Visitor Management for Housing Societies: Gate Rules, Guard Apps and Privacy

Picture a typical evening at a 120-flat society in Kharghar. It is 9:40 pm. A man in a delivery T-shirt tells the guard he has a parcel for 1102. The guard is alone, the intercom to the B Wing has been dead for a month, and two cars are honking behind the barrier. He waves the man in and writes “courier, 1102” in a register that nobody will read unless something goes missing. Nobody at 1102 ordered anything.

Most committees I speak to know this scene. The question they ask is which visitor app to buy. The better question comes first: what should the rules at your gate be, who is accountable for following them on each shift, and what are you allowed to do with the names, phone numbers and photos you collect? This guide works through those in order, so a committee can fix its gate with or without new software.

What is a visitor management system for a society?

A visitor management system for a society is the set of rules, records and tools that decide who may enter the premises, who approves each entry, and what is recorded about it. Today it usually means a guard app at the gate plus a resident app that receives an alert and replies Allow or Deny, but the paper register and intercom are also a visitor management system, just a weak one.

Most pages ranking for this term are vendor feature lists: pre-approval, QR codes, delivery tracking, boom barrier integration. Those features matter, but they do not tell a committee what rules to set, what to do when the resident does not answer, or what the data law now expects. That is the gap this post tries to fill.

1. What goes wrong at society gates

Society gates fail in predictable ways: the register is unreadable and unsearchable, delivery riders are let in without checking the flat, anyone in a uniform or carrying a parcel is trusted, and nobody can prove which guard was on duty at a given hour. Each failure has a simple fix that does not need expensive hardware.

In our work setting up gate apps for residential complexes, the first audit is always the paper register. We usually find the same things: entries without a flat number, phone numbers with nine digits, no exit times, and gaps of several hours at night. The register exists to satisfy the committee, not to answer the question “who came to Flat 704 last Tuesday?”

Source: Infoways’ experience setting up gate apps for residential complexes; patterns, not survey data.

2. How to design gate rules before choosing an app

Good gate rules name each type of visitor, say who approves their entry, say what the guard must record, and say how long that record is kept. Write them on one page, pass them in a managing committee meeting or the general body if your bye-laws need it, and give guards a version in Hindi or Marathi.

Source: Infoways template for committees. Approval rules and hours are committee decisions, not legal requirements.

Pre-approved passes and resident Allow or Deny

Pre-approved passes do most of the work. When a resident issues a pass for a guest with a date and time window, the guard checks a code and the guest walks in without anyone being called. For unexpected visitors, the resident gets a push alert with the visitor’s name and photo and taps Allow or Deny.

The rule people forget is the fallback. Decide what happens when the resident does not reply: the guard calls the flat, and if nobody answers, the visitor waits outside. The call and its result should be logged, so a missed alert never turns into an unrecorded entry.

Deliveries, domestic staff and vendors

Deliveries are the largest volume at most gates. A “leave at gate” default, with a shelf or locker and a resident option to allow the rider up, cuts most of the rush-hour pressure. Domestic staff and drivers get a personal pass that the resident registers once; if a different person arrives, the guard treats them as a new visitor. Many committees also ask residents to complete police verification of domestic staff; check the current process with your local police station.

Vendors are where impersonation happens. A plumber or electrician should enter only against a request from a resident or a work order from the society office, inside fixed working hours, with their ID recorded. A complaints desk in the same app helps here, because the work order and the gate entry then match.

3. Guard shifts and accountability

Guard accountability comes down to three records: who clocked in, whether they were actually inside the premises when they did, and who handed each gate to whom at shift change. With those three, a committee can check the security agency’s bill against real duty and answer questions after an incident.

The features that create these records are now common in guard apps. Geo-fenced clock-in lets a guard mark attendance only when the phone is inside the society’s boundary, so attendance cannot be marked from home. OTP shift handover asks the outgoing guard to hand over to the incoming guard with a one-time code, which records the exact handover time for each gate. Some societies add face-based attendance for housekeeping and guards, which we cover on our face attendance system page.

What we see in practice: the first month of geo-fenced attendance usually shows gaps the committee did not know about, such as a night guard covering two gates, or a relief guard who arrives an hour late every Sunday. Raise them with the agency at the monthly bill review.

• Ask for a monthly duty report: shifts scheduled, shifts with on-time clock-in, shifts with a recorded handover.
• Pass the agency’s bill only after comparing it with that report.
• Give each guard a personal login. Shared logins destroy accountability.

4. Emergencies and SOS at the gate

An SOS feature is only useful if the committee has decided in advance who receives the alert, who acts on it, and what the guard does in the first five minutes. Without that, an alarm on ten phones means ten people assuming someone else is handling it.

In the guard apps we have built, an SOS button lets a guard or a resident raise an alarm that reaches the committee and nearby guards at once. The button is the easy part. The work is the roster behind it and a printed sheet at the gate with emergency numbers, the location of fire extinguishers and the main power switch, and the names of residents who are doctors or trained in first aid, with their consent.

1. Name two committee members and the head guard as first responders for each shift.
2. List what counts as an emergency: medical, fire, lift entrapment, intrusion, a lost child.
3. Write the first five minutes for each: who calls whom, which gate stays open for an ambulance, who meets it.
4. Run a test SOS once a quarter and note how long it took for someone to respond.

5. Visitor photos, phone numbers and the DPDP Act 2023

Visitor names, phone numbers, photos and vehicle numbers are personal data under the Digital Personal Data Protection Act, 2023, and a society that decides why and how that data is collected acts as a data fiduciary. The DPDP Rules 2025, notified on 14 November 2025, phase in the detailed duties, with most operational rules starting 18 months later, around mid-May 2027.

I am not a lawyer, and this section is a practical reading of the primary texts, not legal advice. Ask your society’s legal adviser to confirm how it applies to you. But the texts are clear enough on several points that committees should act on now, not in May 2027. The DPDP Rules say Rules 1, 2 and 17 to 21 took effect on publication, Rule 4 after one year, and Rules 3, 5 to 16, 22 and 23 after eighteen months. The Act also covers data collected on paper and later digitised, so typing up an old register brings it into scope.

Source: DPDP Act 2023 and DPDP Rules 2025 (MeitY); PIB explainer, 17 November 2025. Commencement dates per Rule 1.

The stakes are not small on paper. The government’s explainer says penalties can reach ₹250 crore for failing to keep reasonable security safeguards, ₹200 crore for not reporting a breach, and ₹50 crore for other violations. Those are maximums; the point for a society is that “the app company handles privacy” is not a defence, because the fiduciary stays responsible for its processor.

Practical privacy rules for the gate

• Collect less. Name, phone, flat and time are usually enough. Ask whether you need a photo of every delivery rider, or only of unexpected visitors.
• Limit who sees it. Guards see today’s entries for their gate. Residents see only visitors to their own flat. A small number of committee members can search history, and every search or export is logged.
• Set a retention period. Agree in writing how long visitor photos and logs are kept, in line with the Rule 8(3) one-year minimum and your adviser’s view, then delete on schedule.
• No WhatsApp forwards. Visitor photos and resident lists should not move through personal groups. This is where most leaks start.
• Children’s data needs care. The Act requires verifiable parental consent for processing a child’s data, so think before photographing children at the gate.

6. Hiring a security agency: what PSARA requires

If your society hires guards through an agency, that agency needs a licence under the Private Security Agencies (Regulation) Act, 2005, issued by your state’s Controlling Authority. Asking to see a valid licence before signing, and at each renewal, is the simplest check a committee can make.

The current text of the Act on India Code, which includes the 2026 Jan Vishwas amendments, says no one may carry on the business of a private security agency without a licence (section 4). Contravening that is punishable with imprisonment up to one year, a fine up to ₹25,000, or both (section 20). A licence is valid for five years and can be renewed. The Act does not, as far as I can see, put a penalty on the society that hires an agency, but an unlicensed agency is a risk you take on at your gate.

Source: Private Security Agencies (Regulation) Act, 2005, India Code copy including Jan Vishwas (Amendment of Provisions) Act, 2026. State rules add detail; check your state’s rules.

The Ministry of Home Affairs runs a PSARA licensing portal with state-wise licence status and a “Know your Agency” section. State rules (Maharashtra has its own) add detail on training and wages, so the agency contract should also cover minimum wages, PF and ESI where they apply. Your accountant or legal adviser can confirm what to ask for.

See also: weighing a ready-made app against your own platform? Read custom software vs off-the-shelf.

7. A rollout plan guards will actually follow

A gate app succeeds or fails in its first three weeks. Train each guard at the gate, shift by shift, in the language they are comfortable with, run the phone call alongside the app until residents reliably answer alerts, and switch fully only when the numbers show it works.

The mistake we see most often is a launch announced on the society WhatsApp group on a Friday, with the agency told to “start using the app” on Monday. By Wednesday the night guard is back to the register because nobody showed him what to do when the app says “no response”. In our rollouts, training happens at the gate, on the actual phone, in Hindi or Marathi, and we come back for the night shift because it is always a different person.

1. Week 0: rules and data. Gate rules passed, flats and residents loaded, residents invited to the app with a society code that the office approves.
2. Week 1: training. On-site sessions for every guard on every shift, with a laminated one-page guide using icons and Hindi or Marathi labels.
3. Weeks 1 to 2: parallel running. Guards enter every visitor in the app and also call the flat. Measure the share of alerts residents answer in the app.
4. Weeks 3 to 4: switch. Move to app approval with call fallback once that share is high enough for your committee. Keep a paper register only for internet outages.
5. Month 2 onwards: review. Monthly look at alerts answered, average approval time, shifts with a recorded handover, and complaints from residents.

Elderly residents need their own plan. Let a family member answer alerts for the flat, or keep the call as the default for flats that request it. A gate rule that leaves out a third of residents will not last.

8. What to check in any visitor app before you sign

Judge a visitor app on how it handles your worst moments, not its feature list: a resident who does not answer, the internet going down, a guard who cannot read English, and a request to delete someone’s data. Ask every vendor the same questions and get the answers in writing.

Source: Infoways checklist, built on DPDP Rules 2025 duties (Rules 6 and 7) and gate rollout experience.

Ready-made apps are the right first choice for most single societies, and the well-known ones cover the basics. A platform of your own makes more sense for a facility management company or builder running many sites, a large township with several gates, or a committee that wants data held only by the society and its chosen vendor. The trade-offs are covered on our housing society software page.

Where this advice breaks down

This guide assumes at least one staffed gate and residents who mostly use smartphones, and some legal points are still being interpreted.

• Very small buildings. A 20-flat building with one watchman may be better off with a clean register, a good intercom and a list of approved staff than any app.
• Residents who ignore alerts. If most residents do not switch on notifications, the app adds a step without adding safety. Keep the call as the default until behaviour changes.
• Poor signal at the gate. Some gates sit in basements or behind thick walls. Test the network where the guard actually stands before buying anything.
• Unsettled law. The DPDP Rules phase in through 2027, and how they apply to housing societies, visitor photos and retention periods will become clearer as the Data Protection Board starts deciding cases. Treat the privacy section as a careful starting point, not a final answer.

The guard at that Kharghar gate was not careless. He had no rule for an unexpected parcel, no quick way to ask 1102, and no record anyone would check. Give him those three things and the gate starts working, whichever app you choose.