RWAs and Housing Societies: A DPDP Act Impact Study

Executive summary

A gated housing complex runs on personal data. The gate app records every cook, driver and courier, often with a photograph. Cameras watch the lobby. The office keeps a register of members, tenants' agreements and a ledger of dues, and several hundred residents share one WhatsApp group.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) makes whoever decides why and how that data is processed a data fiduciary, answerable to each data principal, the person the data is about. Its definition of "person" includes "an association of persons or a body of individuals, whether incorporated or not", so co-operative housing societies, apartment owners' associations and unregistered residents' welfare associations (RWAs) all qualify. The s.3(c)(i) exclusion for data processed "by an individual for any personal or domestic purpose" covers a resident's own doorbell camera, not the association's gate.

Headline impact rating: High. Six of the twelve areas in the Trayambic scorecard are rated High. The three biggest changes:

1. 1.Security needs a stated legal ground. There is no "legitimate interests" ground. In our view, details people hand over at the gate fit s.7(a); cameras aimed at preventing offences can rest on the s.17(1)(c) exemption; facial recognition, directories and most app extras need consent.
2. 2.Volunteers become custodians. Identity copies, gate logs and footage need safeguards, deletion dates and a breach plan, and every change of committee needs a data handover.
3. 3.Vendors must be given a role. A visitor app or facility-management company is either a data processor acting on the society's instructions or a separate fiduciary with its own purposes. The contract must say which, and the society stays answerable for its processors.

The main obligations commence on 13 May 2027. Maharashtra is rewriting its housing rulebook at the same time, and its August 2026 draft model bye-laws add a confidentiality note for members' identity and bank details.

Background

Who this study covers

Co-operative housing societies; apartment owners' associations; RWAs, registered or not; the facility-management (FM) companies and security agencies that run the office and gate; and visitor-management apps. Trayambic's real estate and proptech study looked at buildings from the developer's side; this study looks at the society itself.

Whose data, and what data

The data principals are members and families, nominees, tenants, domestic workers, drivers, delivery staff, visitors, children, the society's staff, agency guards and committee members.

The data runs from the register of members and nominations to maintenance ledgers, leave and licence agreements, police verification copies, Aadhaar and PAN copies, vehicle numbers, gate entries with photographs, facial templates, CCTV footage, complaints, minutes and video recordings of meetings.

Where it flows

A visitor's details go from the guard's tablet to the app's cloud and the resident's phone, and stay in the vendor's log. Tenant papers reach the office by email or chat. Accounts go to software, auditors and the Registrar; footage goes to the police; much else moves through WhatsApp.

Legal framework

The DPDP Act and Rules

• Who is covered (ss.2(i), 2(s), 3(a), 2(x)). Any "person" deciding purpose and means, including an unincorporated association. The Act covers digital personal data, including paper records "digitised subsequently"; a handwritten gate register is outside it until someone photographs or types it up.
• Grounds (ss.4, 6, 7). Consent, or a legitimate use: data "voluntarily provided" for a specified purpose (s.7(a)); legal duties to disclose information to the State (s.7(d)); compliance with a judgment or an "order issued under any law" (s.7(e)); and employment (s.7(i)), which covers only the society's own employees. There is no legitimate interests ground and no general legal-obligation ground.
• Exemptions (s.17(1)). Most of the Act does not apply to processing "necessary for enforcing any legal right or claim" (s.17(1)(a)) or "in the interest of prevention, detection, investigation or prosecution of any offence" (s.17(1)(c)). Responsibility for processors (s.8(1)) and security safeguards (s.8(5)) still apply.
• Duties (s.8; Rules 6, 7, 9). Security safeguards; breach notice to the Data Protection Board and every affected person, with a detailed report to the Board within 72 hours; erasure once the purpose ends unless law requires retention; and a published contact. Only a Significant Data Fiduciary (SDF) designated under s.10 needs a Data Protection Officer.
• Rights and children (ss.9, 11 to 13; Rule 14). Access, correction and erasure rights, and grievances answered within 90 days; verifiable parental consent and no "tracking or behavioural monitoring of children" beyond what the Rules allow.
• Penalties (s.33(2)). The Board must weigh gravity, mitigation, proportionality and "the likely impact of the imposition of the monetary penalty on the person".

Co-operative housing law: Maharashtra as the example

Maharashtra Act XXIII of 2019, deemed in force from 9 March 2019, gave housing societies their own chapter, Chapter XIII-B, in the Co-operative Societies Act, 1960. The provisions that matter for data:

• s.154B-8: every member may inspect, free, the list of committee members, "a register of members", minutes, and the parts of the books recording her own transactions, and obtain copies within 45 days.
• ss.154B-1(11), 154B-23 and 154B-29: a "defaulter" is a member, flat owner or occupier who has not paid dues within three months; defaulters cannot sit on the committee; and the Registrar may certify arrears for recovery as arrears of land revenue.
• s.79A: the State's power to direct societies in the public interest, which still applies to housing societies.
• s.160: handing over records and property to a newly elected chair.

The Maharashtra Co-operative Societies (Amendment) Rules, 2026, dated 18 June 2026, prescribe the list of members in Form J and require the video recording of a redevelopment meeting to be kept in the chair's custody. Draft model bye-laws, posted by the State's Commissioner for Co-operation for comment in August 2026, would allow an official digital platform for notices (bye-law 2(b)); add a note that the society "shall not disclose or provide copies of any confidential, personal or sensitive information" of members, such as Aadhaar, PAN or bank details, unless law or a competent authority requires it (bye-law 39); require a member who lets her flat to give written intimation with the agreement and any required police intimation or verification (bye-law 40(a)); and list CCTV and access control among common installations (bye-law 45(b)).

Apartment ownership laws

Where flats are owned outright, State apartment ownership Acts create an association of owners. Delhi's Apartment Ownership Act, 1986 describes the owners acting "as a group in accordance with the bye-laws". Punjab's Apartment Ownership Act, 1995 makes an owner, allottee or occupier a member from possession (s.17(3)) and requires model bye-laws to provide for minute books, financial records and collection of charges from owners "or any other occupants" (s.20(4)). These laws require records but say almost nothing about privacy.

Police verification and cameras

• Verification orders. District magistrates issue time-bound orders under s.163 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS). South Goa's, in force for 60 days from 16 July 2024, required landlords to give tenants' particulars to the police before letting, on pain of prosecution under s.223 of the Bharatiya Nyaya Sanhita. It bound landlords and accommodation providers, not societies. The Delhi Police publishes standard tenant and domestic help verification forms.
• Footage requests. A written requisition under s.94 BNSS (summons to produce a document or other thing) gives the society a record of what it released and why.
• CCTV. We found no general law requiring cameras in housing. Telangana's Public Safety (Measures) Enforcement Act, 2013 requires cameras with 30 days' storage where 100 or more people may gather, but its examples are commercial, religious, educational and similar venues, not homes. Cameras sold in India must now be tested against the Government's CCTV essential requirements.

How the layers fit

Section 38 makes the DPDP Act additional to these laws and lets it prevail in a conflict. Co-operative and apartment laws require records; the DPDP Act governs how they are kept, and s.8(7) protects retention that law requires. Registrar filings fit s.7(d); particulars given under a magistrate's order fit s.7(e).

Member-to-member inspection is harder. No s.7 clause covers a disclosure to a private person that a law requires. In our view, s.7(a) does the work: a member provides her data for the specified purpose of membership, and inspection by fellow members under s.154B-8 is a statutory incident of membership. The admission form should say so. Section 16(2), on stricter sector rules for transfers abroad, has little to bite on.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Grounds at the gate

Map each group of people to a ground before buying more technology:

• Members. Admission data fits s.7(a) for billing, meetings, elections, registers and filings.
• Tenants. The owner's intimation gives the society a tenant's name and tenancy dates. It rarely needs her Aadhaar copy; a note that police intimation was made, with date and reference, does the job.
• Visitors. A visitor who gives her name, the flat and a number for an approval message has provided them for entry, which fits s.7(a). Photographing every guest goes further; keep photographs only where they serve security, and only for days.
• Domestic workers. A cook who registers for a gate pass provides her details to get in to work. In our view s.7(a) fits better than consent, which must be "free" and rarely is when a livelihood depends on the gate. That makes minimisation the society's duty: a verification status, not document copies. Ratings, reviews or attendance records visible to every resident are a new purpose needing her consent; a blacklist shared across societies has, in our view, no ground at all.
• Cameras. Trayambic's cybersecurity impact study explains why, in our view, s.17(1)(c) is framed by purpose rather than by who processes. Cameras at gates, lifts and parking that deter and detect theft or trespass can rest on it. The exemption follows the purpose: checking a housekeeper's arrival time or posting a clip in the residents' group is not offence prevention and has no obvious ground.
• Facial recognition. A face template serves convenience, so it needs consent, which must be free and as easy to withdraw as to give. That means a card or PIN for anyone who declines. Workers should never be required to enrol, and children are best left out.

Gate logs of children's comings and goings raise s.9(3). Trayambic's real estate study discusses exit alerts to parents; a standing movement history of every child in the complex goes further than safety needs.

Visitor apps and FM companies: processor or fiduciary?

The test is who decides why the data is used. An app that records entries, sends approval requests and shows logs to the committee, as the society configures it, is a processor. An app that also uses the data for its own ends, such as offers to residents, worker profiles that follow a cook from society to society, advertising or analytics, is a fiduciary for those uses and needs its own ground. Many apps are both.

Section 8(1) holds the society answerable for processing "on its behalf by a Data Processor", irrespective of any agreement. For a gate app, the contract should answer practical questions: where the logs sit and who at the vendor can open them; whether the committee can set how long entries are kept and switch off features such as worker ratings; whether society data feeds the vendor's other products; how fast the vendor reports an incident; and what happens to the logs when the society leaves.

FM companies and security agencies employ the managers, guards and housekeepers. They, not the society, are the employers for s.7(i); the society needs only rosters and the details required for site access.

Group chats, notice boards and defaulters

A society's official WhatsApp group is society processing, and Maharashtra's draft bye-laws would formalise an official digital platform. A group can expose every member's number to every other member. Use announcement-only channels, add people on request, and never post identity documents, gate logs or footage.

Defaulters are a recurring flashpoint. The Maharashtra Act defines a defaulter, bars defaulters from the committee and provides recovery through the Registrar. In our view s.17(1)(a) covers what is necessary to enforce the claim: bills, reminders, legal notices, the recovery application and checking eligibility at elections. Naming members on a notice board or in a group chat is pressure, not enforcement, and a list printed from the accounts software is a disclosure of digital data. Report arrears in the accounts, and name individuals only where a decision of the general body requires it.

Resident directories are opt-in: consent, a Rule 3 notice and an easy way out.

Committees, elections and the small society

The fiduciary is the society, but its data lives on volunteers' phones, personal email accounts and drives, and volunteers change every few years. An election handover, which s.160 requires in Maharashtra for records and property, should cover data too: transfer of administrator rights in the app, email and cloud folders; revocation of departing members' access; deletion of personal copies, recorded in the minutes; and an updated s.8(9) contact.

The Act has no small-entity threshold, and no class of fiduciaries has been exempted under s.17(3). What it offers is proportionality under s.33(2). A 40-flat society can comply with a one-page record of what it holds, why and for how long; a short notice for consent-based uses; a named contact; a data addendum with each vendor; a retention table applied quarterly; and a breach card saying who to call.

Worked example (illustrative)

A 420-flat co-operative housing society in Thane has facial recognition at the turnstiles, 32 cameras keeping 90 days of footage, an FM company running the office and a 650-member WhatsApp group. Leave and licence agreements for 110 flats, with Aadhaar copies, sit in a shared cloud folder. From 13 May 2027:

• Grounds. Membership and gate entry rest on s.7(a) and cameras on s.17(1)(c). Facial recognition becomes opt-in, with RFID cards as the alternative, and workers' faces are deleted.
• Tenants. The folder is purged; the office keeps names, flat numbers, tenancy dates and a police intimation reference.
• Footage. Retention drops to 30 days, and footage leaves the control room only against a written police requisition or a logged incident.
• Defaulters. The notice-board list comes down; recovery runs under s.154B-29.
• The app. The vendor signs a processor addendum, and its worker-rating feature is switched off for the society.
• Breach. Before the purge, a committee member's phone holding the tenant folder is stolen. The society tells the Board and each affected tenant and owner without delay, sends the Board a detailed report within 72 hours, and tells those affected what was exposed and how to protect themselves.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Stop taking identity copies, ask each vendor what it keeps, and publish the s.8(9) contact.

January to March 2027. Decide grounds, rewrite forms, sign vendor addenda, reset camera and app settings, and purge old folders.

April to May 2027. Put the notice and contact on the app, rehearse a lost-phone incident, open the rights channel and give guards a new gate script.

Ongoing. Apply the retention table quarterly, hand over data at every election, and track Maharashtra's final bye-laws and any Board guidance on cameras.

Recommendations

1. 1.Keep society data in society accounts. App logins, email and drives should belong to the society, not to volunteers.
2. 2.Keep evidence, not copies. A verification reference does the work of an Aadhaar photocopy.
3. 3.Use s.17(1)(c) only for cameras that prevent or detect offences, and keep footage for weeks, not months.
4. 4.Make facial recognition optional, and never for domestic workers or children.
5. 5.Put every vendor in writing as a processor or a fiduciary before May 2027.
6. 6.Collect dues through the law, not the notice board.
7. 7.Hand over data at every election, and minute it.

Key takeaways

• RWAs, co-operative housing societies and apartment associations are data fiduciaries: the Act's 'person' includes associations 'whether incorporated or not', and the domestic-purpose exclusion covers only individuals.
• Gate entry fits s.7(a), cameras that prevent offences can in our view rest on s.17(1)(c), and facial recognition, directories and app extras need consent with a non-biometric alternative.
• Maharashtra's statutory register-inspection right fits no s.7 clause neatly; we read it as an incident of membership under s.7(a) that the admission form should disclose.
• Visitor apps and FM companies must be classed as processors or fiduciaries in writing, and the society remains answerable for its processors.
• Defaulters should be pursued through statutory recovery, not notice boards or group chats, and every committee change needs a data handover.