The short answer: the DPDP Act does not contain a line that says "paper registers are banned." The longer, more useful answer is that a typical open reception register is very hard to operate in a way that complies with the Act — which, in practice, is why organizations are retiring them.
What the Act actually requires
The Digital Personal Data Protection Act, 2023 governs how organizations handle individuals' personal data. When you record a visitor's name, phone number, company and host, you are processing personal data and you take on obligations: collect it with informed consent and clear notice, use it only for the stated purpose, keep it no longer than necessary, secure it, and be able to honour an individual's requests over their data.
Nothing there names paper. The law is about outcomes — consent, purpose, retention, security — not the medium.
Why the open register struggles to meet it
The problem is that the classic reception book fails those outcomes almost by design:
- It discloses data to others. Every visitor can read the entries above theirs. That is an unauthorized disclosure baked into the format.
- Its "consent" is meaningless. A signature to pass the gate is not informed consent to how the data is later used.
- It has no retention control. Books sit in storerooms for years; there is no mechanism to delete data when its purpose ends.
- It cannot answer a data request. If someone asks what you hold about them, or asks you to erase it, a bound book cannot comply.
- It has weak security. A book on a desk can be read, photographed or lost by anyone who passes.
So while "illegal" is the wrong word, "non-compliant in most real setups" is fair. The register is not a crime; it is a liability that is difficult to fix without changing the format.
Could a paper process ever comply?
In theory, a heavily redesigned paper process — individual tear-off slips, a locked drop-box, a written retention-and-disposal schedule, a private consent notice — could get closer. In practice it recreates, badly and manually, what a digital system does automatically. Once you are enforcing per-visitor privacy, consent capture, retention and access control by hand, digitizing is simpler and more reliable.
The stakes are real
The Act carries meaningful penalties for failures such as inadequate security safeguards — up to ₹250 crore in certain cases — and enforcement has been rolling out in stages into 2027. The prudent reading is not to gamble on a deadline but to move visitor data onto a compliant footing now, because the fix is inexpensive and removes a standing risk.
What a compliant replacement looks like
Digital check-in solves the register's problems structurally rather than by discipline:
- Each visitor enters details on their own screen — no shared page, no disclosure.
- Consent and a purpose notice are captured at check-in.
- Retention is configurable, so records purge automatically.
- Access is controlled and logged; data can be located, corrected or erased on request.
manmov'e does all of this at the front desk, and extends the same auditable record to contractors and material movement — so the whole gate, not just reception, comes off paper together. For the deeper background, see our full DPDP visitor-data compliance guide.
This article is general information, not legal advice. Consult your legal or compliance team for guidance specific to your organization.