DPDP for housing societies and RWAs

The society is the fiduciary, not the secretary

When the register lives in a committee member’s personal email, phone or spreadsheet, the society loses control of it at every election. Keep registers, app administration, CCTV access and group admin rights in accounts the society owns, with a hand-over checklist: new office-bearers get access, outgoing ones lose it, and the change is recorded.

Collecting dues is a legitimate purpose. Posting defaulters’ names in groups or on notice boards goes well beyond what collecting dues needs, and it is a frequent cause of complaints.

Members often have rights under the society’s bye-laws and state co-operative or apartment ownership laws to inspect certain records. Give access to what those rules allow, and no more. Under legal review: Members’ inspection rights depend on the state law and bye-laws that apply to each society.

Hand over

Register files, app admin rights, CCTV passwords, group admin, billing software.

Remove

Outgoing members’ access the same day, and copies on personal devices.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

Mr Iyer rents a flat in a gated society. His cook enters daily through the gate app, which photographs her. The society employs a security agency through a facility management company and pays a software company for the gate app.

If the gate-app company used visitor data to sell services to residents, it would be deciding its own purpose and become a fiduciary for that use. A smaller society without a gate app has no such provider: its guards and paper register are its own.

What a housing society holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Move-in, tenant and staff registration forms
• Maintenance billing and payment collection
• Society WhatsApp groups and notice boards
• Gate and visitor-management apps (where used)
• CCTV and number-plate cameras (where installed)
• Biometric entry or attendance devices (where used)

Where it goes

Where housing societies are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

43 controls written for housing societies, on top of 66 common ones

Alongside the common controls, the housing society assessment asks about the register and the committee first, then about the systems around them: CCTV, service providers, staff records, WhatsApp groups and dues. It asks early on whether the society has CCTV, uses outside providers such as a facility manager or security agency, or uses a gate app, biometric devices or number-plate cameras; for anything the society does not have, the questions about it are not asked and do not count.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. RWA-01 Critical

   Is the resident register kept in the society's own accounts, with a set process to hand it to the next committee and remove it from outgoing members' devices?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Society accounts with a handover process.

   Why it is asked: Data on personal devices of outgoing members leaves the society's control.

2. RWA-02 High

   Do you avoid sharing lists of defaulters or dues in group chats and on notice boards?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Dues are raised individually.

   Why it is asked: Publishing dues goes beyond the purpose of collecting them and can harm the resident.

3. RWA-03 High

   Is your gate or visitor-management app provider bound by written data terms, including how long visitor records are kept?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Terms cover use and retention.

   Why it is asked: The app provider processes residents' and visitors' data for the society.

4. RWA-04 Medium

   Are there CCTV notices at entrances, with footage viewable only by named people and overwritten after a set period?

   Answers: Yes, Partly, No, Not sure · “Yes” means: All three are in place.

   Why it is asked: Footage of residents, staff and visitors is personal data; it must be protected and kept only as long as needed.

5. RWA-05 High

   Are domestic staff and driver ID documents stored securely and deleted when they stop working in the society?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Secured and deleted on exit.

   Why it is asked: Staff ID copies are rarely protected and often kept long after the person has left.

6. RWA-30 High

   Do you refuse to share resident lists or numbers with vendors, builders, service providers or campaigners for their own use without residents' consent?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Never shared without consent.

   Why it is asked: Each recipient using the data for its own purposes needs a basis.

All 43 questions written for housing societies

1. RWA-08 Have you agreed in writing with your facility management company, security agency and community app provider who decides how residents' data is used, and that they act only for the society? Organisation and role mapping
2. RWA-09 Have you identified every group whose data the society holds: owners, tenants, family members including children, domestic staff, drivers, visitors, delivery workers and vendors' staff? Organisation and role mapping
3. RWA-10 Do move-in, tenant and domestic-staff forms ask only for what the society needs, without religion, full family histories, or ID copies of every family member unless a local order requires them? Data inventory and purpose
4. RWA-11 Do you know where old society data sits: previous committees' spreadsheets and phones, old visitor books, paper registers and old email accounts? Data inventory and purpose
5. RWA-07 Have residents been given a short notice explaining what data the society holds, why, and whom to ask about it? Notice and transparency
6. RWA-04 Are there CCTV notices at entrances, with footage viewable only by named people and overwritten after a set period? Notice and transparency
7. RWA-12 Are visitors and delivery workers told, at the gate, what is recorded (name, number, photograph, vehicle) and why? Notice and transparency
8. RWA-06 Do residents know that their number is visible to every member of society WhatsApp groups, and can they join without exposing it? Consent and lawful basis
9. RWA-13 Are residents listed in a printed or app directory only if they agreed, with the choice of what to show? Consent and lawful basis
10. RWA-14 Are photographs from society events shared on groups or social media only where those shown agreed, with a way to ask for removal? Consent and lawful basis
11. RWA-15 Can residents, staff and visitors ask to see, correct or delete their data, with requests tracked so they are not lost when the committee changes? Data Principal rights
12. RWA-17 Are children's details (names, photographs, school timings, who may collect them) kept to what safety needs and seen only by security staff who need them? Children and guardians
13. RWA-18 Before charging penalties or restricting facilities for unpaid dues, do you check the records and give the resident a chance to correct errors? Data quality
14. RWA-19 When residents move out or details change, are the gate app, guards' lists and facility manager updated? Data quality
15. RWA-20 After residents or tenants move out and dues are settled, is their data deleted except what society records must keep? Retention and deletion
16. RWA-05 Are domestic staff and driver ID documents stored securely and deleted when they stop working in the society? Retention and deletion
17. RWA-21 Are visitor records in gate registers and apps deleted after a set short period? Retention and deletion
18. RWA-22 Are CCTV recorders, gate tablets and committee laptops wiped before disposal, return or repair? Retention and deletion
19. RWA-23 Are resident and staff records kept in password-protected, encrypted storage, with identity numbers masked? Security safeguards
20. RWA-24 Is the CCTV recorder in a locked place, with its default password changed and remote viewing limited to named people? Security safeguards
21. RWA-25 Are lost access cards deactivated at once, cards of departed residents and staff cancelled, and entry logs protected? Security safeguards
22. RWA-43 Is biometric data used only for attendance or entry, stored as templates by the device, with an alternative offered, and deleted when people leave? Security safeguards
23. RWA-44 Are vehicle numbers and number-plate camera records used only for parking and entry, visible only to security, and deleted after a set period? Security safeguards
24. RWA-26 If CCTV footage, the resident register or staff records are shared without authority, is it logged and notified to the Board and the people affected? Breach response
25. RWA-27 Are your facility management company, security agency and billing software provider bound by written data terms? Processors and vendors
26. RWA-28 Do contracts require providers to report breaches at once and, when replaced, hand back visitor registers, staff records and footage and delete their copies? Processors and vendors
27. RWA-29 Before appointing a provider who will see residents' data, does the committee check how it protects data and who will access it? Processors and vendors
28. RWA-03 Is your gate or visitor-management app provider bound by written data terms, including how long visitor records are kept? Processors and vendors
29. RWA-42 Are the guards' gate devices locked with a PIN, with guards able to see only visitor entries and not residents' full profiles? Access control
30. RWA-02 Do you avoid sharing lists of defaulters or dues in group chats and on notice boards? Data sharing and disclosure
31. RWA-30 Do you refuse to share resident lists or numbers with vendors, builders, service providers or campaigners for their own use without residents' consent? Data sharing and disclosure
32. RWA-31 Does the society record when residents' or staff data is given to outside parties, such as the police, municipal bodies or providers? Data sharing and disclosure
33. RWA-32 Are requests for residents', staff or visitors' data, or footage, from police and municipal bodies made in writing, checked by a named office-bearer, limited and logged? Data sharing and disclosure
34. RWA-16 When members ask to inspect society registers or records, do you give access only to what the bye-laws allow, without exposing other residents' personal details beyond that? Data sharing and disclosure
35. RWA-33 Do you know where the society's app, billing software, email and cloud storage keep data? Transfer and storage location
36. RWA-34 Where society tools store data outside India, has the country been checked against any government restriction? Transfer and storage location
37. RWA-35 Are residents' consents, the disclosure log and committee decisions about data kept in society accounts and handed to each new committee? Records and evidence
38. RWA-01 Is the resident register kept in the society's own accounts, with a set process to hand it to the next committee and remove it from outgoing members' devices? Access control
39. RWA-36 Can each office-bearer, the manager and guards see only the records their role needs (for example, the treasurer billing, guards visitor entries)? Access control
40. RWA-37 Is two-step sign-in turned on for the society email, app admin and billing accounts? Access control
41. RWA-38 Is access to society accounts, the app and CCTV reviewed when the committee changes and at least yearly? Incident testing
42. RWA-39 Is there a written policy covering groups, footage, registers, staff records and requests from residents? Policy and training
43. RWA-40 Are guards, managers and helpdesk staff briefed not to give residents' details, flat numbers or movements to callers and visitors? Policy and training

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• A short privacy notice given to residents and displayed at the gate
• Register held in a society-owned account, with the access list
• Hand-over checklist from the last election
• Data terms with the gate-app provider, facility manager and security agency
  Where applicable: these are engaged
• CCTV signage, named viewers and the overwrite period
  Where applicable: cCTV is installed
• Rule for deleting domestic staff records after they leave
• Committee resolution adopting these practices

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. Stop posting defaulter names in groups and on boards

   Now

2. Move the register, app admin and billing to society-owned accounts

   Now

3. Sign data terms with the gate app, facility manager and security agency

   Before 13 May 2027
   Where applicable: the society uses them

4. Display CCTV notices and name who may view footage

   Before 13 May 2027
   Where applicable: cCTV is installed

5. Give residents a one-page privacy notice

   Before 13 May 2027

6. Run the hand-over checklist at every election

   Ongoing, at every election

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports a housing society usually needs

A society’s result is read by the managing committee and, often, by members at the general body meeting.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.