Question 1

When a member hands in an application (transfer, nomination, parking, alteration), what must the office do and how quickly?

Accepted Answer

Acknowledge it. Under the 2014 bye-laws, point out any deficiency within 15 days, place it before the next committee meeting, and decide it within 3 months at most. The draft 2026 bye-laws tighten this: acknowledge the same day or within 3 days, scrutinise within 7 days, and decide within 60 days of a complete application. 2014 BL 62 covers membership, transfers, sub-letting intimations, alterations, parking, terrace use, complaints and other applications. It requires an acknowledgement and a deficiency note within 15 days. The application goes to the next meeting and is disposed of within 3 months. Reasons for rejection are recorded in the minutes. Draft dBL 60: acknowledgement within 3 days; scrutiny within 7 days; deficiencies notified within 7 days of scrutiny, with 15 days for the applicant to comply; a meeting within 30 days; decision within 60 days; communication within 7 days. A membership application not decided in 3 months is deemed admitted under s.22(2) (dBL 60(i)). The front office should date-stamp and give a written or electronic acknowledgement every time.

Question 2

How must notices reach members — is a WhatsApp message or email enough?

Accepted Answer

Send the notice by hand delivery, post or email to the member's last known address, and also put it on the society notice board. Once it is on the notice board, a member cannot invalidate it by saying they did not receive it. WhatsApp alone is not a mode the 2014 bye-laws recognise. 2014 BL 161 lists hand delivery, post or registered post, or email, plus display on the notice board. BL 163 requires a notice board in each building for all notices, statements of accounts and annual reports. The draft keeps notice boards in each building (dBL 70). Under dBL 69, service by an approved mode is valid, and non-receipt does not invalidate proceedings if reasonable steps were taken. Some kinds of notice have their own rules: a redevelopment SGM needs 14 clear days (Rule 106C-13(3)(i)), a casual-vacancy notice 7 days on the board (Rule 106C-13(4)(b)), and elections the election rules. WhatsApp is a useful reminder channel. Keep proof of the formal mode (email log, dispatch register, photograph of the notice board with the date).

Question 3

A member asks for copies of the minutes, the audit report or their own ledger. What can the society charge, and how fast?

Accepted Answer

Members are entitled to inspect and get copies of the society's records under the Act and bye-laws, at the fees in the bye-law schedule: ₹5–₹10 per page under the 2014 bye-laws. The draft 2026 bye-laws make copies sent by WhatsApp or email free. The Secretary must tell the member the fee within 7 days of the application and supply the copies within 45 days of payment. 2014 BL 170 lists fees: for example, bye-laws ₹5 per page, the audited balance sheet and minutes ₹10 per page, a duplicate share certificate ₹100. Draft dBL 38 requires a written application. The Secretary states the fee and payment modes within 7 days and supplies the copies within 45 days of the fee (30 days for Government-assisted societies). The fee table charges nothing for WhatsApp or email copies. It also says the society must not disclose other people's Aadhaar, PAN, passport or bank details. The right comes from s.154B-8 of the Act. Refusing to supply copies is a matter for the Registrar (BL 173; dBL 190(A)(vii)). Redact other members' personal identifiers before giving copies.

Question 4

How should I word my request for copies so that the society cannot dodge the 45-day deadline?

Accepted Answer

Make it in writing, list each document precisely (name, date or period), ask the Secretary to state the fee, and pay or tender the fee with proof. The 45 days run from the payment or tender of the fee, even if the society does not encash your cheque. Keep the acknowledgement. Section 154B-8(2) obliges the society to supply copies of the documents in s.154B-8(1) within 45 days of a written request and payment of the fee (30 days where the Government has given share capital, loan or land). In Ramane (2026) the High Court held that the period runs from the tender of fees, even if the society does not encash the cheque (para 13). A request that works: - addressed to the Secretary, dated, with your flat number; - an itemised list: "minutes of committee meetings held from 1 Apr 2025 to 31 Mar 2026", "audited
  balance sheet and income and expenditure account for 2025-26", "my personal ledger from 1 Apr 2024";
- a request to state the fee and payment mode (the draft bye-laws give the Secretary 7 days to do so,
  dBL 38(b));
- a statement that you will accept copies by email or WhatsApp, which the draft makes free
  (dBL 39(b)(14)).
Hand it in against an inward stamp, or send it by registered post or email, and keep proof. Pay by a traceable mode. If nothing arrives in 45 days, complain to the Deputy Registrar with this paper trail (see records_rti_privacy-002). Avoid vague requests such as "all records". They invite argument about what was asked for.

Question 5

Can the society refuse me copies of records because I owe maintenance or because I "keep troubling the committee"?

Accepted Answer

No. The right to inspect and to get copies under s.154B-8 has no condition about dues or conduct. The draft 2026 bye-laws' dues condition applies only to complaints about services, not to access to records. The only limits are the list of documents in the Act and other people's personal information. Section 154B-8(1) gives "every member" the right to inspect the listed records free of cost, and s.154B-8(2) the right to copies on payment of fees. The section attaches no condition about arrears, behaviour or the number of requests. The Registrar can hold committee members responsible and disqualify them for failure (s.154B-23; records_rti_privacy-002). Two genuine limits exist: - the list: the right covers the Act, Rules and bye-laws, the last audited balance sheet and income
  and expenditure account, the committee list, the register of members, minutes of general-body and
  committee meetings, and the member's own account. A recording of a meeting is not on the list
  (Bhartiya, 2026);
- other people's data: the draft 2026 bye-laws tell the society not to disclose Aadhaar, PAN,
  passport, bank details or similar information of any member or other person unless the law or an
  authority requires it (note under dBL 39). Redact those, not the whole document.
The draft condition in dBL 184(c) (complaints entertained only when undisputed dues are paid) concerns complaints about services and management. It does not cut down the statutory right of access. Very large or repeated requests can be met by offering inspection on the monthly inspection day that the draft lets the general body fix (dBL 37).

Question 6

Can I get a copy of the statutory audit report and the society's rectification report, not just the balance sheet?

Accepted Answer

The audit report is placed before the annual general meeting, and the rectification report goes to the Registrar and to the general body, so members are entitled to see them as general-body papers. Ask for them in writing and pay the copy fee. The Registrar's office also holds a copy. Section 154B-8(1) names the last audited balance sheet and income and expenditure account, and the minutes of general-body meetings. The audit report itself is not named in the extracts available to us. It is, however, a general-body paper. The AGM considers the audit report and receives the audit rectification report and the action taken (BL 94(c)-(d); dBL 95(c)). The draft requires audited statements to be displayed 14 days before the AGM (dBL 141(5)). The society must send the rectification report in Form O to the Registrar within three months of the audit report (s.82; BL 152), and the annual returns under s.79(1A) include the audited accounts. Copy fees are listed in BL 170: Rs 10 a page for annual returns, Rs 5 a page for any other document under s.32. If the society refuses, complain to the Deputy Registrar. You can also ask the Registrar's office for the copy it holds, including under the RTI Act, subject to its exemptions (see records_rti_privacy-003).

Question 7

During inspection at the society office, may I photograph or scan the records instead of paying for copies?

Accepted Answer

Neither the Act nor the bye-laws say so either way. The right is to inspect free and to get copies on payment of the fee. Many societies allow phone photographs of the pages inspected; a general-body or committee rule on it avoids arguments. The society may refuse photographs of other people's personal data. Section 154B-8 speaks of inspection free of cost and of copies on payment of the prescribed fee. BL 170 and dBL 39 fix the copy fees. The draft makes copies sent by WhatsApp or email free (dBL 39(b)(14)). That removes most of the cost argument for societies that adopt it. Because the law is silent on photographs, practice varies. A sensible house rule: - photographs allowed of the pages the member is entitled to see; - no photographs of pages carrying other members' Aadhaar, PAN, bank details or similar data (note
  under dBL 39);
- the Secretary or an authorised person stays present, and the inspection is entered in the register of
  inspections (dBL 37).
If the society insists on certified copies, pay the fee and ask for the copies within the 45-day period (records_rti_privacy-301). A refusal to allow inspection itself is a Registrar matter (BL 173(a)(viii); dBL 190(A)(vii)).

Question 8

Does the Digital Personal Data Protection Act apply to a housing society, and from when?

Accepted Answer

Yes. A society that decides why and how residents' personal data is processed is a "data fiduciary" for data held in digital form, such as billing software, spreadsheets, a gate app, email or CCTV. The main duties (notice, consent, security, breach reporting, rights, erasure) apply from 13 May 2027. Paper registers that are never digitised fall outside the Act. The DPDP Act 2023 applies to personal data processed in digital form, or collected on paper and digitised later. It does not apply to processing by an individual for a personal or domestic purpose, or to data that a person has made public herself. A society, a body corporate under s.36 of the MCS Act, is not a domestic user. The Board and framework rules came into force on 13 Nov 2025. Consent-manager rules follow on 13 Nov 2026. Rules 3 and 5 to 16 (notice, security, breach, retention, contact person, children, rights) start on 13 May 2027 (DPDP Rules 2025 r.1(2)-(4)). What a society typically holds: members' and tenants' names, contact details, flat and ledger data, KYC copies; staff and domestic-help records; visitor logs; vehicle numbers; CCTV images. Using the period before May 2027: - list what data you hold, where, and why; - drop what you do not need; - prepare the notice (records_rti_privacy-307); - name a contact person (records_rti_privacy-308); - review vendor contracts (records_rti_privacy-314); - write a breach plan (records_rti_privacy-313).

Question 9

Under the DPDP Act, does the society need every member's consent to keep the register of members, send bills or share data with the Registrar?

Accepted Answer

Not always. Consent is one ground; "certain legitimate uses" are the other. They include data a person gives voluntarily for a specified purpose, disclosures the law requires to the State, compliance with a court order, and medical emergencies. Keeping statutory registers and billing members fits these. Extra uses, such as a directory or marketing, need consent. The DPDP Act allows processing for a lawful purpose either with consent or for certain legitimate uses (ss.4, 6, 7). Consent must be free, specific, informed, unconditional and unambiguous, and can be withdrawn as easily as it was given. Legitimate uses relevant to a society include: - data the principal gave voluntarily for a specified purpose without objecting to its use, for
  example the details in a membership application used to admit and bill the member;
- fulfilling a legal obligation to disclose information to the State or its instrumentalities, for
  example returns and lists to the Registrar;
- compliance with a judgment or order; - medical emergencies and disaster response; - employment purposes, for staff. Statutory registers under the MCS Act (Form I, Form J, nominations) must be kept; the Act lets retention required by law override erasure. By contrast, a residents' directory, sharing phone numbers with vendors, marketing tie-ups or putting photos on social media are outside the member's original purpose. They need specific consent (records_rti_privacy-311). Record the ground for each kind of data in a simple register. It answers the Data Protection Board's first question.

Question 10

What must the society's privacy notice to members and residents contain under the DPDP Rules?

Accepted Answer

A standalone notice in clear, plain language that lists the personal data collected item by item, says what each is used for, and explains how to withdraw consent, exercise rights and complain to the Data Protection Board, with a link or other means to do so. Give it in English and Marathi. Rule 3 of the DPDP Rules 2025 (from 13 May 2027) requires the notice to: - be understandable on its own, independent of other information; - give, in clear and plain language, an itemised description of the personal data and the specified
  purposes, with a description of the services or uses enabled;
- give the communication link to the fiduciary's website or app, and any other means, by which the
  person can withdraw consent (as easily as it was given), exercise her rights and complain to the Board.
The Act lets the person choose to read the notice in English or in a language of the Eighth Schedule, and Marathi is one. The platform's own rule is bilingual notices. A society notice usually covers: membership and ledger data; tenant and occupant data; visitor and vehicle logs at the gate; CCTV; staff and domestic-help records; a directory or group, if any. For each, state the purpose, who receives it (Registrar, auditor, bank, software vendor, police on lawful request), how long it is kept (dBL 138 schedule; r.8(3) one-year minimum for logs), and the contact person (records_rti_privacy-308). Put it on the notice board, at the gate and on the society's app or website, and hand it over with membership and tenant forms.

Question 11

Must our society appoint a Data Protection Officer, and who handles residents' privacy complaints?

Accepted Answer

A housing society is not a Significant Data Fiduciary, so a formal Data Protection Officer is not required. It must still publish the business contact of a person who can answer questions about its processing, mention it in every reply to a rights request, and run a grievance system that responds within ninety days. Only a Significant Data Fiduciary, notified by the Central Government, must appoint a Data Protection Officer, carry out impact assessments and audits (DPDP Act s.10; Rules r.13). Housing societies are not in that class. Every fiduciary must, from 13 May 2027: - publish prominently on its website or app, and mention in every response to a rights request, the
  business contact information of a person able to answer questions about the processing (r.9; Act s.8(9));
- set up an effective grievance-redressal mechanism (Act s.8(10)) and publish the period for responding,
  not exceeding ninety days (r.14(3));
- publish how rights requests are made and what identifiers are needed (r.14(1)). In a society, the natural contact is the Secretary, or a committee member named by committee resolution, reachable at the society's official email. Record privacy requests in the complaint register that the draft bye-laws introduce (dBL 185) and answer in writing. A person must use the society's grievance system before complaining to the Data Protection Board (Act s.13(3)); see records_rti_privacy-316.

Question 12

A member asks the society, "What personal data do you hold about me and whom have you shared it with?" Must we answer?

Accepted Answer

From 13 May 2027, yes, for personal data processed on consent or voluntarily given. The member can ask for a summary of the data and the processing, and the identities of fiduciaries and processors it was shared with. Answer within the period the society publishes, no more than ninety days. Separately, the member already has the right to see his own account under s.154B-8. The DPDP Act gives a data principal the right to obtain a summary of her personal data being processed and the processing activities, the identities of the other data fiduciaries and processors with whom it has been shared, with a description of the data shared, and other prescribed information (s.11). Requests are made by the means the society publishes (r.14(1)-(2)), and answered within its published period of not more than ninety days (r.14(3)). Every reply must carry the contact person's details (r.9). How to answer in practice: - verify identity (flat number, registered mobile or email); - list the categories held: register-of-members entries, ledger, KYC copies, vehicle numbers, gate
  entries, CCTV if relevant;
- list recipients: Registrar, auditor, bank, billing or gate software vendor, police on written
  request;
- offer the member's own ledger as the s.154B-8 copy. Do not include other people's data in the reply. A request about another person is not an access request (see records_rti_privacy-004).

Question 13

A former member (or a tenant who left) asks the society to delete all his data. Must we?

Accepted Answer

Partly. Data kept only for a purpose that is over, such as a tenant's gate pass, directory entry or old KYC copies, should be erased once the minimum retention periods have passed. Entries the law requires, such as the register of members, the share register, minutes and account books, stay for their statutory period. Tell the person what was erased and what is kept, and why. The DPDP Act lets a person ask for correction, completion, updating and erasure (s.12). The fiduciary must erase data when consent is withdrawn or the purpose is no longer served, unless retention is necessary for compliance with any law (s.8(7)). The Rules add a floor. Personal data and logs of processing are kept for at least one year from the processing, and then erased unless another law requires longer (r.8(3); also r.6(1)(e) for security logs). What the society must keep: - Form I entries, including the date of cessation, and the share register (s.38; permanent under dBL 138(c)); - minutes, audited accounts, recovery orders (permanent); - vouchers and ledgers (ten years, dBL 138(d)); - tenant and occupant records, complaints, security logs (five years, dBL 138(e)). What can usually go after the period: phone numbers in directories and groups, vehicle stickers, gate approvals, CCTV clips beyond the rolling window, and extra KYC copies not needed for any record. Reply in writing within the published period (at most ninety days, r.14(3)), listing what was erased and what is retained under which rule.

Question 14

We want to print a residents' directory with names, flat numbers and phone numbers. What consent do we need?

Accepted Answer

Get each person's specific, opt-in consent for the directory, stating exactly which fields will appear and who will receive it. Do not take phone numbers from the membership file for this. Let people withdraw and remove them at the next edition. Names in the statutory list of members are a separate matter. The list of members in Form J is a statutory record open to inspection (s.39; Rule 33). It contains names, not phone numbers or emails. A directory with contact details is a new purpose, beyond the one for which members gave their details to the society. It needs consent that is free, specific, informed and unambiguous, given by a clear affirmative act. Consent cannot be bundled as a condition of membership or service (DPDP Act s.6). The person can withdraw at any time, and the society then stops using the data within a reasonable time. A simple consent form: a tick-box for each field (name, flat, mobile, email, household members' names), with the purpose ("distributed to residents of this society only"), the format (printed, PDF, app) and how to withdraw. Keep the signed forms. Do not include children's details without a parent's verifiable consent (r.10), and never include Aadhaar, PAN or bank data (note under dBL 39). Mark each copy "for residents only; not to be shared". From 13 May 2027 these are legal duties; before that they are good practice.

Question 15

Can the committee add every member to the society WhatsApp group, and post defaulters' names or flat-wise dues there?

Accepted Answer

Adding members to a group exposes their mobile numbers to everyone in it, so ask first and let people opt out. Do not post individual members' dues, KYC or complaints on a group. Use the lawful channels: a notice to the member, the statutory list at the AGM, and recovery under s.154B-29. A chat group is also not a valid mode of formal notice under the 2014 bye-laws. A member's mobile number was given to the society for society communication. Putting it in a group where every participant sees it is a disclosure to others. From 13 May 2027 it should rest on consent, or at least a clear notice and an easy opt-out (DPDP Act ss.5-7). Communities or broadcast lists that hide numbers reduce the problem. Dues are the member's own transaction record under s.154B-8(1). Other members have no right to see them (records_rti_privacy-004). Publishing names and amounts to shame a member can expose the society and the poster to a privacy complaint and, if the figures are wrong, to a defamation claim. The lawful routes: - demand notices and reminders to the member; - reporting defaulters to the general body where the Act or bye-laws require it, for example in the annual
  report or for committee disqualification;
- a recovery certificate under s.154B-29. Formal notices must go by the modes in BL 161 or dBL 69 (hand, post, email, approved digital platform) and on the notice board. A WhatsApp message is only a reminder (see ops-003).

Question 16

Our society's member spreadsheet was leaked (a lost phone, a hacked email, a wrong WhatsApp forward). What must we do?

Accepted Answer

Contain it at once, then inform each affected person without delay and inform the Data Protection Board without delay, followed by a detailed report within 72 hours. If a software vendor is involved, it must tell you at once, and CERT-In reporting within 6 hours may also apply. Record everything you do. DPDP Rules 2025 r.7 (from 13 May 2027): - to each affected person, without delay, through her registered contact: what happened (nature, extent,
  timing), likely consequences for her, what the society is doing, what she can do to protect herself,
  and a contact person (r.7(1));
- to the Board, without delay, a description with nature, extent, timing, location and likely impact
  (r.7(2)(a));
- to the Board within 72 hours of becoming aware (or longer if the Board allows on written request),
  a detailed report covering updated facts, causes, mitigation, findings about who caused it, steps to
  prevent recurrence, and the intimations sent to affected people (r.7(2)(b)).
CERT-In's Directions of 28 Apr 2022 require service providers, intermediaries, data centres and bodies corporate to report listed cyber incidents, including data breaches and leaks, within 6 hours of noticing them. A society's software vendor is clearly covered. Whether a housing society, itself a body corporate, must also report is worth an advocate's view; reporting does no harm. Immediate steps: change passwords and revoke access; ask recipients to delete; take down posts; preserve evidence; file a cyber-crime complaint if there was theft or hacking; note the time you became aware, because the clocks run from it. Failure to intimate a breach can attract a penalty of up to Rs 200 crore under the DPDP Act Schedule.

Question 17

We use an outside app for billing, gate management or accounts. What should our contract with the vendor say about members' data?

Accepted Answer

The society stays responsible for data the vendor processes on its behalf. Use a written contract that limits the vendor to the society's instructions and purposes, requires reasonable security safeguards, prompt breach notice, one-year log retention, deletion or return at the end, and no reuse of residents' data for the vendor's own marketing. Under the DPDP Act the society (fiduciary) is responsible for processing done on its behalf by a data processor, and may engage one only under a valid contract (s.8(1)-(2)). Rule 6(1) requires safeguards that include an appropriate contract clause with the processor for reasonable security safeguards (r.6(1)(f)). The safeguards include encryption or masking, access control, logs and monitoring, backups, and retaining logs and data for one year for investigation (r.6(1)(a)-(e)). Clauses to insist on: - purpose and instruction limits; no sale or marketing use; - security measures matching r.6, and the right to ask for evidence; - notice to the society immediately on any breach, so that the society can meet the r.7 timelines;
  CERT-In's 6-hour report is the vendor's own duty;
- location of data and sub-processors named; - retention of logs for one year (r.8(3)), then deletion; return of all data in a usable format at the
  end, with a certificate of deletion;
- help with residents' rights requests within the society's 90-day window. Approve the contract by committee resolution and keep it in the agreements file (BL 141).

Question 18

What penalties can a housing society face under the DPDP Act, and can a resident be penalised too?

Accepted Answer

The Act's Schedule sets maximum penalties of up to Rs 250 crore for failing to take reasonable security safeguards, up to Rs 200 crore for failing to report a breach, and up to Rs 50 crore for other breaches. These are ceilings, and the Board must weigh the nature, gravity and circumstances. A resident who files a false or frivolous complaint can be fined up to Rs 10,000. Penalties are imposed by the Data Protection Board after an inquiry, not by a court. The Act asks the Board to consider the nature, gravity and duration of the breach, the type of data, repetition, any gain or loss, mitigation steps, and whether the penalty is proportionate and effective (s.33). The Board can also accept a voluntary undertaking (s.32) and refer parties to mediation (s.31). For a small non-profit society the realistic risk lies in directions, costs and loss of trust rather than the maximum figures. But a careless leak of members' KYC documents is exactly the security failure the highest band targets. A data principal also has duties: not to impersonate, not to suppress material information, and not to register a false or frivolous grievance or complaint (s.15). A breach attracts a penalty of up to Rs 10,000 (Schedule). Individual committee members are not named as penalty targets. The fiduciary is the society. But a committee member who leaks data may face the society's action, and criminal law where applicable.

Question 19

The society mishandled my personal data and ignored my complaint. How do I complain to the Data Protection Board?

Accepted Answer

First use the society's own grievance system and keep its reply, or proof that the published period (at most 90 days) passed without one. Then complain to the Data Protection Board, which works as a digital office. Appeals from the Board go to the Appellate Tribunal (TDSAT). Order of steps: - write to the society's contact person (records_rti_privacy-308) describing the data, what went wrong
  and what you want: access, correction, erasure, stopping a use;
- the society must answer within its published period, not more than ninety days (r.14(3)); - a data principal must exhaust the fiduciary's grievance redressal before approaching the Board (Act
  s.13(3));
- complain to the Board. It functions as a digital office and conducts proceedings without needing
  physical presence (r.20). It may direct mediation (s.31) or accept an undertaking from the society (s.32);
- an appeal against the Board's order lies to the Appellate Tribunal, filed digitally with the fee
  applicable to TDSAT appeals (r.22), within sixty days (s.29).
Do not file false or frivolous complaints; that is itself penalised (s.15). The substantive duties apply from 13 May 2027. Before then, use the MCS Act routes: records complaints to the Registrar under s.154B-8, and misuse by the committee through the complaint procedure (BL 171-173).

Question 20

My scooter was damaged in the society parking. Can I get the CCTV footage from the society?

Accepted Answer

You have no statutory right to copy the footage under the co-operative law, but the society should preserve the relevant clip at once and let you view it with an office-bearer present. It should give a copy to the police on a written request once you file a complaint. Follow the society's CCTV policy. Footage is not among the records s.154B-8(1) opens to members, and the High Court has held that even a general-body meeting recording falls outside that list (Bhartiya, 2026; records_rti_privacy-005). Footage also shows other people, so handing copies to one resident raises privacy issues under the DPDP Act from 13 May 2027. A fair procedure: - the member asks in writing within the retention window, giving date, time and place; - the Secretary or an authorised person preserves the clip (export to a secured drive) and notes it in a
  register;
- the member may view the clip in the office with an office-bearer present; - a copy goes to the police or an insurer on written request (see records_rti_privacy-318); - the preserved clip is deleted when the matter is closed. Where the member himself is the person in the clip, from 13 May 2027 he may also ask for a summary of his own data (s.11), but that is not a right to other people's images. The draft 2026 bye-laws let the committee use CCTV footage to record violations (dBL 176(a)). That makes a written policy on viewing and copying even more important.

Question 21

The police have asked for CCTV footage, visitor logs or a member's details. Must the society hand them over?

Accepted Answer

Yes, when the request is lawful: a written requisition or summons from an officer investigating an offence, or a court order. Ask for it in writing, give only what is asked for, record what was given and to whom, and keep a copy. The DPDP Act does not block disclosure for preventing or investigating offences. Under the criminal procedure law (the Bharatiya Nagarik Suraksha Sanhita 2023 from 1 Jul 2024) a court or the officer in charge of a police station can summon or require production of a document or thing needed for an investigation or trial. The DPDP Act exempts processing in the interest of preventing, detecting, investigating or prosecuting offences from most of its duties (s.17(1)(c)). It also treats compliance with a judgment or order as a legitimate use (s.7). Good practice: - ask for a written requisition on letterhead with the case or FIR number, the officer's name and rank,
  and the exact items (camera, date, time window);
- give copies, not the society's only original, unless the police seize the device under a seizure memo; - note the handover in a register, with the requisition attached; - do not share with private parties on a verbal "police asked" claim. For a member's phone number or KYC held by the society, the same applies: a written requisition in a pending investigation. For a civil dispute between neighbours, the route is a court order, not an informal request.

Question 22

The society collects children's details for the swimming pool, the play area or gate passes. Is there anything special about children's data?

Accepted Answer

Yes. Under the DPDP Act anyone under 18 is a child. The society needs a parent's verifiable consent to process a child's data, must not track or behaviourally monitor children, and should collect the minimum: usually the name, flat and a parent's contact. The rules start on 13 May 2027. The DPDP Act requires verifiable consent of the parent or lawful guardian before processing a child's personal data. It bars processing likely to harm a child's well-being, and bars tracking, behavioural monitoring and targeted advertising directed at children (s.9). Rule 10 requires appropriate technical and organisational measures to confirm that the person consenting is an identifiable adult parent. Rule 12 and the Fourth Schedule exempt certain classes and purposes, for example safety-related processing by some institutions. Check whether any exemption fits before relying on one. Practical approach: - pool or gym registration: a parent signs a consent form listing the child's data and purpose; - gate: record a child's entry and exit only where needed for safety, not a photo database; - photos of children at society events: do not post them on social media or groups without the
  parent's consent;
- keep medical notes (such as allergies for a summer camp) only for the event and then delete them. Also note the child's own rights through the parent, and the one-year minimum log rule (r.8(3)).

Question 23

How should the society store copies of Aadhaar, police verification and photos of its staff and residents' domestic help?

Accepted Answer

Collect only what the purpose needs, mask the Aadhaar number where you can, keep the copies in one locked place with access for named persons only, and delete them within a set period after the person stops working. Never post these documents on notice boards or groups. For the society's own employees, processing for employment purposes is a legitimate use under the DPDP Act (s.7). Records of employees after cessation are kept five years under the draft bye-laws (dBL 138(e)(v)). For domestic help employed by residents, the society collects data for gate security. The notice should say so, and the data should be limited to identity, photo, flat(s) served and a verification reference. Safeguards the Rules expect (r.6(1)): - encryption or masking. Keep only the last four digits of Aadhaar in registers and apps; - access control: the Secretary and security supervisor only; - logs of who viewed or exported the data, kept for a year; - backups for continuity. Police verification of workers is often required by the local police. Keep the reference number rather than the full report where possible. The draft bye-laws already tell the society not to disclose Aadhaar, PAN, passport or bank details of any person unless the law requires (note under dBL 39). When a worker leaves, cancel the pass the same day. Delete the documents after the society's retention period, subject to the one-year minimum for logs (r.8(3)).

Question 24

A member has let out the flat. What tenant documents may the society ask for, and how long can it keep them?

Accepted Answer

The bye-laws let the society ask for intimation with a copy of the registered leave-and-licence agreement, the police intimation and the licensee's details. Keep only these, use them for occupancy and security, and keep them five years after the tenancy under the draft schedule. Do not ask for more than the purpose needs. A member who sub-lets or gives the flat on leave and licence must intimate the society in writing. The draft lists a copy of the duly stamped and registered leave-and-licence agreement and a copy of the police intimation or verification, where applicable (dBL 40(a)). The 2014 bye-laws also require intimation. These are records the society needs to know who occupies its premises, and they sit in the tenants' register (dBL 136). Under the DPDP Act, data the tenant or member provides voluntarily for this purpose can be processed for it (s.7). The notice should still tell the tenant what is kept and why. Asking for bank statements, salary slips or employer letters goes beyond the purpose. Retention: tenant, licensee, caretaker and occupant records are kept five years (dBL 138(e)(i)), and logs at least one year (r.8(3)). After that, delete the tenant's KYC copies. Keep only the register entry if the society's policy requires it. Other members have no right to see a tenant's papers (records_rti_privacy-004).

Question 25

Must the society record general-body meetings on video, who keeps the recording, and can members get a copy?

Accepted Answer

A redevelopment SGM must be video-recorded, with the recording kept by the Chairman and a copy in the Deputy or Assistant Registrar's office. When members attend by video conference, the system must record and store the proceedings with date and time. Other meetings need no video. The High Court has held that a recording is not a document members can demand under s.154B-8; the minutes are. Rule 106C-13(3)(i): a redevelopment-related SGM needs fourteen clear days' notice and a two-thirds quorum, is held in the presence of the Registrar's representative, and is video-recorded. The recording stays in the Chairman's custody and one copy goes to the Assistant or Deputy Registrar's office. Rule 106C-13(3)(b) proviso allows participation by video conferencing or other audio-visual means that can record and recognise the members' participation and store the proceedings with date and time. In Bhartiya (2026) the High Court held that a CD or recording of a general-body meeting is not among the documents listed in s.154B-8(1), so not supplying it does not by itself disqualify the committee. The minutes are listed and must be supplied (records_rti_privacy-002). Practical points: announce at the start that the meeting is recorded; keep the file in the society's custody with restricted access; keep it at least until the minutes are confirmed and any challenge period has passed, and permanently for redevelopment; and treat it as personal data under the DPDP Act from 13 May 2027. A society may, by resolution, let members view the recording at the office.

Question 26

Can the society keep its registers and books only in software, without paper registers?

Accepted Answer

The draft 2026 bye-laws expressly allow physical or electronic records, provided they are protected against loss, damage and unauthorised alteration. The 2014 bye-laws treat digital data as society "papers". Keep backups, restrict editing, keep an audit trail, and print and sign the key statutory registers at year end until the final bye-laws settle the point. dBL 138(b) lets the society maintain books, registers, records and documents in physical form, electronic form or both, wherever permitted under law. It must ensure their custody, preservation, confidentiality and protection against loss, damage or unauthorised alteration. dBL 140 repeats this for books of account, and dBL 170(b) suggests electronic backup of important records. The note under BL 123 of the 2014 bye-laws says "papers" includes data or information in digital form, so electronic records pass on at the handover of charge. The Information Technology Act 2000 gives legal recognition to electronic records. The DPDP Rules add security expectations: access control, logs, backups (r.6). Practical safeguards: - one system of record, not parallel spreadsheets; - entries are never deleted; corrections are new entries linked to the old one. This matches the
  append-only nature of statutory registers;
- role-based access and a log of changes; - an off-site backup, tested; - a printed, signed copy of Form I, Form J and the minutes at year end, as a precaution. Registrar inspections (s.89A) and the auditor need access. Make sure the software can export complete registers.

Question 27

For redevelopment, the developer or project consultant wants the full member list with phone numbers, PAN and Aadhaar. Can the committee hand it over?

Accepted Answer

Share only what the stage needs, under a written agreement that limits use to the project. Names, flat numbers and areas from the society's records can go for feasibility and tender work. PAN, Aadhaar and bank details should come from each member directly when agreements are signed, not from the society's files. The register and list of members, and the flat areas, are society records the committee uses to run the redevelopment process under the s.79A directive and dBL 150-161. Giving a consultant appointed by the general body what it needs for the feasibility report and tender is within the society's purpose. The consultant then acts as a processor under a contract (DPDP Act s.8(2); r.6(1)(f)). Identity documents are different. The draft bye-laws tell the society not to disclose Aadhaar, PAN, passport or bank details of any member except where the law or a competent authority requires it (note under dBL 39). A developer's request is neither. When individual agreements (for example the permanent alternative accommodation agreement) are executed, each member gives his own documents to the developer and consents to their use. Steps: a committee or general-body resolution naming what may be shared and with whom; a confidentiality and data-use clause in the consultant's or developer's contract; a log of what was sent; and a notice to members. Mobile numbers for project communication should be shared only for members who agree.

Question 28

What are the Register of Members (Form I) and the List of Members (Form J), and must the society keep and show them?

Accepted Answer

Yes. Every society must keep a Register of Members in Form I and a List of Members in Form J. Form I records each member's name, address, shares, date of admission, date of leaving and nominee. Form J is the list of current members. A member may inspect the register free of cost, and the list of members is open to inspection. Section 38 of the Act requires the register, with each member's name, address and occupation, shares, date of admission and date of cessation. Where a nomination is recorded, the register also shows the nominee and the date. Rule 32 prescribes Form I for it. Rule 106C-9 adds that nominations, revocations and variations are entered in this register. The register is prima facie evidence of the dates of admission and cessation (s.38(2)). Section 39 requires a copy of the Act, the Rules, the bye-laws and a list of members to be kept at the registered address and open to inspection. Rule 33 prescribes Form J for the list. Both appear first in the list of registers in BL 140 and dBL 136. The draft 2026 bye-laws keep them permanently (dBL 138). Members inspect the register of members free (s.32(1); dBL 37). A copy of the list of members costs Rs 10 a page under the 2014 fee schedule (BL 170). Every transfer is entered in both registers (dBL transfer-approval letter form). Enter only what the law asks for. Phone numbers, e-mail and KYC documents are not part of Form I; see records_rti_privacy-004 before sharing them.

Question 29

An outsider (a broker, a buyer or a candidate's supporter) asks for the list of members. Must the society show it?

Accepted Answer

The Act says the list of members is kept open to inspection by the public, free of charge. So the list in Form J may be seen. That does not extend to phone numbers, e-mail addresses, ledgers or KYC papers, and from 13 May 2027 the society must also handle member data under the DPDP Act. Section 39 requires the society to keep, at its registered address, a copy of the Act, the Rules, its bye-laws and a list of members, open to public inspection free of cost. The list is Form J (Rule 33). Inspection means viewing at the office in office hours. It does not oblige the society to hand out copies to non-members. For members, copies are available on payment (s.32(2); BL 170). The register of members in Form I, the minutes and the ledgers are open to members under s.32 and s.154B-8, not to the public. From 13 May 2027 the society, as a data fiduciary, must limit use of personal data to its purpose and keep it secure (in-dpdp). Showing the statutory list is required by law. Exporting members' contact details to a broker is not. Keep a register of inspections (dBL 37(g)) noting who inspected what and when.

Question 30

As secretary, which statutory registers and books must I keep up to date?

Accepted Answer

The 2014 model bye-laws list 16 books and registers (BL 140), including the Register of Members in Form I, the List of Members in Form J, the cash book, ledgers, the nomination register, the two minutes books, the investment register, the property register and the Form O audit rectification register. BL 141 adds 33 subject files. The Secretary keeps them up to date unless the committee decides otherwise (BL 142). BL 140 registers: (1) Register of Members, Form I (Rule 32); (2) List of Members, Form J (Rule 33); (3) Cash Book; (4) General Ledger; (5) Personal Ledger (one account per member); (6) Sinking Fund Register; (7) Audit Rectification Register, Form O (Rule 73); (8) Investment Register; (9) Nomination Register; (10) Loan / Mortgage Register; (11) Committee minutes book; (12) General body minutes book; (13) Property register with furniture, fixtures and office equipment; (14) Structural and Fire Audit Register and Lift Inspection Record; (15) Register of Nominal Members (tenants); (16) Register of Active Members. BL 141 lists the files: membership, transfer and resignation applications, nominations, a separate file for each member's correspondence, correspondence with the Registrar, property tax, electricity, conveyance, agreements, approved plans, parking applications, vouchers in cash-book order, bank challans, cheque and receipt counterfoils, share-certificate counterfoils, notices and agendas, audit memos with rectification reports, election papers and members' complaints. The draft 2026 bye-laws (dBL 136-137) keep the same core list and add a Share Register, a Register of Provisional Members, a Register of Associate Members, a Tenants Register and a Parking Register. They also allow physical or electronic records, provided they are protected against loss or unauthorised alteration (dBL 138(b)). Practical tip: keep one master index of every register and file with the person holding it and the date it was last written up. Hand that index over at every change of committee.

Question 31

How do I write up the Register of Members (Form I) and the List of Members (Form J)?

Accepted Answer

Make one Form I entry for each member when the committee admits them. Record the name, address, occupation, shares held, date of admission and nominee with the date the nomination was recorded. When a member leaves, enter the date of cessation; do not erase the entry. Form J is the current list of members, kept open for inspection. Section 38(1) of the Act lists what the register must contain. Rule 32 prescribes Form I for it. The register is prima facie evidence of the dates of admission and cessation (s.38(2)), so accuracy matters in transfer and succession disputes. A simple routine: - Write the entry only after the committee's admission resolution. Note the resolution number
  and date against it.
- Enter the share certificate number and the distinctive numbers of the shares. - When a nomination is recorded, write the nominee and the date against the member (s.38(1)
  proviso; BL 32).
- On transfer, resignation, expulsion or death, write the date of cessation against the old
  entry. Open a new entry for the incoming member. Never overwrite, white-out or tear out
  pages. Correct a mistake by striking it through with a dated, initialled note.
- Update Form J (Rule 33) after every change. The Act requires the list of members to be open
  for inspection at the registered address (s.39).
Both registers are kept permanently (dBL 138(c)). If kept electronically, keep a printed, signed copy at least at every year end. That is good practice, not a legal requirement.

Question 32

How do I issue share certificates and keep the share register?

Accepted Answer

Issue the share certificate within six months of allotment. The Chairman, the Secretary and one authorised committee member sign it under the society's seal. Keep the counterfoil and record the certificate number and share numbers against the member. A duplicate is marked "So Marked" and is issued only against an application with supporting papers. BL 9(a) requires a share certificate with distinctive numbers within six months of allotment. BL 10 says the Secretary issues it, signed by the Chairman, the Secretary and a committee member authorised for the purpose, under the seal. Counterfoils go in a file (BL 141(xx)). For a duplicate (BL 9(b)): the member applies with a copy of the police complaint and an affidavit if the certificate is lost, or an affidavit if it is damaged. The committee approves it, the duplicate is marked "So Marked", and the fee is Rs 100 (BL 170). On a transfer, endorse the existing certificate in the transferee's name or cancel it and issue a new one, as the committee decides. Note the resolution in the register. The draft 2026 bye-laws make the Share Register a separate register (dBL 136(xvii)) and keep it permanently (dBL 138(c)).

Question 33

A member has handed in a nomination form. What exactly must the secretary do?

Accepted Answer

Acknowledge it, and place it before the next committee meeting so that it is recorded in the minutes. Then enter it in the Nomination Register within 7 days of that meeting. Also note the nominee against the member in the Register of Members. The first nomination is free; a later change costs Rs 100. BL 32 sets the sequence: receipt, the next committee meeting records it in the minutes, and the Secretary enters it in the register within 7 days. Recording a nomination is not a decision to approve or reject it. The committee cannot refuse a valid nomination because it dislikes the nominee. Check that the form is signed by the member, names the nominee(s) and shares if more than one, and is witnessed as the form requires. Under Rule 106C-8(1) (from 22 Jun 2026) joint members may each make a separate nomination. A revocation or a new nomination follows the same path. Keep the old form in the nominations file (BL 141(viii)); do not destroy it. Fee for a second or later nomination: Rs 100 (BL 170). Give the member a written acknowledgement with the date. It is their proof if the nomination is disputed after death.

Question 34

How should the minutes of a committee meeting be written, signed and corrected?

Accepted Answer

The Secretary records the minutes of every committee meeting. They are signed by the Secretary and the person who chaired the meeting, and confirmed at the next committee meeting. Record who attended, that there was a quorum for each item, the text of each resolution with the voting, and any dissent or withdrawal. Never rewrite confirmed minutes; correct them by a later resolution. BL 135 requires the Secretary to attend and record the minutes and to place them for confirmation at the next meeting, signed by the Secretary and the chairman of the meeting. If the Secretary is absent, the Chairman arranges for someone else to record them. A good minute contains: - date, time, place, the notice date and the names of those present and absent (leave granted
  or not; three consecutive absences without leave end membership of the committee, BL 118);
- the quorum, which must exist for every item (BL 125); - for each item: the papers placed, a short note of discussion, the resolution text with a
  number, proposer and seconder, and votes for and against (BL 133; the chair has a casting
  vote);
- any member who declared an interest and left the room (BL 119; dBL 115); - dissent, where a member asks for it to be recorded. This matters for personal liability
  (BL 136).
Minutes are statutory records kept permanently (dBL 138(c)). Pages are numbered and never removed. A correction is made by a resolution at the next meeting, written below the original. General-body minutes follow BL 107: the committee finalises the draft within 3 months, circulates it within 15 days, and members have 15 days to comment.

Question 35

How should the society correspond with the Registrar's office, and what must be sent there?

Accepted Answer

Write on the society's letterhead, signed by the Secretary with the committee's authority, and keep proof of delivery: an inward stamp, a registered-post receipt or an email/portal acknowledgement. Keep everything in the Registrar correspondence file (BL 141(x)). Regular items include the annual returns by 30 September, the auditor-appointment return within one month of the AGM, and the audit rectification report. What typically goes to the Registrar: - annual returns under s.79(1A) by 30 September (BL 145(b)): the annual report, audited
  accounts, the surplus-disposal plan, bye-law amendments, the AGM and election declaration,
  and the list of active and non-active members;
- the name of the auditor appointed at the AGM, with written consent, within one month
  (s.79(1B); BL 145(b)(viii));
- the audit rectification report in Form O within three months of the audit report (s.82;
  BL 152);
- notice of a committee member's disqualification or cessation (BL 118(b)); - intimation of every AGM and SGM (BL 98); - bye-law amendment proposals (BL 165), and redevelopment intimations under the 2019 directive. Practical routine: give each outgoing letter a number in an outward register, keep a copy with the acknowledgement, and note the reply date. For a request or complaint, follow up in writing after 30 days if there is no reply; this is good practice, not a legal deadline. Only the persons the committee authorises should sign. A resolution naming them avoids disputes about who speaks for the society.

Question 36

Which society records can a member inspect, and how fast must copies be given?

Accepted Answer

Inspection is free, at the office during office hours or at a fixed time. It covers the Act, Rules and bye-laws, the last audited balance sheet and income and expenditure account, the committee list, the register of members, the minutes of general-body and committee meetings, and the member's own account. Copies must be supplied within 45 days of payment of the fee. Section 154B-8(1) lists the records open to inspection. Section 154B-8(2) obliges the society to supply copies on a written request and payment of the fee within 45 days, or 30 days where the Government has given share capital, loan or land. This replaces the one-month period in s.32(2) for housing societies. Fees under the 2014 bye-laws (BL 170) are Rs 10 a page for minutes, the member list and correspondence, and Rs 5 for most other documents. The draft 2026 bye-laws make copies sent by WhatsApp or email free (dBL 39(b)(14)). The draft bye-laws add procedure. The general body may fix one day a month for inspection without an application. Otherwise the Secretary fixes a date within 15 days of a written request (dBL 37). The Secretary communicates the fee within 7 days (dBL 38(b)). Both are recorded in a register. A committee member who wants records is also entitled as a member. The High Court rejected the argument that such a person already had access (Ramane, para 25). If the society fails, complain to the Deputy Registrar. The penalty for the committee can be disqualification; see records_rti_privacy-002.

Question 37

What happens to committee members who do not give a member the documents they asked for?

Accepted Answer

The Registrar can hold them responsible under s.154B-8(2). They then cease to be on the committee and cannot be elected, co-opted or nominated for five years (s.154B-23(1)(iii), (3)). The Registrar can also direct and penalise the society under s.154B-27. Real, substantial compliance can avoid disqualification; deliberate stonewalling will not. In Ramane (1 Jul 2026) a committee member asked for the committee minutes of a year and the AGM video, and paid the fees. The society sat on the request for months despite four letters from the Deputy Registrar. It then handed the papers to the Registrar's office, not to the member. The High Court upheld the chairman's, secretary's and treasurer's disqualification for five years. Following Shahid Tamboli (2023), the court said: - disqualification is not automatic when the 45 days end, because an inquiry is needed; - substantial compliance and bona fide delay can excuse a default; - a deliberate refusal cannot (paras 23-24). In Mahesh Bhartiya (25 Jun 2026) the same judge held that a CD or recording of a general-body meeting is not one of the documents listed in s.154B-8(1). Not supplying it alone does not disqualify. Minutes are listed, and not supplying them does. Practical step: log every request, communicate the fee, supply within 45 days, and keep proof of delivery.

Question 38

Can I file an RTI application against my housing society?

Accepted Answer

No. A co-operative housing society is not a "public authority" under the RTI Act, so it need not answer RTI applications. Use your right to inspect and get copies under s.154B-8 and s.32. Or ask the Registrar under RTI for information the Registrar holds or can lawfully obtain. In Thalappalam (7 Oct 2013) the Supreme Court held that co-operative societies registered under state law are not public authorities under s.2(h) of the RTI Act. The exception is a society owned, controlled or substantially financed by the Government, which a housing society rarely is (para 54). The Registrar's supervisory control does not change this. The Court noted that information the Registrar can access under the co-operative law is "information" under s.2(f). The Registrar, who is a public authority, may furnish it, subject to the exemptions in s.8 (para 52). For a member, s.154B-8 is usually faster and carries a real sanction; see records_rti_privacy-002.

Question 39

Can a member see another member's ledger, phone number or KYC documents?

Accepted Answer

No. The inspection right covers the register of members and the member's own transactions, not other members' accounts or identity documents. The draft 2026 bye-laws tell the society not to disclose Aadhaar, PAN, passport, bank details or similar personal information except where the law requires it. Section 154B-8(1) opens "those portions of the books and records in which his transactions with the society have been recorded". It does not open other members' accounts. The register of members (Form I) and the list of members (Form J) are open. They contain names, addresses, shares and dates, not KYC documents. The note under dBL 39 bars disclosure of confidential or personal information unless required by law or ordered by an authority. From 13 May 2027 the DPDP Act's duties apply to the society as a data fiduciary. These include notice, purpose limitation, security and data principals' rights. A request for another member's data for a legal dispute should go through the Registrar or the court.

Question 40

What rules apply to CCTV cameras in the society, and who may see the footage?

Accepted Answer

The society may install CCTV in common areas for security. The system is a society asset. Cameras must not look into flats. Footage is personal data: tell residents and visitors, restrict access to authorised people, keep it only for a set period, and hand it to the police on a lawful request. A member has no general right to copy footage. CCTV and security systems are common installations the society maintains (BL 67(a)(xix); dBL 74). Tampering with them is prohibited (dBL 166(a)(v)). The draft 2026 bye-laws let the committee rely on CCTV footage to record minor violations (dBL 176(a)). That makes a written CCTV policy important. It should cover camera locations, who may view, the retention period, and how requests are handled. Recorded images of identifiable people are personal data under the DPDP Act 2023. From 13 May 2027 the society must: - give notice, for example signs at the entry and in the lifts; - use the footage only for security; - keep it secure and delete it when the purpose is served; - report breaches (DPDP Rules 2025 r.7). Footage is not among the records s.154B-8(1) opens to members. The High Court has held that even a general-body meeting video is outside that list (Bhartiya, 2026). Security logs are kept five years under dBL 138. CCTV itself usually needs a much shorter rolling window; the society's policy should fix it.

Question 41

How long must the society keep its registers, minutes, vouchers and visitor records?

Accepted Answer

Keep permanently the registers of members and shares, the minutes books, title and plans, audit reports and recovery orders. Keep account books, vouchers, contracts and tax records for 10 years. Keep tenant records, complaints and security logs for 5 years. Under the 2014 regime account books are kept for at least 8 years. The draft 2026 bye-laws introduce an explicit retention schedule in dBL 138: - Permanent: registration and bye-laws, register of members, share register, both minutes
  books, conveyance and plans, structural-audit and redevelopment records, annual accounts,
  audit reports, and orders or recovery certificates.
- 10 years: cash book, ledgers, vouchers, contracts and tenders, insurance, and tax filings. - 5 years: tenant and occupant records, parking, complaints, AMC records, and security logs. - 1 year: attendance sheets once the minutes are confirmed, and draft notices. Nothing is destroyed while an authority or court directs it to be kept. Under the DPDP Act, personal data must be erased once the purpose is served, unless a law requires retention. Statutory registers therefore stay. Visitor logs and CCTV should follow the shortest period the society's policy allows.

Records, RTI & privacyअभिलेख, माहिती अधिकार व गोपनीयता