flag without the reason. Rule 6(1)(b) and (c) expect access control and logs, so log every look at a visitor record.
Stop emailing a daily visitor spreadsheet to tenants: it copies everyone’s details to everyone and logs nothing. Before signing with a vendor, compare a tenant admin’s screen with the control room’s.
Recommended set-up: decisions for a multi-tenant building
- Data roles: name the fiduciary for lobby records and for tenant-registered guests in the lease annexure and FM contract.
- One lobby system: one record per visit, each tenant seeing only its own visitors.
- Visitor types: guest, candidate, contractor, delivery, event attendee, each collecting only what it needs, with ID verification only where policy calls for it, and inductions and NDAs signed before arrival where needed.
- Pre-registration by default; walk-ins check in on their own phones, and approvals go host, tenant backup, tenant reception, never the building desk.
- Passes: expire with the visit; guard-checked first, turnstiles later.
- One building roll call: a live register by tenant and floor, reported to one incident controller.
- Retention: the visit record and its logs for one year; photos and mobile numbers for days, as a written decision the DPO and counsel sign off.
- Directory: each tenant uploads its staff list or syncs its directory, so leavers cannot pre-register guests.
Who does what (R does it, A answers for it; “Owner” is the landlord or REIT). The table assumes the common set-up above: the owner is the fiduciary for lobby records and each tenant for the guests it registers. Change it if your annexure says otherwise.
| Task | Owner | Tenant | FM company |
|---|---|---|---|
| Visitor notice | A for the lobby notice: approves wording, names the fiduciary | A for its guests: supplies purposes, approves wording | R: displays notices, runs the desk route |
| Host approvals | A for the house rule that nobody goes up unapproved | A and R for each approval: hosts approve, tenant names backups | R: escalates, never approves |
| Breach reporting | A for lobby records: tells the Board and visitors | A for its guests and its own records | R: tells the owner and affected tenants at once |
| Retention | A for lobby records: sets the building schedule | A for its guests: sets their retention to suit its audits | R: runs erasure, keeps proof |
| Roll call | A: approves the fire plan | R: wardens count staff and own visitors | R: live register, lobby, contractors, incident control |
On a breach, the fiduciary tells each affected visitor without delay and gives the Board a full report within 72 hours of becoming aware, unless the Board allows longer on a written request (Rule 7). CERT-In’s 2022 Directions separately require body corporates to report listed cyber incidents within 6 hours.
Agree this table at the next tenant meeting and attach it to the fire plan and FM contract before an alarm or a breach tests it.
Common mistakes in multi-tenant towers and tech parks
- A building-wide visitor list emailed to every tenant each morning.
- Two registers that never match: the lobby logbook and a tenant spreadsheet, with no shared visit reference.
- The wide gate left open at peak, so turnstiles record staff but not visitors.
- ID collected from every visitor because vendor engineers need it.
- A roll call against a register with no exit times.
- Leases and FM contracts silent on data roles.
Most of these come from nobody owning the boundary between building and tenant. Name an owner for each.
Where Orb fits
Orb, our visitor management system, is built for Indian buildings and for the DPDP Act 2023 and Rules 2025.
Your desk phones tenant receptions all morning
Hosts approve in one tap in WhatsApp, Microsoft Teams or Slack, and a backup is asked if the host does not answer.
Guards wave visitors through at peak
The visitor’s phone becomes the pass, its code changes every minute, and the guard scans it to see photo, name, host and approval.
Your tower already has turnstiles
Orb works with existing turnstiles, RFID and card readers and face recognition gates, so no new hardware is needed to start.
The alarm sounds with eight tenants inside
A live register shows who is inside right now, and the evacuation roll call produces a drill report for fire audits.
Tenants keep changing staff
Each tenant uploads a staff list or syncs from Okta or Microsoft Entra ID, so hosts stay current.
Questions buyers ask
Who is the data fiduciary for visitor data in a multi-tenant building?
Whoever decides the purpose and means of processing, alone or with others (DPDP Act, section 2(i)). Often the owner for lobby records and each tenant for guests it registers, with the FM company and vendor as processors; it depends on the facts.
Can a building share its visitor register with tenants?
Each tenant should see only its own visitors. A full list sent to every tenant goes beyond the purpose visitors were told about and creates copies nobody can track.
How does tenant visitor pre-registration work in a tech park?
The host enters the guest before the visit, the guest reads the notice and receives an approved pass, and the guard or turnstile checks it on arrival.
Can visitors use a QR code at the turnstile?
Yes, through a QR reader on the gate, an API into the access control software, or a guard who scans the pass and opens a visitor lane. The code should expire with the visit.
How long should a tech park keep visitor records?
Keep the visit record and its logs for one year. That covers PCI DSS 9.3.4’s three months and DPDP Rule 8(3), whose one year is tied to Seventh Schedule purposes but which Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read as binding every data fiduciary. Keep photos and mobile numbers for days, as a written decision your DPO and counsel sign off.
Sources
- Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, 13 November 2025
- DPDP Rules 2025, Rule 7: intimation of personal data breach, dpdpa.com (text reproduction)
- Who is in control? Identifying data fiduciaries in complex processing scenarios, Khaitan & Co on SCC Online, 28 January 2024
- DPDP FAQs (law as on 7 December 2025), Cyril Amarchand Mangaldas
- Digital Personal Data Protection Rules, 2025: incremental tweaks and the way ahead, Lakshmikumaran & Sridharan, updated 16 July 2026
- MeitY may cut compliance timeline for key DPDP rules to 12 months, Business Standard, 22 January 2026
- DPDP (Removal of Difficulties) Order, 2026: what has been changed for children’s data and SDF audits, S.S. Rana & Co., 12 October 2026
- Languages included in the Eighth Schedule of the Indian Constitution, Department of Official Language, Ministry of Home Affairs
- CERT-In Directions under section 70B(6) of the IT Act, CERT-In, 28 April 2022
- Office leasing hits record high for third consecutive year in 2025, CBRE India, 6 January 2026
- The Private Security Agencies (Regulation) Act, 2005-act-2005.pdf), PRS Legislative Research (text of the Act)
- Enabling establishment of non-SEZ IT/ITeS businesses in SEZ, EY, 8 December 2023
- Government allows non-SEZ IT/ITeS units to operate out of IT/ITeS SEZs, Trilegal, 26 December 2023
- ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection: Information security management systems: Requirements, ISO
- ISO 27001 A.7.1 Physical security perimeters, TCSA
- ISO 27001 A.7.2 Physical entry, TCSA
- PCI DSS v4.0.1, PCI Security Standards Council, June 2024
- PCI DSS Summary of Changes, v4.0 to v4.0.1, PCI Security Standards Council, June 2024
- SIA AC-01-1996.10: Access Control Standard Protocol for the 26-Bit Wiegand Reader Interface, Security Industry Association
- Open Supervised Device Protocol (OSDP), Security Industry Association
- Why choose OSDP over Wiegand in access control, Axis Communications, May 2025
This guide reflects Indian law, the standards cited and published guidance as of 13 October 2026. It is general information, not legal advice: confirm your approach with counsel and your auditor.
