Introduction
NDA signing at the reception desk is standard practice for thousands of Indian corporates, technology firms, and manufacturing facilities. A visitor arrives, the receptionist presents a Non-Disclosure Agreement on a tablet or printed form, the visitor signs, and they enter.
It is a sensible security practice. It is also a data event β one that is now squarely within the scope of India’s Digital Personal Data Protection Act, 2023 (DPDP Act).
Most legal and compliance teams working on DPDP have focused their visitor management attention on the obvious data points: the photo, the phone number, the check-in form. The NDA has been somewhat overlooked. That is a gap.
This article addresses the specific intersection of NDA signing at reception and DPDP compliance β clarifying what the Act requires, where the common misunderstandings lie, and what changes legal teams need to make to visitor NDA processes before the May 2027 compliance deadline.
The Core Misunderstanding: NDA Consent β Privacy Consent
This is the most important point in the entire article. Read it twice.
Signing an NDA is not the same as giving consent to data processing under the DPDP Act.
When a visitor signs your Non-Disclosure Agreement, they are consenting to the terms of the NDA β agreeing to keep information confidential, agreeing to specific obligations around intellectual property, agreeing that the company’s proprietary information is protected. The NDA is a legal contract between the visitor and your organisation.
It is not, and cannot serve as, a consent to your organisation collecting, processing, retaining, and eventually deleting their personal data under the DPDP Act.
Why? Because the DPDP Act’s consent requirements are specific:
- Consent must be free β the visitor cannot be coerced into a bundled agreement where NDA signing and data privacy consent are combined and both are mandatory conditions of entry
- Consent must be specific β each distinct data processing purpose needs its own consent
- Consent must be informed β preceded by a standalone privacy notice explaining exactly what data is collected and why
- Consent must be unambiguous β a clear affirmative action, not an implicit acceptance through signing another document
Bundling your DPDP privacy consent into the NDA β or treating NDA signature as evidence of privacy consent β creates an invalid consent mechanism. If a Data Principal challenges this before the DPBI, they will succeed.
What Data Is Processed When a Visitor Signs an NDA?
When your organisation conducts an NDA signing at reception, the following personal data is typically processed:
| Data Point | Processed By | DPDP Classification |
| Visitor’s full name (on the NDA) | Your organisation | Personal data |
| Visitor’s signature (digital or physical) | Your organisation | Personal data |
| Visitor’s company / designation (if included in NDA) | Your organisation | Personal data |
| Date and time of signing | Your organisation | Personal data (linked to an identified individual) |
| Witness name and signature (if applicable) | Your organisation | Personal data of the witness |
| Digitised copy of the signed NDA | Your organisation + your VMS/document platform | Personal data in digital form |
| Email (if NDA copy is sent to visitor’s email) | Your organisation + email service provider | Personal data |
Every one of these data points is personal data under the DPDP Act β and the digitisation of any paper-based NDA makes it subject to the Act’s full obligations.
The Legal Basis for Processing NDA Data
Here is where the DPDP Act creates some genuine clarity for NDA processing, if it is handled correctly.
Processing data contained in a signed NDA falls within the “legitimate use for contractual necessity” category under Section 7 of the DPDP Act. A visitor who agrees to enter your facility and signs an NDA has entered into a contractual relationship with your organisation. Processing the personal data contained in the NDA β the visitor’s name, signature, company, date of signing β is necessary for the existence and enforcement of that contract.
This means, for the NDA document itself:
- Consent may not be strictly required β you can rely on the contractual necessity legitimate use
- A privacy notice is still required β even for legitimate use processing, you must inform the Data Principal of the data processing
- Purpose limitation applies β the NDA data can only be used for NDA-related purposes: enforcing the agreement, demonstrating that it was signed, pursuing legal action if the agreement is breached
However, and this is critical: the contractual necessity legitimate use for the NDA does not extend to other data collected at check-in. The visitor’s phone number, face photo, visit frequency, host name, and other check-in data are not part of the NDA contract. They require their own legal basis.
The Right Way to Structure NDA + Privacy Compliance at Reception
The correct approach separates the NDA process and the privacy consent process into distinct, sequential steps β each with its own clear legal basis and proper documentation.
Step 1: Privacy Notice (Before Everything)
Before any data collection β before the check-in form, before the NDA β display the standalone privacy notice. This notice should cover all data that will be collected during the visit, including:
- Standard check-in data (name, phone, company, purpose, host)
- Photo capture (if applicable)
- NDA signing process β “For visits requiring an NDA, you will be asked to sign a confidentiality agreement. Your name, signature, and signing date will be retained for the duration of the NDA + 3 years for legal record purposes.”
This notice covers the NDA data processing under the “inform the Data Principal” requirement that applies to legitimate use processing under Section 7.
Step 2: Check-In Data Consent
After the privacy notice, collect consent for check-in data: name, phone, company, purpose, host, photo. These require explicit affirmative consent because they are collected primarily on a consent basis.
Step 3: NDA Presentation and Signing (Separate Process)
The NDA should be presented as a separate document from the privacy notice and check-in consent. The visitor should have a reasonable opportunity to read the NDA. The signing interface should make clear:
- “This is a confidentiality agreement between you and [Company Name] for the purpose of today’s meeting.”
- “By signing, you agree to the terms of this agreement. Your signature and details will be retained as a legal record of this agreement for [duration of NDA + 3 years].”
Do not include DPDP consent language in the NDA body. Do not present the NDA as the privacy consent. Do not use NDA signature as evidence of consent to unrelated data processing (the photo, the visit log, the host notification).
Step 4: NDA Copy to Visitor (Best Practice)
If the NDA is signed digitally, send or offer a copy to the visitor immediately β email or QR code download. This is:
- Good contractual practice (a party to a contract should have a copy)
- Consistent with the DPDP principle of transparency (the visitor knows exactly what they signed)
- Practically useful (reduces later disputes about what was agreed)
If sending by email, this triggers a separate data processing step β using the visitor’s email. Ensure your privacy notice covers this use if you plan to email the NDA copy.
NDA Data Retention Under DPDP
This is where the NDA process diverges from standard visitor data retention β and where the legal override to standard DPDP deletion rules clearly applies.
Standard visitor check-in data: Delete after 90β180 days from the visit (per your defined retention policy).
Signed NDA / confidentiality agreement: This is a legal document. Its retention is governed not by the DPDP storage limitation principle alone, but by:
- The duration of the NDA itself β if the NDA is effective for 2 years from signing, it must be retained for at least that period
- The limitation period for civil claims under the Limitation Act, 1963 β typically 3 years for contract-based claims in India. If a breach of the NDA is discovered after the agreement expires, the organisation needs to prove the NDA existed and was signed. The 3-year limitation period from the date of breach determines how long this evidence must be accessible.
Practical retention formula: Retain the signed NDA for the duration of the NDA + 3 years from the date of signing, as a documented legal obligation override under DPDP Rule 8.
Important: Only the NDA document itself needs extended retention. Other data collected during the same visit β the visitor’s photo, OTP log, visit timestamp, host name β does not benefit from the NDA legal retention justification. Delete those according to your standard retention schedule.
Digital vs. Paper NDA: Does It Matter for DPDP?
Digital NDA signed on a tablet or screen:
Clearly within the DPDP Act’s scope β it is digital personal data from the moment of signing. All obligations apply.
Paper NDA signed with a pen:
If the paper form is subsequently scanned, photographed, or typed into any digital system β it becomes digital personal data and the DPDP Act applies. This is explicitly covered: the Act applies to personal data collected in hardcopy and subsequently digitised.
If the paper form is signed and stored only as a physical document with no digital copy ever made β technically outside the DPDP Act’s scope (which covers only digital personal data). However:
- Best practice is to apply the same principles regardless
- Physical document storage has its own data protection obligations under general data governance
- Any future scanning or digitisation of the physical record triggers DPDP obligations at that point
Most organisations transitioning to digital visitor management will have digital NDAs β the paper question is increasingly academic.
What Happens to Witness Data?
If your NDA signing process involves a witness β typically a receptionist or security officer who witnesses and co-signs the visitor’s NDA β that witness’s name and signature are also personal data.
- The witness is a Data Principal
- Their name and signature are processed as part of the NDA record
- The legal basis for this processing is the same contractual necessity that covers the visitor’s data
- They do not need a separate privacy notice for this specific processing (they are employees, covered under employment legitimate use for general processing, and this specific processing is covered under the NDA contractual record)
- However, the witness’s data retention follows the NDA retention period β the same document that contains the visitor’s signature contains the witness’s signature
Common NDA + DPDP Compliance Mistakes to Avoid
Mistake 1: Bundling privacy consent into the NDA body
Including language like “By signing this NDA, you also consent to [Company Name] collecting and processing your personal data” is invalid. The NDA consent and the DPDP consent must be separate processes with separate documentation.
Mistake 2: Using NDA signing to bypass the privacy notice requirement
The privacy notice is required even when processing occurs under legitimate use. The contractual necessity basis for NDA data does not remove the obligation to inform the visitor that their data is being processed.
Mistake 3: Retaining NDA-linked visit data beyond the NDA retention period
The NDA retention justification covers the NDA document. It does not justify retaining the visitor’s phone number, photo, or visit history for 5 years because an NDA was signed during that visit.
Mistake 4: Not providing the visitor a copy of the NDA
Not a DPDP violation per se, but poor practice that creates disputes and undermines the transparency principle.
Mistake 5: Treating digital NDA signing as the only consent collected
If your entire visitor check-in process relies on NDA signing as the data consent mechanism, you have a fundamental compliance architecture problem that needs to be rebuilt.
The NDA + DPDP Compliance Checklist for Legal Teams
The Bottom Line
NDA signing at reception is DPDP-compliant β if the process is designed correctly.
The contractual necessity legal basis covers the NDA document itself. The privacy notice covers the obligation to inform visitors about all data processing, including the NDA. The NDA and the privacy consent must be handled as separate, distinct processes.
The danger lies in treating the NDA signature as a catch-all consent, or in failing to notice that the legal document creates its own data trail β one that requires its own retention policy, its own legal basis documentation, and its own deletion workflow when the retention period ends.
Get the architecture right. Keep the NDA and the privacy consent separate. Define and enforce the retention period. And make sure your legal team is as comfortable with the data law aspects of your visitor NDA process as they are with the contractual aspects.
This article is for informational purposes only and does not constitute legal advice. Consult a qualified data protection professional for specific compliance guidance.
Onfra’s visitor management platform supports digital document signing at check-in β including NDAs β with separate consent flows for the NDA and for visitor data processing, configurable retention policies for each document type, and DPDP-compliant audit trails. Learn about Onfra’s document management features β