The Digital Personal Data Protection Act, 2023 puts the duty on whoever decides why personal data is collected — which, for every flat number, phone number and gate photograph in your society, is the committee. Zwangu processes that data on your instructions. Here is each right and duty the Act sets, with the section it comes from and the screen that discharges it.
Three words the Act uses, and the only three you need for a committee meeting.
You decide what is collected and why — the member register, gate entries, vehicle records. The Act's duties land on you, and they cannot be signed away to a vendor. What a vendor can do is make them possible to discharge.
We hold and process the data on your written instructions, under a signed agreement, for the purposes you set. We do not decide what your society collects, and we do not use a society's data for anything but running that society's service.
Owners, tenants, their families and their staff. Each has rights under the Act, and each of those rights has a place in the app rather than an email address to write to.
The processing agreement names the purposes, the retention periods, the sub-processors and the deletion terms. Send it to your society's CA or advocate first. We expect that, and nothing about it is negotiated verbally.
A right a resident cannot exercise without writing a letter is a right on paper. These sit in the app the resident already has.
On the two correction and erasure sections: the poster cites 12(1)(a) and 12(1)(b). Section 12(1) is the umbrella right; the Act puts the fiduciary's correction, completion and updating duty at 12(2) and the erasure request at 12(3). We cite those, because a committee that looks the section up should find what we said it would.
Three duties, plainly stated. Two of them a product can enforce for you; the third is a decision the committee keeps making.
Reasonable security safeguards, to prevent a breach rather than to explain one. TLS 1.3 in transit, AES-256 at rest including backups and gate photographs, row-level scoping so a query cannot cross from one society into another, and an append-only audit log that outlives whoever made the entry. The ciphers, and row-level security →
Erase once consent is withdrawn or the purpose is served, whichever comes first — unless another law compels you to keep it. Gate photographs are deleted on the period your committee sets, 90 days by default, without anyone remembering to do it. Co-operative law's own retention of the books is the exception, and the app keeps that boundary visible instead of quietly deleting a voucher.
Personal data moves only on authorisation, consent, or a legal basis — and a processor may hold it only under a valid contract. Zwangu does not sell society data, merge it across societies, or build a directory from it. External roles — auditor, returning officer, community manager — are granted by the committee, scoped to what the role needs, and revocable in one tap. How the committee grants and revokes →
A personal data breach is notified to the Data Protection Board and to each affected resident. If one affects your society we tell you what we know and what we are doing, inside the timeline the Act sets, so you can notify as the fiduciary. You will not learn about it from a status page.
The Act covers digital personal data. The visitor book on the guard's desk is not digital — which is not a relief, it is a gap.
Personal data collected in digital form, or in non-digital form and digitised subsequently. So the register at your gate sits outside the Act — until someone scans it to keep a copy, at which point it is inside, and the society is the fiduciary for it.
The visitor book at the gate, with names, flat numbers and phone numbers of everyone who came. Photocopies of tenant IDs and police verification forms in the office almirah. AGM attendance sheets with signatures against flat numbers. Cheque counterfoils and the old receipt book. None of it is protected by the Act, and all of it fits in a bag.
The paper you already hold is the committee's to destroy, and shredding is the right answer, not a locked cupboard. The paper you have not made yet is the part a product can fix: on Zwangu the gate is digital from the first visitor, the AGM roll is a record rather than a sheet, and the receipt book is a ledger entry. There is no register to shred next year because there is no register.
A committee resolution, a signed agreement, a share certificate. Those are documents the society is meant to hold, and the Act has nothing to say about them. Keep them; it is the personal data stapled around them that should not be lying loose.
Data collected for gate entry is used for gate entry. Zwangu does not merge a society's data with another's, sell it, or use it to build a directory. If your committee wants to use a resident list for something new, that is a new purpose and it needs a new notice — the product will not do it quietly.
What is collected, why, and who processes it — presented when a resident is added, not buried in a terms page, and available in the app afterwards rather than only at signup.
A society holds data about children — a child's name on a gate pass, a face in a photograph. The Act treats that as verifiable-consent territory and bars tracking and behavioural advertising outright. Zwangu does no advertising and no behavioural profiling of anyone, of any age, at all.
Indian regions only — primary in Mumbai, replica in Hyderabad. No society data, backup or log leaves India. That includes residents' phone numbers, gate photographs and vehicle records.
We cannot consent on your residents' behalf, decide your retention policy, or answer a Data Protection Board notice addressed to the society. Those are the fiduciary's, and a vendor claiming otherwise is selling you something that will not hold.
The four awareness posters on this page are published by dpdpa.com and reproduced as issued. They are an explanation of the Act, not of Zwangu; the copy beside each one is ours, and so is the responsibility for it. Nothing here is legal advice — read the Act, and take your agreement to your society's advocate.
