DPDP Consulting for Coworking
Learn how coworking spaces should handle biometric entry, visitor logs, WiFi records and tenant data.
Discuss this page with an LLM
Now replace the sandwich shop with your Coworking company. Where does personal data enter? Where does it sit? Who else touches it?
Coworking DPDP Self-Check
Start here to understand why DPDP is relevant to Coworking. Before any other task, first understand how personal data moves through the business.
What is Coworking?
In this context, Coworking means the websites, apps, operations, support teams, customer records, employee systems, vendor tools and data workflows that collect or use personal data.
Children's data
- Do you collect age, class, school, parent details or learning progress?
- Can you separate child, parent and guardian data?
- Do you know which users are under 18?
Consent
- Can you prove where consent came from?
- Is consent collected before data is used for the stated purpose?
- Can consent be withdrawn without breaking the entire account flow?
Tracking and profiling
- Do you track usage, performance, attention, behavior or drop-offs?
- Is any of this used for ads, recommendations or nudges?
- Are analytics tools collecting user identifiers?
Vendors and SDKs
- Which CRMs, email tools, payment tools, analytics tools and support tools receive personal data?
- Do contracts say they process data only on your instructions?
- Can you delete or export data from each vendor?
Retention
- What happens when the service ends?
- What happens when a user leaves?
- What data is kept for certificates, invoices, disputes or regulatory records?
First action
- Map one user journey from sign-up to completion.
- Mark where data is collected, stored, shared, used for communication and deleted.
If this self-check exposed more than three unclear answers, the next useful step is a DPDP data journey map.
Book a DPDP clarity callFrequently asked questions
Can we share member contact lists with our in-house cafe or event partners?
Only if the member gave specific consent for marketing by third parties. You cannot share the primary membership database with vendors just because they operate inside your building.
How long can we keep logs of who entered the building?
You must delete visitor logs once the security purpose is served, unless a specific law requires a longer hold. You cannot keep guest phone numbers for future marketing purposes.
Are we liable if a tenant uses our WiFi to leak data?
You are the Data Fiduciary for the internet connection service, but the tenant is responsible for their own business data. You must ensure your WiFi logs are only used for network security and not for tracking member browsing habits without notice.