Visitor watchlist and banned visitor list in India: grounds, DPDP duties and review

What a visitor watchlist is, and what it is not

A visitor watchlist is a short internal record of people not to admit, or to admit only under conditions, with the reason, evidence and decision maker. Two tiers are enough:

• Do not admit: the guard pauses the check-in and calls the supervisor. Example: a former contractor debarred after a safety incident.
• Admit with conditions: the visit goes ahead only with an escort or a supervisor present. Example: a vendor’s representative who abused reception staff last month.

It is separate from sanctions screening (covered below), it is not a record of people someone dislikes, and it is never a public notice. “Blacklist” is still the common word in Indian buildings; many organisations now say “deny list”.

Who can go on a banned visitor list: grounds that hold up

In a 2013 contract case the Supreme Court said “the freedom to contract or not to contract is unqualified in the case of private parties”, while State blacklisting is open to judicial review (Kulja Industries v BSNL, paragraph 17). In our reading an owner or occupier has similar freedom over whom to admit, limited by anti-discrimination law, the DPDP Act and defamation law. These grounds hold up when the evidence is on file:

• Protection orders. Under section 18(c) of the Protection of Women from Domestic Violence Act 2005, a Magistrate may prohibit the respondent from “entering the place of employment of the aggrieved person”. The watchlist is how your gate gives such an order effect.
• Trespass. Under section 329 of the Bharatiya Nyaya Sanhita 2023, entering or unlawfully remaining on another’s property with intent to commit an offence or to intimidate, insult or annoy is criminal trespass, punishable with up to three months’ imprisonment, a fine up to ₹5,000, or both.
• POSH matters. The POSH Act 2013 protects a woman “whether employed or not”. Where the perpetrator is not an employee, section 19(h) asks the employer, if the woman so desires, to cause action to be initiated under the criminal law or any other law. Restricting that person’s access is a separate, practical safety step: record it as management’s decision and keep the details confidential, as section 16 requires.

Grounds you must never use. Never screen by religion, caste, race, sex, gender identity, sexual orientation, place of birth, region, language, disability, health status, political or union activity, or appearance, and never list anyone for rumours, social media posts, personal debts or having complained or blown the whistle. Article 15(2) of the Constitution bars restricting citizens’ access to shops, public restaurants, hotels and places of public entertainment on grounds only of religion, race, caste, sex or place of birth, which reaches malls and hotels, and section 4 of the Protection of Civil Rights Act 1955 makes enforcing such a disability on the ground of untouchability an offence. The DPDP Act allows processing only for a purpose “not expressly forbidden by law” (section 4), so a list that breaks such a law has no lawful purpose. Where no statute reaches your site, discriminatory screening is still indefensible.

Due process: adding, reviewing and removing a name

Before the State blacklists anyone, its show cause notice must state the grounds and the particular penalty proposed, and the Supreme Court has noted that blacklisting is described as “civil death” (Gorkha Security Services v Government of NCT of Delhi, 2014, paragraphs 17 and 20). That rule binds government bodies, but it is the standard you will be measured against if an entry is challenged.

1. Request in writing. Security, HR, the Internal Committee, a host or an employee at risk names the person, ground and evidence.
2. Approval by a named role. The head of security approves routine entries; POSH and employee matters also need HR or legal sign-off.
3. Tier and instruction. Decide “do not admit” or “admit with conditions” and write the one line the guard will see.
4. Review date set at entry, without exception.
5. Tell the person where it is safe and lawful. A debarment letter can say so; a person named in a police request or protection order usually should not hear it from you. Record which applies.
6. A route to challenge. Give anyone refused at the gate a grievance contact, and answer within your published timeline.
7. Removal on the review date unless the approver renews it with fresh reasons, with the removal logged.

What the DPDP Act asks of a visitor watchlist

A watchlist entry is “personal data” under section 2(t). Most DPDP duties apply from 13 May 2027 under Rule 1(4) of the DPDP Rules 2025 (SCC Online); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027. A proposal to shorten the timeline was reported in January 2026 (Business Standard); as of 12 October 2026 no change had been notified (S.S. Rana & Co.). What matters for a watchlist:

• Lawful purpose (sections 4 and 7). The listed person will not consent, and section 7 has no general security or legitimate interest ground. Clause 7(e) covers compliance with a judgment, decree or order under Indian law, which fits court orders; whether a police letter counts depends on what it is. Clause 7(i) covers employment and “safeguarding the employer from loss or liability” but is framed around employees, and PSA Legal advises against stretching it to non-employees. For incident-based entries the basis is unsettled.
• The offence exemption (section 17(1)(c)). Chapter II (except sections 8(1) and 8(5)), Chapter III and section 16 do not apply where data is processed “in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law for the time being in force in India”. The clause does not name the State, but we found no ruling on how far a private list can rely on it, and it could cover only entries tied to an offence. Treat it as an argument for counsel, never the foundation of the list.
• Accuracy (section 8(3)). Where data is likely to be “used to make a decision that affects the Data Principal” or disclosed to another Data Fiduciary, you must ensure its “completeness, accuracy and consistency”. Refusing entry is such a decision; sharing with a landlord or tenant is such a disclosure.
• Security (section 8(5) and Rule 6). Rule 6(1)(b) and (c) expect access control and “visibility on the accessing of such personal data, through appropriate logs, monitoring and review”. A WhatsApp photo of the list is hard to square with either.
• Notice and grievances. If check-in relies on consent, the notice under section 5 and Rule 3 should say check-in details are compared with the list. Under section 13 and Rule 14(3), publish how to raise a grievance and respond within ninety days at most.

Penalties reach ₹250 crore for security safeguards and ₹50 crore for other provisions, including accuracy (Schedule; section 33(2)). See our guide to the DPDP Act and your visitor register.

At the gate: matches, false positives and the quiet flag

Treat every match as a question for the supervisor. Name-only matching is unreliable in India: initials replace first names, spellings vary between scripts, and common names collide. NIST’s December 2019 study found that in one-to-one face matching, false positive rates differed across demographic groups, often by “a factor of 10 to 100 times” depending on the algorithm. Because false matches can fall more heavily on some groups, no automatic match should refuse anyone on its own; the supervisor’s check keeps a watchlist from becoming discriminatory in effect. Check invited visitors at the invite stage, so a match is resolved before arrival.

1. The flag, never the reason. The guard sees that the person needs the supervisor, plus the one-line instruction. Section 16 of the POSH Act bars complaint and inquiry details from being “published, communicated or made known to the public”.
2. A polite pause. “Please wait a moment, my supervisor will help you.” No accusation, no explanation.
3. The supervisor confirms identity against the evidence on file, with ID verification where your policy requires it.
4. Decide and record. Admit, admit with conditions or refuse; record who decided and why, including false matches cleared.
5. Escalate under the lobby emergency playbook if a refused person turns threatening.

Quiet reasons also limit defamation risk. Section 356 of the Bharatiya Nyaya Sanhita has an exception for imputations made in good faith to protect the interests of the person making them or of any other person, and a need-to-know entry is far easier to defend under it than a photo captioned “thief” in a guards’ WhatsApp group.

Sharing a watchlist between tenants, buildings and group companies

In towers and tech parks, the landlord runs the gate while each tenant knows its own risks. Under section 2(i), whoever decides “the purpose and means of processing”, alone or with others, is a Data Fiduciary, and disclosure to another fiduciary triggers the accuracy duty in section 8(3)(b). Shared lists have gone wrong before: in 2009 the UK Information Commissioner’s Office acted against a construction industry blacklist holding details of over 3,000 workers and used by over 40 companies (Pinsent Masons, 9 March 2009). A workable pattern for Indian towers:

• Building entries: the landlord holds entries that justify refusal at the building gate, with the evidence.
• Tenant entries: the tenant owns the ground, evidence and review date for its floor; the building sees only the instruction.
• A written agreement on who owns which entries, whether the building acts for the tenant as its processor, who sees reasons, how corrections and removals flow, and who answers grievances.
• No list swapping. One tenant’s problem with a person is not another tenant’s ground, and the same goes for group companies.

Government sanctions and terror lists: when they apply

• Section 51A of the Unlawful Activities (Prevention) Act 1967 lets the Central Government freeze funds of listed individuals and entities, bar anyone from making funds available to them, and “prevent the entry into or the transit through India” of listed individuals.
• The MHA order of 2 February 2021 sets the procedure. It works through banks, intermediaries, insurers, property registrars and other designated businesses, and leaves entry and transit to the immigration authorities (paragraph 12). An MHA corrigendum of 29 August 2023, circulated by IFSCA, extended paragraph 7 to “any other person”: anyone holding funds or assets of designated individuals or entities must freeze them without delay and immediately inform the nearest police station.
• The UN Security Council Consolidated List held 736 individuals and 274 entities at its update on 15 October 2026.

For most offices, factories and campuses these lists concern payments and counterparties, which finance may already screen. They matter at the gate where a regulator or government customer requires it, or at sensitive sites; see visitor management for critical infrastructure.

How long to keep a watchlist entry

• Active entry: stays only while the ground lasts, until a court order expires, a debarment ends or a review finds the reason gone. Section 8(7) requires erasure once the purpose is no longer served.
• Decision record and log: Rule 8(3) of the DPDP Rules asks for personal data, associated traffic data and processing logs to be kept for at least one year from processing for the purposes specified in the Seventh Schedule, then erased unless another law requires longer. Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding all fiduciaries.

So a removed entry leaves the guards’ view at once, and the archived decision, approvals and access log are erased a year later unless litigation, a police matter or another law needs them. Your DPO and counsel should sign that rule off.

Watchlist entry record: a template

Copy this into your list, spreadsheet or system. “Restricted” fields are visible only to the head of security, HR or legal.

Policy clauses to adopt with it:

1. [Company name] keeps a visitor access restriction list for the safety of people and property at [sites].
2. An entry requires a written request, evidence and approval by [Head of security]; entries arising from POSH or employment matters also require approval by [HR head or legal].
3. No entry may be based on religion, caste, race, sex, gender identity, sexual orientation, place of birth, region, language, disability, health status, political or union activity or appearance.
4. A person under 18 is listed only where a court order or written police request names them, with approval by [legal head].
5. Guards see only the instruction; reasons are visible only to [roles].
6. No match, whether by name or by face, refuses entry on its own; [supervisor] confirms identity and records the outcome, including false matches.
7. Every entry has a review date no more than [six] months ahead; expired entries leave the active list.
8. Entries are shared outside [Company name] only under a written agreement and only as instructions.
9. Every look at the list is logged; [DPO] reviews the log every [month] and, with [legal head], the whole list and this policy every [year].
10. Records of removed entries are erased [one year] after removal unless a law, litigation or a police matter requires longer.
11. Anyone refused entry may contact [grievance contact], who responds within [period, not more than 90 days].

Visitor watchlist checklist

1. Every entry has a ground, evidence, an approver and a review date.
2. No entry relies on a protected attribute, rumour or social media.
3. Guards see a flag and an instruction, never the reason.
4. A supervisor confirms every match, by name or face, before anyone is refused, and false matches are recorded.
5. The list lives in one access-controlled place with every look logged, never in WhatsApp groups or printouts.
6. Shared entries sit under a written agreement, with one owner each.
7. Expired entries leave the active list; archived records are erased after one year.
8. The visitor notice says check-in details are checked against access restrictions.
9. Counsel has signed off the legal basis for each type of entry before May 2027.

Where Orb fits

Orb, our visitor management system, gives the guard a quiet watchlist flag: names on your watchlist show a flag, and the reason stays with you.

Questions buyers ask