Short answer
Most smart office systems, including CCTV, access control, visitor management, desk booking and some occupancy sensors, collect personal data. That brings them under India's Digital Personal Data Protection (DPDP) Act. The main business obligations under the DPDP Rules apply from 13 May 2027, so an office being designed now should collect only the data it needs, pick less identifying technology where possible, and set retention and access controls before handover.
Smart office privacy checklist
Eight systems, and the lower-risk choice for each
- CCTV: cover entries, exits and assets only; no audio; privacy masking.
- Access control: cards or mobile credentials first; biometrics only where justified.
- Visitor management: collect the minimum; no stored ID scans; auto-delete.
- Desk booking: report by team or floor, not by individual.
- Occupancy sensors: PIR, thermal or radar where a count is enough.
- Wi-Fi analytics: aggregate reports; anonymise device IDs.
- Lockers: short log retention; badge, not biometrics.
- BMS: separate network; no default passwords.
Why this matters now
The DPDP Rules, 2025 were notified in November 2025 with an 18-month runway for most obligations. The rules run in phases:
- From notification (November 2025): Rules on the Data Protection Board.
- From 13 November 2026: Registration and obligations of consent managers. This is less than three weeks away.
- From 13 May 2027: The obligations most businesses care about, including notice, consent, security safeguards, breach reporting, retention and erasure, and data principal rights.
In January 2026, Business Standard reported that the Ministry of Electronics and IT was considering shortening some timelines. As of early October 2026, privacy practitioners reported that no amendment changing the May 2027 date had been published. Check the current position with your legal team before you finalise systems.
The stakes are real. According to the government's explainer on the Rules, failing to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to notify a breach can attract up to ₹200 crore.
This links directly to fit-outs. An office designed this quarter will usually be built, commissioned and occupied well before May 2027. The cameras, readers, kiosks and sensors installed now will be the systems your company runs when the obligations start. Changing camera positions, swapping biometric readers or re-segmenting a network after handover costs far more than getting it right on the drawings.
Key terms, defined
- Personal data: Any data about an individual who can be identified by or from it, such as a face on CCTV, a fingerprint template, a name and phone number on a visitor log, or a badge ID linked to an employee.
- Data fiduciary: The organisation that decides why and how personal data is processed. For your office systems, that is usually your company, not the fit-out contractor.
- Data processor: A party that processes data on the fiduciary's behalf, such as a cloud visitor-management vendor or a security agency that monitors CCTV.
- Legitimate use for employment: Section 7 of the Act allows certain processing without consent for employment purposes. Legal commentators caution that this is not a blanket permission for unrestricted employee monitoring.
- Privacy by design: Building data protection into how a system is chosen, placed and configured, rather than adding policies after it is installed.
Which smart office systems collect personal data?
| System | Personal data it typically handles | Main privacy risk | Lower-risk design choice |
|---|---|---|---|
| CCTV and video analytics | Faces, movement, sometimes audio | Over-coverage, long retention, wide access | Cover entries, exits and assets only; no audio; privacy masking; defined retention |
| Access control | Badge ID, entry and exit times, biometric templates if used | Biometric data and movement profiles | Cards or mobile credentials as default; biometrics only where justified, with an alternative |
| Visitor management | Name, phone, ID photo, host, photo at entry | Collecting ID copies; logs kept forever | Collect the minimum; avoid storing ID scans; auto-delete after a set period |
| Desk and room booking | Employee name, booking history | Attendance profiling | Report on team or floor-level usage, not individuals |
| Occupancy sensors | Ranges from none (PIR) to images (camera-based counters) | Camera-based counting creates images | Use PIR, thermal or radar-type sensors that do not identify people where counts are enough |
| Wi-Fi and network analytics | Device IDs, location history | Tracking individuals by device | Aggregate reporting; anonymise device IDs |
| Smart lockers and vending | User ID, usage logs | Unnecessary log retention | Short retention; link to badge, not biometrics |
| BMS, HVAC and lighting controls | Usually none | Network weak point for attackers | Separate network, no default passwords |
The pattern is simple. Building systems such as HVAC and lighting rarely identify people, but they are often the least secure devices on the network. People-facing systems such as cameras, readers and kiosks are where the privacy questions sit. For how occupancy data is used in design decisions, see our guide on AI and occupancy data in office design.
Privacy-by-design decisions to make during the fit-out
1. Decide the purpose of each system first
Before choosing hardware, write one line per system stating why it exists, for example "CCTV for security at entry points and the server room" or "occupancy sensors to size meeting rooms and control air-conditioning". A clear purpose makes it easier to defend what you collect and to say no to features you don't need.
2. Choose the least identifying technology that does the job
If you only need to know how many people use a floor or a meeting room, a sensor that counts without capturing images is usually enough. Many AI-based "people analytics" features run on camera feeds. They can be useful, but they process far more personal data than a simple count. If you do choose AI video analytics, ask the vendor where the processing happens, what is stored and for how long.
3. Plan camera positions on the drawings
- Cover entries, exits, reception, the server room and high-value storage.
- Avoid washrooms, changing areas, prayer and wellness rooms, and similar private spaces.
- Avoid cameras that look directly onto individual workstations unless there is a specific, documented reason.
- Use privacy masking where a camera's view includes screens or neighbouring premises.
- Put clear CCTV signage at entrances.
4. Treat biometrics as optional, not default
Fingerprint and face readers are convenient, but biometric data is among the most sensitive personal data an office holds. Many companies now default to cards or mobile credentials and reserve biometrics for high-security zones. Where biometrics are used, offer an alternative for people who prefer not to enrol, and confirm how templates are stored and deleted.
5. Design the network for the devices
Smart office devices should sit on their own network segment or VLAN, separate from the corporate network, with default passwords changed at commissioning. This is a cabling and IT design decision, so it belongs in the fit-out drawings, not in a post-move IT ticket. Our guide to structured cabling, IT infrastructure and server room design covers the network side.
6. Set retention and access rules before handover
Agree how long CCTV footage, access logs and visitor records will be kept, who can view them, and how deletion happens. Many systems keep data indefinitely unless someone configures them otherwise. The DPDP Rules also include specific retention provisions, so confirm the right periods with your legal or compliance team and configure them at commissioning.
What to put in your fit-out tender and specifications
If your ELV (extra-low voltage) systems are part of the fit-out scope, add these lines to the tender:
- A data-flow note for each system: what it collects, where data is stored (on site or cloud, in India or abroad) and who the vendor is
- Configurable retention and automatic deletion for CCTV, access logs and visitor records
- Role-based access to system dashboards, with audit logs
- Encryption of data in transit and at rest, where the product supports it
- IoT devices on a separate network segment, with default credentials removed
- Camera layout drawings marked with coverage zones and privacy-masked areas
- Handover documents covering admin credentials, configuration settings and vendor support contacts
In a design-and-build or turnkey contract, such as those Officea Design & Build delivers, the ELV design, cabling, installation and commissioning sit with one accountable party. That makes it easier to get these settings right first time, instead of chasing three separate vendors after you move in. See our MEP works service and how we plan IT and GCC offices.
Who is responsible for what
| Party | Typical role |
|---|---|
| Your company | Data fiduciary: decides purposes, issues notices, sets retention, handles employee and visitor requests |
| Fit-out / design-and-build contractor | Designs, supplies, installs and configures systems to your specification; hands over credentials and settings |
| System or cloud vendor | Often a data processor; hosts and processes data under contract |
| Security agency | May monitor CCTV and visitor desks; should work under written instructions |
| Landlord or building management | Runs building-level CCTV and access at lobbies and common areas |
This is a general guide, not legal advice. The roles above are typical, so confirm them for your own contracts with legal counsel.
Common mistakes to avoid
- Buying an AI camera package for a problem a simple sensor could solve
- Letting the security vendor choose camera positions without reference to the layout
- Making biometrics the only way into the office
- Putting cameras, controllers and laptops on the same network
- Leaving footage and visitor logs on default "keep forever" settings
- Not recording who holds the admin passwords at handover
Officea Design & Build plans ELV and IT infrastructure alongside the layout, HVAC and electrical design, so these choices are made once, on the drawings, across projects pan-India.
Frequently asked questions
Does the DPDP Act apply to office CCTV in India?
CCTV footage that shows identifiable people is generally treated as personal data, so the Act is relevant to how you collect, store and share it. Most obligations for businesses apply from 13 May 2027. Confirm the specifics for your office with legal counsel.
Is biometric attendance allowed under the DPDP Act?
The Act does not ban biometric systems, but biometric data is highly sensitive and needs strong safeguards. Many employers now use cards or mobile credentials by default and keep biometrics for specific high-security areas, with an alternative for people who prefer not to enrol. Take legal advice on your specific use.
When do DPDP Rules apply to companies?
The Rules were notified in November 2025 and come into force in phases. Consent manager provisions start on 13 November 2026, and most business obligations, such as notice, security safeguards, breach reporting and retention, start on 13 May 2027. A government proposal to shorten some timelines was reported in January 2026, so check for updates.
Are occupancy sensors a privacy risk?
It depends on the type. Simple PIR or similar sensors that only detect presence or count people usually collect no personal data. Camera-based counters and Wi-Fi tracking can identify individuals, so they need more care, including clear purposes, aggregation and short retention.
Who is responsible for data from office access control and visitor systems?
Usually the company occupying the office, acting as the data fiduciary. Vendors that host the data typically act as processors under contract. The fit-out contractor installs and configures the systems, and should hand over full settings and admin credentials.
What smart office systems should I include in a new fit-out?
Start with what solves a real problem: access control, CCTV at key points, meeting-room booking, and occupancy-linked lighting and HVAC controls are common choices. Add more advanced analytics only when there is a clear use for the data and the privacy design is in place.
Planning a new office or upgrading an existing one? Officea Design & Build offers a complimentary site visit and a layout and budget estimate covering interiors, MEP and ELV systems. Request yours here.
Sources
- PIB: DPDP Rules, 2025 Notified (explainer), 17 Nov 2025
- S.S. Rana & Co.: MeitY Notifies Final Digital Personal Data Protection Rules 2025, 14 Nov 2025
- The Privacy Labs: DPDP 13 November 2026, what actually starts (and what does not), 8 Oct 2026
- Business Standard: MeitY may cut compliance timeline for key DPDP rules to 12 months, 22 Jan 2026
- King Stubb & Kasiva: Can employers monitor employees under the DPDP Act?, 9 Sep 2026