DPDP Rules 2025 Compliance Checklist for Visitor Data

This is a working checklist, not an explainer. Twenty-two items in seven phases, each with a note on how to do it and a test for when it is done.

It covers one thing: the personal data you collect at the gate and reception names, phone numbers, photographs, ID details, vehicle numbers, host names, in-out timings. If you want the law explained first, read our plain-English guide to the DPDP Act for visitor management and come back.

Every rule number, date and penalty below links to a source, verified on 15 September 2026. This is general information, not legal advice.

Which deadline actually applies to you

Most obligations on this list commence on 13 May 2027. November 2026 is not a universal deadline, despite how it is often reported.

13 May 2027 is when the obligation becomes enforceable, not when you should start items 1 to 3 take a quarter on their own across multiple sites.

How to use this checklist

Work the phases in order Phase 1 feeds everything after it. Each item gives the shortest honest path to getting there, plus a test someone else can run to confirm you closed it.

Phase 1 Map what you collect at the gate

1. Inventory every place visitor data lives.
   How: Walk each site. Registers, gate software, Excel sheets, the WhatsApp group where security sends the day's list, parking logs, contractor induction forms, CCTV, the pass printer.
   Done when: One spreadsheet lists every location, medium, site and owner, and a second person walks the same site and finds nothing you missed.
2. List every field you collect, per visitor type.
   How: Photograph your check-in form and write out each field. Split by visitor type business visitor, contractor, courier, interview candidate, vendor. They rarely need the same fields.
   Done when: Every cell in the field-by-visitor-type grid is either marked "required" with a one-line reason, or marked for removal.
3. Delete the fields you cannot justify.
   How: For each field ask, "what decision does this let us make?" Data you do not hold cannot leak.
   Done when: The live form matches the grid, and removed fields no longer appear in new records.
   

Phase 2 Fix the notice and the consent

4. Write a standalone, plain-language notice.
   How: Rule 3 requires a notice understandable independently of any other information, in clear and plain language, itemising the data collected and the specified purpose. Write it as a short card, not legalese taped to the counter.
   Done when: A guard on shift can explain it, and it is displayed where the visitor gives their data.
5. Put the withdrawal and rights route on the same notice.How: Rule 3 also requires the notice to state how the visitor withdraws consent "with the ease of doing so being comparable to that with which such consent was given", how to exercise their rights, and how to complain to the Board.
   Done when: It names a real, monitored channel, and someone has tested it with a live deletion request.
6. Unbundle security consent from everything else.
   How: Using visitor contact details for marketing, invitations or surveys is a separate purpose needing separate, specific consent. One blanket tick does not meet the standard.
   Done when: A separate, unticked box exists for any non-security use, and check-in completes without it.
7. Publish a contact point for visitor data questions.
   How: Rule 9 requires you to prominently publish the business contact information of your Data Protection Officer, if applicable, or a person who can answer questions about the processing.
   Done when: The contact appears on your public privacy page and on the notice at the desk, and the named person knows they are named.

Our guide to visitor consent and notice wording covers the drafting.

Phase 3 Fix retention and erasure

8. Write a retention schedule with a stated purpose per line.
   How: There is no fixed period for visitor records the duty is purpose-based. Do not borrow the Third Schedule's three-year timers; those bind specified large e-commerce, social media and online gaming platforms, not your factory gate.
   Done when: Every line has a purpose, a period and a named approver from legal.
9. Prove you can delete a single visitor's record.
   How: Pick a real record from last month and delete it in the VMS, the Excel export, the emailed daily report, the backup. Most teams discover here that it lives in four places and they can only delete one.
   Done when: The test is run, the record is gone everywhere, and you have noted how long it took and who did it.
10. Separate security logs from visitor records.
    How: Rule 6(e) requires retention of logs for one year. That is a logging obligation, not permission to keep every visitor's phone number for a year.
    Done when: The schedule has distinct lines for visitor records and access logs, with different periods and justifications.

Phase 4 Fix security safeguards under Rule 6

Rule 6 carries the largest penalty on this list, so treat it as the priority phase.

11. Close the open-register problem.
    How: A register on a counter shows every previous visitor's details to the next person signing in. That fails Rule 6(b) access control at the most basic level.
    Done when: A visitor at your busiest gate cannot read anyone else's name, number or host.
12. Replace shared logins with named, role-based accounts.
    How: Rule 6(b) requires appropriate measures to control access to computer resources used. One shared login for twelve guards across three shifts is not access control.
    Done when: Every account maps to one named person, and you can list who opened the visitor log yesterday.
13. Turn on logging and monitoring, and keep the logs.
    How: Rule 6(c) requires visibility on access to personal data through logs, monitoring and review to detect unauthorised access; Rule 6(e) requires keeping them a year.
    Done when: You can produce an access log for a named date range without asking your vendor.
14. Get encryption and backup confirmations in writing.
    How: If a vendor holds the data, Rules 6(a) and 6(d) are still your obligation. Ask: encrypted at rest and in transit, hosted where, backed up how often, restore tested when.
    Done when: The answers are in an email or contract annexe, not a sales deck.

Phase 5 Fix breach response under Rule 7

15. Write the breach playbook with both clocks on it.
    How: Rule 7 has two duties. Intimate each affected Data Principal without delay nature, extent and timing, likely consequences, mitigation taken, safety measures they can take, and a contact for queries. Separately notify the Board within 72 hours, or a longer period the Board allows.
    Done when: The playbook states both duties separately, names who starts each clock, and lists the out-of-hours contact.
16. Work out now how you would reach affected visitors.
    How: Visitors are not on your directory. Check whether you hold a usable contact channel for every record, and what you would do where you do not.
    Done when: You can state, per visitor type, the channel and roughly how many people are involved.
17. Run one tabletop drill against the 72-hour clock.
    How: Pick a plausible scenario a stolen reception tablet, a visitor list emailed to the wrong address. Ninety minutes with admin, IT and legal.
    Done when: It is documented with a date, attendees, and the three things it showed you were not ready for.

Phase 6 Fix vendor and processor contracts

18. Confirm the fiduciary/processor split in writing.
    How: You are the Data Fiduciary you decide why visitor data is collected. Your VMS vendor is normally a Data Processor acting on your instructions. The obligation stays with you either way.
    Done when: The contract says which party is which, in those words.
19. Get the Rule 6(f) safeguards clause into the contract.
    How: Rule 6(f) expects an appropriate provision in the contract between Data Fiduciary and Data Processor requiring reasonable security safeguards. Add breach notification on a timeline that lets you meet your own 72-hour duty, plus deletion on termination and sub-processor disclosure.
    Done when: A signed contract or addendum exists and procurement holds a copy.
20. Do the same for the vendors nobody thinks of.
    How: Housekeeping, security agencies, parking operators, canteen contractors and event partners all touch visitor data.
    Done when: Every third party on the Phase 1 inventory has a clause, or a documented decision that it needs none.

Phase 7 Build the audit evidence pack

21. Assemble one folder that answers what you will be asked.
    How: The Phase 1 inventory, the field justification grid, a photo of the live notice at each site, the retention schedule with legal sign-off, the access policy and account list, a sample access log, the breach playbook and drill record, and the signed vendor clauses.
    Done when: Someone who did not build it can answer "what visitor data do you hold, and for how long" from the folder alone.
22. Set a review date and an owner.
    How: Sites change, vendors change, and removed form fields get added back by well-meaning people. Quarterly until 13 May 2027, half-yearly after.
    Done when: The review is scheduled with a named owner and the folder is versioned and dated.

Who is accountable for each phase

The one-page summary

What it costs to get this wrong

Phases 4 and 5 carry the largest exposure, which is why they are worth bringing forward if you have to sequence.

Where software closes the gap

Items 9, 11, 12, 13 and 21 ask you to prove who saw what, when. That is a systems question, and it is where a notebook and a shared spreadsheet run out.

VizMan covers the structural part: OTP verification at the gate, role-based modules for Admin, Security, Reception and Host, digital or printed visitor passes instead of an open counter register, and a dashboard an admin can pull a record from. Offline mode keeps gates with patchy connectivity off paper.

Whatever you choose, put these in writing before you sign: where data is hosted and whether it is stored in India; encrypted at rest and in transit; retention periods configurable with automatic deletion; individual record deletion logged; access logs retained for at least a year and exportable; breach notification commitment in hours; sub-processors disclosed; what happens to data when the contract ends.

Official sources

Statutory references in this checklist were checked against the official texts published by the Ministry of Electronics and Information Technology (MeitY), Government of India:

• The Digital Personal Data Protection Act, 2023 (official text, including the Schedule of penalties)
• The Digital Personal Data Protection Rules, 2025 (notified 13 November 2025)

This checklist is general information, not legal advice. Confirm applicability to your organisation with a qualified adviser.