DPDP Act and Guest WiFi: What a Venue May Collect at Login
A phone number typed into a WiFi login page is personal data under Indian law. The Act does not stop you collecting it. It asks you to collect only what the login needs, say why, keep it away from people who do not need it, and delete it when you are done.
A guest WiFi login page collects personal data. A phone number, an email address, the time a person connected and the device they used are all personal data under India’s Digital Personal Data Protection Act, 2023, and a venue that runs the WiFi is the party the Act holds responsible for them.
The short version: collect what the login needs and nothing more, tell the guest why you are collecting it, keep it away from staff who do not need it, and delete it when it has done its job unless another law says keep it. This post goes through each of those for a hotel, cafe, office or co-working space. It is not legal advice. Talk to your own adviser about your situation, and read the Act itself: the official text is on the MeitY data protection page.
The words the Act uses, applied to a WiFi login
The Act was published on 11 August 2023. The Rules under it set the detail and bring its sections into force in phases, so check the current Rules for the dates that apply to you. Three of its terms matter for guest WiFi:
- Personal data is any data about an individual who can be identified by it. A phone number qualifies on its own.
- Data Principal is the person the data is about: your guest.
- Data Fiduciary is whoever decides why and how the data is processed. That is the venue, not the software company whose login page you use. A vendor that stores the data on your behalf is a Data Processor, and the Act still puts the duty on you.
What you may collect at login
The Act asks that consent be specific to a stated purpose, and separately allows processing where a person has voluntarily given data for a specified purpose and not objected. For a WiFi login the purpose is plain: put this guest’s device online and keep a record of who used the connection. What that purpose needs is short.
| Field | Needed to get a guest online? | Note |
|---|---|---|
| Phone number | Yes, for an SMS or WhatsApp OTP | Also the identifier Indian rules on public WiFi expect |
| Email address | Yes, for an email OTP | An alternative to phone, not an extra |
| Voucher code | Yes, for voucher access | Not personal data by itself |
| Device MAC address, connection time | Collected by the network itself | What a session log is made of |
| Name, date of birth, city, gender | No | Needs its own stated purpose |
| Aadhaar or other ID numbers | No | Avoid on a WiFi login page |
A login form that asks for a name, a birthday and a city before the internet works is collecting for a purpose it has not stated. If you want those details for a loyalty programme, ask after login, say what they are for, and make them optional. What to put on a WiFi login page makes the same point for a different reason: every extra field costs you guests.
What you have to tell the guest
The Act requires that a request for consent come with, or follow, a notice that says what personal data is being collected and why, how the guest can withdraw consent, and how to complain. On a WiFi login page that is a link to your terms and privacy text next to the sign-in button, written in plain words. One short paragraph is enough: “We use your number to send a login code and to keep a record of this session. We do not share it. To have it removed, contact us at…”
Make the terms reachable before the guest is online, since a guest with no internet cannot open a page on another site. Writing a guest WiFi acceptable use policy covers the wording. In Wyfy Guest, the terms link and its checkbox are on the first OTP screen, before the code is sent, and the terms page opens inside the portal.
Marketing is a second purpose
A guest who typed a number to get online has agreed to get online. They have not agreed to receive festival offers on WhatsApp. The Act’s consent is tied to the purpose it was given for, so a marketing message is a new purpose that needs its own yes.
The practical rule: only message guests who opted in, keep the opt-out working, and keep the marketing list separate from the login record. Guest WiFi as a marketing channel explains how to ask without putting the question in front of the login.
Who inside the venue can see it
The Act requires reasonable security safeguards against a personal data breach, and in practice the first breach risk in a small venue is not a hacker. It is every staff login being able to read every guest’s number, forever, with no record of who looked.
Three settings answer that:
- Hide contact details by default. The dashboard shows masked numbers and emails unless someone with a reason turns the mask off for their own account. In Wyfy Guest that step needs an OTP sent to the staff member’s own phone or email. Hiding guest phone numbers from staff covers how it works.
- One login per staff member, with a role. Shared dashboard passwords make every action anonymous. Role-based access is what lets you say who can see what.
- An audit trail. A record of who changed a setting or unmasked a guest, for the day a guest asks what happened to their data.
How long to keep it
Section 8(7) of the Act says a Data Fiduciary must erase personal data when the guest withdraws consent or as soon as it is reasonable to assume the purpose is no longer being served, unless retention is necessary to comply with another law.
The CERT-In directions of April 2022 require businesses to keep logs of their ICT (information and communication technology) systems for 180 days, and a guest network is hard to argue out of that. So session logs stay for at least 180 days. Guest WiFi logs in India quotes the direction and says where it is unclear.
Everything else follows the Act’s default. A marketing list drops guests who opt out. A loyalty profile goes when the programme ends or the guest asks. Write down which records you keep, for how long, and why.
Guests under 18
The Act defines a child as anyone under 18 and requires verifiable consent from a parent or guardian before processing a child’s data. It also bans tracking, behavioural monitoring and targeted advertising directed at children. The manner of taking that consent is left to the Rules, so check them.
For a hotel or cafe this rarely comes up, because the adult in the group logs in. For a school or a coaching centre it comes up every day: do not market to those numbers, do not profile them, and ask your adviser how to take parental consent before students log in with their own phones. Guest WiFi for coaching centres covers that setup.
A five-line check for your login page
- The page asks for a phone number or email, or a voucher, and nothing else before login.
- A terms and privacy link is on the login screen, and it opens without internet.
- Marketing messages go only to guests who opted in, and the opt-out works.
- Staff see masked contact details unless they have a reason, and that reason is recorded.
- You can say which records you keep, for how long, and which law requires the long ones.
Where Wyfy Guest fits
Wyfy Guest is guest WiFi software for venues in India. The login page asks for a phone number or email for an OTP, or a voucher code, and nothing more, with the terms link and checkbox on the first screen. In the dashboard, guest numbers and emails are masked by default, unmasking needs an OTP to the staff member’s own contact, every staff member has their own login and role, and changes are recorded. Session records are kept so the venue can meet the CERT-In logging direction. What your terms say, how you take consent from minors and how long you keep a marketing list are your decisions, and the Act makes them yours. Our own privacy policy says what we do with the data we hold for you.