Visitor Data Privacy for RWAs: Collect Less, Protect Better

The law, in one paragraph

The Digital Personal Data Protection Act, 2023 places duties on a Data Fiduciary, the entity that decides why and how personal data is processed. Its relevant provisions, as enacted, include notice to the Data Principal (section 5), consent that is free, specific, informed and unambiguous (section 6), reasonable security safeguards to prevent personal data breach (section 8(5)), intimation to the Board and each affected Data Principal in the event of a breach (section 8(6)), and erasure when the specified purpose is no longer served (section 8(7)), alongside a right of grievance redressal (section 13). Whether a given RWA is treated as a Data Fiduciary in a specific situation is a legal question this article does not answer. The practices below make sense either way.

Purpose: write it down first

Before touching the register, the managing committee should write one sentence per data item. "Visitor phone numbers let the guard call the flat." "Vehicle numbers let the parking register stay useful." If a sentence cannot be written, the column should not exist. This exercise kills the two classic over-collections at Indian gates: identity photocopies and visitor photographs, both of which rarely serve a stated purpose that a name and phone do not already serve.

Collection: the minimum gate

Data item	Purpose sentence	Keep or drop
Visitor name	Identify the person at the gate	Keep
Visitor phone	Contact for the visit; dispute resolution	Keep
Flat and host	Route the approval	Keep
Entry and exit time	Prove duration of visit	Keep
Purpose category (guest, delivery, service)	Choose the right flow	Keep
Identity document copies	No clear purpose beyond the name	Drop
Full Aadhaar number	Not needed; high risk	Drop
Photographs of visitors	Recognition is the guard's job	Drop unless a tool needs it with notice
Vehicle number	Parking and incident follow-up	Keep only if the society manages parking

Notice: the sign at the gate

Section 5 of the Act exists so that people know what is being collected and why. A laminated card at the gate does this in practice: what the register records, why, who to contact about it, and how long entries are kept. Bilingual, five lines, no legal jargon. Guards should be able to point to it rather than argue about it.

Access and devices

Most visitor-data incidents at societies are not hacks. They are oversharing: a register left open at the desk, a guard phone without a passcode, a screenshot of the day's entries forwarded to a residents' group to shame a vendor. Tighten four things:

1. Guard devices get passcodes and automatic lock. One shared device has one accountable holder per shift.
2. The register is not public. Curious residents get incident summaries, not the visitor history of their neighbours.
3. Exports need a reason. Office bearers may pull a specific date for a specific incident, recorded in the minutes.
4. Vendors and their staff are people too. Their details collected for gate approval deserve the same deletion schedule as guests.

Retention: choose numbers and keep them

Pick a retention period the committee can defend: a common practice band is 30 to 90 days for routine visitor entries, with anything tied to a specific incident preserved separately until it closes. Then automate or calendar the purge. Under the Act's erasure logic, personal data kept past its purpose is not neutral; it is a liability. Registers that run for years unread are how a stolen laptop becomes a neighbourhood privacy incident.

Incident response: the one-page plan

Write the plan before you need it.

1. Contain. Retrieve or lock the device or book; change shared credentials.
2. Assess. What leaked: names and phones, or identity documents? How many people?
3. Inform. Tell affected residents and visitors promptly and plainly. Section 8(6) of the Act requires a Data Fiduciary to intimate the Board and each affected Data Principal after a personal data breach; for an RWA the honest course is the same, and serious cyber incidents should also be checked against current CERT-In reporting requirements.
4. Fix the cause, not just the symptom.
5. Record the incident and the response in committee minutes.

Common mistakes

• Photocopying workers' IDs into a society file. Purpose undefined, retention infinite, risk high.
• The WhatsApp-forward register. Daily visitor lists broadcast to all residents turn a security record into neighbourhood gossip.
• No exit column. Half a record is worse than none when an incident is investigated.
• Guard turnover without handover. Device passcodes and register custody must transfer formally.
• Collecting more after an incident. When something goes wrong, societies often add fields rather than fix access. Add less, protect better.
• No deletion ever. Decide the number of days and enforce it.

Where Agman fits

Agman by Big Helpers is a residential society and visitor workflow app whose listing makes privacy commitments societies can ask of any tool. It states that Agman has no advertising, behavioural analytics or tracking, never stores a full Aadhaar number, hosts data in India, supports offline verification of signed gate passes, and allows account deletion from inside the app. These are exactly the questions a committee should put to any vendor: what is collected, where it is stored, who can export it, and how a household's data is deleted. Agman is available on iOS. Android is in controlled testing. The same questions can be asked in reverse, and the Big Helpers trust page answers them for its own products.

One next step

Put the five-line bilingual notice at your gate and fix a deletion date this month. To compare a tool against these practices, Agman's privacy commitments and current status are listed on the Big Helpers apps page. For the organisation-side view of the law, see our DPDP compliance guide for Indian websites.

Frequently asked questions

Is our RWA legally a Data Fiduciary?

This article does not give a legal opinion. The duties in the Act attach to whoever decides the purpose and means of processing, so a committee that decides what the register collects should simply act as if good data practices apply. For a formal view, consult a lawyer.

Do we need visitor consent for the register?

Practically, a clear notice at the gate plus honest answers beats paperwork. Consent that is free, specific and informed is the standard in the Act, and a laminated card plus a guard who can explain the register gets you most of the way.

What about domestic staff details held by the society?

Same principle: purpose first, minimum fields, a retention date, and access only for the office. Standing lists are better than re-collecting identity documents every month.

How do we answer a resident who asks what we hold about her visitors?

Have a process: the secretary or a designated office bearer pulls the relevant entries, shares them, and notes the request. Section 13 of the Act makes grievance redressal a right; a committee with a named contact handles it easily.

Should visitor data stay in India?

The Act's framework and CERT-In expectations make India-hosted data simpler to defend, and Agman's listing confirms India hosting. Ask every vendor where data rests and who can export it.

What is the single best first step?

Delete the identity-photocopy file. It is the highest-risk, lowest-purpose collection most societies hold.

General information about the DPDP Act, 2023 and society practice, not legal advice. Consult a lawyer for your association's specific obligations.