Quick Answer
Co-working spaces collect personal data including identity documents, biometrics, access logs, and CCTV footage of members and visitors. Under the DPDP Act 2023, this data requires consent notices, defined retention periods, and secure storage. Co-working operators must also ensure that member companies using their infrastructure do not inadvertently create data processing obligations for the operator.
Quick AnswerCo-working spaces must obtain explicit consent before collecting biometric data for access control, implement purpose limitation for member data, and ensure visitor data is collected minimally and deleted promptly.
DPDP Compliance Checklist
- Obtain explicit consent for biometric access control — biometrics are sensitive data under DPDP
- Implement data minimisation for visitor registration — collect name, company, and host only
- Review member CRM: ensure marketing communications have valid consent
- Publish privacy notice in member agreement and on website
- Implement data retention: delete visitor logs after 90 days, member data after contract end
- Review CCTV policy — publish camera locations and data retention period
- Train front desk staff on data handling and member data requests
- Implement secure access to member data — restrict to operations team only
- Review community app and WiFi analytics tools for DPDP compliance
- Conduct annual DPDP compliance assessment
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Is biometric attendance data sensitive under DPDP?+
Yes. Fingerprint and facial recognition data is sensitive personal data. Co-working spaces must obtain explicit consent before enrolling members in biometric systems.
How long can co-working spaces retain CCTV footage?+
Best practice is 30-90 days unless an incident requires retention. DPDP requires publishing retention periods and not keeping footage longer than necessary.
Can co-working spaces use member data for marketing?+
Only with explicit marketing consent separate from the membership agreement. Using billing data for promotional emails without opt-in violates DPDP.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
