Who this guide is for
Founders, office managers, IT and security leads, and whoever answers client security questionnaires at a startup, branch office, clinic, professional firm or co-working member company in India, and co-working operators deciding what their front desk does. If you have one glass door, no receptionist and a building guard downstairs with a logbook, this is your guide.
Small offices and co-working spaces at a glance
| Factor | What it usually looks like |
|---|---|
| Visitor volume and peaks | A handful a day; clusters on interview days, client meetings and month-end vendor visits |
| Who comes | Clients, candidates, vendors, AMC technicians (AC, UPS, IT), cleaners, couriers, food deliveries, the occasional auditor |
| Entry points | One office door, often glass, behind a building lobby you do not control |
| Turnstiles or access control | None of your own; perhaps a card or PIN lock; the building may have lobby turnstiles |
| Guard set-up | A building guard downstairs who writes names in a logbook and phones up, or just sends visitors up |
| Reception | None, a shared receptionist, an office manager doubling as one, or the co-working operator’s front desk |
| Main risks | Visitors alone on an open floor near laptops and client data; tailgating; no record of who approved whom; no headcount in an alarm |
| Rules that apply | DPDP Act 2023 and Rules 2025 for any digital register; ISO 27001 Annex A 7.2, SOC 2 or client contract terms; the building’s fire plan and state fire rules |
Do small offices need visitor management at all?
Yes, a light version, for three reasons.
- The DPDP Act covers any digital register. It applies to personal data collected digitally, or collected otherwise and digitised later (section 3). A Google Form, a spreadsheet, a WhatsApp group where hosts approve visitors, or a photographed logbook page are all in scope. Section 17(3) lets the government notify startups exempt from some duties (notice, accuracy, erasure and the right to information about processing), but not from security safeguards or breach reporting; we found no such notification as of 13 October 2026. King Stubb & Kasiva advise assuming the Act applies “unless a specific exemption is available”.
- Clients and auditors ask. Physical and Environmental Security is one of the 21 risk domains in the SIG questionnaire many enterprises send vendors (Mitratech). SOC 2 criterion CC6.4 expects physical access to facilities to be restricted to authorised personnel (AICPA). ISO 27001 Annex A 7.2, “Physical entry”, has no office-size threshold; TCSA notes it does not demand turnstiles at every door, and suggests a minimum visitor record of name and organisation, host, purpose, entry and exit times and badge reference.
- Fire safety needs a headcount. In Maharashtra, the owner’s or occupier’s declaration filed with the Form B fire safety certificate states that a mock drill “is also conducted periodically”, with attendance attached (Maharashtra Fire and Emergency Services). A warden cannot report a missing visitor nobody recorded. See our guide to evacuation roll call and fire drills.
Most DPDP duties apply from 13 May 2027 (Rule 1(4), eighteen months after publication); some firms, including Cyril Amarchand Mangaldas, count from the next day and give 14 May 2027. A January 2026 proposal to shorten the timeline for some provisions had not been notified as of 12 October 2026 (Business Standard; S.S. Rana & Co.).
A small office needs no hardware, kiosk or front desk. It needs six decisions followed: who registers visitors, who approves them, how they are identified inside, when they leave, who sees the record and when it is erased. “Visitors are escorted and logged” on a questionnaire must be true on a Saturday too.
A day at a small office: four scenarios
11:10 am, an interview candidate and an empty floor
Sneha Iyer arrives for an interview at a 45-person fintech in Andheri East, Mumbai. The building guard logs her name and sends her up. Her interviewer, Karan Malhotra, is in the weekly planning meeting. At the glass door she scans a QR poster, reads the notice and checks in on her phone. Karan misses the WhatsApp approval; after two minutes it goes to his backup, the office manager, who seats her in the meeting room by the door. It worked because she was pre-registered and the backup and waiting room were decided in advance.
Saturday 10 am, the AC technician
Ramesh Yadav from the AC maintenance contractor is booked for Saturday. On Friday the admin manager, Pooja Shetty, pre-registers him as a contractor valid from 9 am to 1 pm and sends the building’s work permit request. One employee lets him in and stays; laptops and the server cabinet are locked; his exit time is recorded. If something later goes missing, the record shows who approved him and when he left.
Monday 3 pm, a client’s auditor asks for last quarter’s records
A 120-person IT services firm in Hinjewadi, Pune, supports a bank whose auditor asks for visitor records, with approvals, for three dates last quarter. Pieced together from a building logbook, WhatsApp chats and a spreadsheet, the answer takes a day and has gaps; from one log with host, approver, times and pass number, it takes minutes. Show the sampled dates on screen, or share those entries with other visitors’ details masked, rather than emailing a full export.
Thursday 9:30 am, a co-working member hosts a 12-person workshop
An eight-desk member company in a Koramangala co-working space, Bengaluru, hosts 12 partners in a booked meeting room. The host, Anjali Rao, uploads the guest list a day ahead for the operator’s front desk. Guests check in on their phones and get guest Wi-Fi, not the member network. When the alarm is tested at 11, the warden knows 12 guests are in meeting room 3.
Each scenario turns on three decisions made in advance: who approves, where the visitor waits, and who records the exit. The tool matters less.
The minimum viable visitor process without a receptionist
- The host pre-registers expected visitors the day before: name, organisation, date and purpose.
- The visitor checks in on their own phone from a QR poster on the door, after a notice. Rule 3 asks for a standalone notice in clear and plain language, with “an itemised description” of the data and the purpose. The visitor may choose English or any of the 22 Eighth Schedule languages (section 5(3)); we advise English, Hindi and the city’s main language at the door, others on request.
- The host approves, with a backup. One tap, with name and time recorded; no answer in a couple of minutes goes to a named backup, then the office manager.
- The visitor gets a pass showing name, host and validity; TCSA suggests one visibly different from staff badges that expires the same day.
- The visitor checks out. Without exit times there is no headcount and no audit trail.
- Records are erased on schedule. Keep the visit record and its logs for one year. Rule 8(3) sets that minimum “for the purposes as specified in the Seventh Schedule”, and Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. Because it speaks of personal data generally, keep photos and mobile numbers for days only as a written decision your DPO and counsel sign off, and record each erasure.
Collect only name, organisation, host, purpose and times, plus a mobile number if you use it: section 6(1) limits consent to data that is “necessary”. For columns to keep and drop, see our visitor register format guide.
Pre-registration by the host does most of the work. Make it as routine as booking a meeting room, and walk-ins become the exception the backup handles.
Co-working spaces and managed offices: who does what
Three parties touch each co-working visit: the building (lobby guard, perhaps turnstiles), the operator (front desk, meeting rooms, Wi-Fi, day passes) and the member company that hosts. Under the DPDP Act, whoever decides, alone or with others, the purpose and means of processing is the data fiduciary (section 2(i)). The answer turns on facts and contracts, so treat this table as a starting point for counsel.
| Situation | Likely data fiduciary |
|---|---|
| The operator runs one front desk register for all members | The operator; its visitor management vendor is its processor |
| A member pre-registers its own guests and sees their records | Possibly the member as well, jointly with the operator, for its own guests |
| A member runs its own check-in at its private cabin | The member, for that register |
| The building guard keeps a lobby logbook | The building or its facility manager, once the logbook is photographed, scanned or typed up; a purely handwritten one is outside the Act |
A day-pass holder is the operator’s customer; a guest invited to a booked meeting room is the member’s visitor, best pre-registered with the booking. TCSA advises treating the building’s and operator’s controls as an outer ring you verify but do not own, and recording which barriers are theirs as inherited controls. If you report under ISO 27001 or SOC 2, ask your auditor early what evidence from the operator they will accept. For the full landlord, operator and tenant split, see our DPDP guide and our multi-tenant towers guide.
Members should ask the operator what it records about their visitors, who sees it and for how long. Operators should answer in the membership terms, including who gives the notice, handles a visitor’s request and reports a breach.
Security basics without hardware
The main risk is a visitor alone near a laptop. These controls cost nothing.
- Clear desk and clear screen (ISO 27001 Annex A 7.7): lock screens, keep client files out of sight, wipe the meeting room whiteboard.
- A visitor meeting room by the door (Annex A 7.3, “Securing offices, rooms and facilities”): meet visitors there, not on the open floor.
- Escort beyond that room: TCSA’s guidance on Annex A 7.2 calls for escorts beyond public areas, so the host walks the visitor in, stays and walks them out.
- No tailgating at the glass door: staff politely ask a stranger whom they are here to see, even one carrying a box.
- Guest Wi-Fi separate from the office network, which auditors map to Annex A 8.22, “Segregation of networks”.
- Deliveries stop at the door, at an agreed drop point.
Put these six lines in a one-page visitor policy the founder signs and every joiner hears.
Logbook, Google Form or visitor management system: cost and effort
A Google Form is a real option for a small office. Compare all three fairly.
| Factor | Logbook | Google Form | Visitor management system |
|---|---|---|---|
| Cost to start | Almost nothing | Free; audit logs need a company Workspace account | A monthly subscription |
| Running effort | Someone collects, checks and stores the books | An owner chases check-outs and deletes responses by hand | An owner reviews exceptions and settings |
| Notice before collection | A printed notice beside the book | In the form description | Built into check-in |
| Host approval | A phone call, no record | None built in | Recorded with name and time |
| Pass | A numbered card, if any | None | Usually included |
| Check-out and headcount | Exit column often blank | A second form or manual entry | Built in, though visitors still forget |
| Access log | None | Who opened the file, not which entry; six months | Usually per record; check the vendor |
| Erasure on schedule | Lock away, then destroy | Manual, in the form and the response sheet | Usually automatic; check the vendor |
A logbook never photographed, scanned or typed up sits outside the DPDP Act (section 3), but it is hard to evidence in an audit and lets each visitor read earlier entries. A Google Form gives timestamps and QR check-in, with gaps. A file upload question, such as a photo, makes respondents sign in to a Google Account, and a linked response spreadsheet is a separate file, so deleting one leaves the other (Google). Most Drive audit events are logged only for files owned by users with supported editions, and the log is kept six months (Google Workspace Admin Help), while Rule 6(1)(e) asks for logs to be kept a year, so export it regularly. A form in someone’s personal Gmail has no admin audit log, and leaves with them.
A Google Form in a company Workspace account, with a notice, a named owner and a monthly erasure routine, is acceptable for a few visitors a week and no client audits. Once a client questionnaire, an ISO 27001 or SOC 2 audit, or a second entrance arrives, patching the form costs more time than a visitor management system costs money.
Recommended set-up for a small office
- Name an owner and a backup, usually the office manager and one colleague who covers leave.
- Fix four visitor types: guest or client, candidate, contractor (AMC technicians, cleaners, IT vendors) and delivery, which stays at the door.
- Make pre-registration the default; walk-ins use the QR poster and go to the backup.
- Set approvals: host, then the named backup after two minutes, then the office manager.
- Use ID verification only where your policy calls for it, such as contractors working out of hours. Record that it was done and by whom rather than the ID number.
- Issue a same-day pass, on the visitor’s phone or as a numbered badge returned at check-out.
- Get NDAs before arrival from candidates who will see client work and contractors near equipment (Annex A 6.6).
- Give the fire warden the live list on a phone. In a real alarm, report anyone unaccounted for to the fire service at once; nobody goes back in to look.
- Write retention down: visit records and logs one year, photos and mobile numbers days, each erasure recorded.
- In co-working, agree the split with the operator in writing: who records, sees, erases and reports a breach.
Common mistakes in small offices
- Relying on the building logbook. You cannot get it on demand, it shows no approver, and it ends at the lobby.
- Approvals by phone call or group chat. A call leaves no record; a WhatsApp group with visitor photos puts personal data on every member’s phone, where you cannot erase it.
- No check-out, so the log cannot support a headcount.
- Collecting ID copies because a client asked about ID verification. The client wants evidence that identity was checked, not documents you must protect.
- Sending a client’s auditor the whole register instead of the sampled entries.
- Assuming the co-working operator handles everything. Your cabin door and your guests’ data need a written answer.
Fix approvals and check-out first: they are what an auditor traces and what a warden needs in an alarm.
Where Orb fits
Orb, our visitor management system, suits offices where nobody sits at the door.
An office manager with an afternoon
Orb goes live in one sitting with six choices (site, staff list, visitor types, notice, retention, approvals), then you print the QR poster; nothing to install or maintain.
A glass door with nobody behind it
Visitors scan the poster and check in on their own phone after a notice in their own language.
A host stuck in a meeting
One-tap approval in WhatsApp, Microsoft Teams or Slack; if the host does not answer, a backup is asked, then the desk.
A workshop or a Saturday contractor
The visitor’s phone becomes the pass, showing host and validity, with a code that changes every minute.
A client audit or a DPO question
Every retention clock is configurable per detail, photos and mobile numbers are erased after seven days by default, and every look at a visitor record is logged.
Questions buyers ask
Can we use a Google Form as a visitor log?
Yes, with care: show the notice in the form description, keep it in a company Workspace account, export the Drive audit log within its six months, and delete responses in both the form and the response sheet on schedule. It has no approval, pass or check-out, and the audit log shows who opened the file, not which entry.
How do you manage visitors without a receptionist?
Make the host responsible. Hosts pre-register visitors, who check in on their phone from a QR poster; the host or a named backup approves; visitors wait in the meeting room by the door.
Who is responsible for visitor data in a co-working space?
The data fiduciary is whoever decides the purpose and means of processing (DPDP Act, section 2(i)). That is usually the operator for its front desk register, and possibly the member too, jointly, if it pre-registers and views its guests’ records. Write the split into the membership terms and confirm it with counsel.
Are startups exempt from the DPDP Act?
Not as far as we found as of 13 October 2026. Section 17(3) lets the government notify startups to whom notice, erasure and some other duties would not apply, but we found no such notification, and those duties do not include security safeguards or breach reporting. Plan as if the Act applies, and confirm with counsel.
How long should a small office keep its visitor log?
Keep the visit record and its logs for one year, then erase them. Rule 8(3) sets a one-year minimum for its Seventh Schedule purposes from 13 May 2027, which Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read as binding every data fiduciary. Keep photos and mobile numbers for days, as a decision your DPO and counsel sign off.
Sources
- Digital Personal Data Protection Act, 2023, Ministry of Electronics and IT
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, 13 November 2025
- DPDP Rules 2025, Rule 1 (commencement), dpdpa.com reproduction of the Gazette text
- DPDP Rules 2025, Rule 3 (notice), dpdpa.com reproduction of the Gazette text
- DPDP Rules 2025, Rule 6 (security safeguards), dpdpa.com reproduction of the Gazette text
- DPDP Rules 2025, Rule 8 (retention and erasure), dpdpa.com reproduction of the Gazette text
- DPDP Act 2023, section 17 (exemptions), dpdpa.com reproduction of the Act
- FAQs on the Digital Personal Data Protection Act and Rules, Cyril Amarchand Mangaldas, law as on 7 December 2025
- Digital Personal Data Protection Rules, 2025: incremental tweaks and the way ahead, Lakshmikumaran & Sridharan, updated 16 July 2026
- MeitY may cut compliance timeline for key DPDP rules to 12 months, Business Standard, 22 January 2026
- DPDP (Removal of Difficulties) Order, 2026: what has been changed, S.S. Rana & Co., 12 October 2026
- DPDP compliance for startups and MSMEs, King Stubb & Kasiva, 15 September 2026
- ISO/IEC 27001:2022, Information security management systems: Requirements, ISO
- ISO/IEC 27002:2022, Information security controls, ISO
- ISO 27002:2017 to ISO 27002:2022 mapping tool, NQA
- ISO 27001 A.7.1 Physical security perimeters, TCSA
- ISO 27001 A.7.2 Physical entry, TCSA
- 2017 Trust Services Criteria (with revised points of focus, 2022), AICPA and CIMA
- SOC 2 CC6.4: Physical access control to facilities and protected information assets, Cyberday, reproduction of the criterion and points of focus
- The Standard Information Gathering (SIG) questionnaire explained, Mitratech, 26 February 2026
- Guidelines to issue Form B, Maharashtra Fire and Emergency Services
- Choose where to save form responses, Google Docs Editors Help
- Choose a type of question for your form, Google Docs Editors Help
- Drive log events, Google Workspace Admin Help
- Data retention and lag times, Google Workspace Admin Help
This guide reflects the law, standards and published guidance as of 13 October 2026. It is general information, not legal advice: confirm retention, lawful basis and co-working responsibilities with your counsel or auditor.
