Who Owns Your Society's Data When the Committee Changes? A Handover Guide

Who owns your society's data when the committee changes? The association owns it — the registered co-operative society, apartment owners' association or company — never the individual who happened to be secretary when the account was opened. That is the legal position and the one most societies cannot enforce, because the app account sits on a personal Gmail, the net-banking token is in a former treasurer's drawer, and the gate password was set by an engineer nobody has spoken to since. Handover is therefore a controlled transfer you rehearse before renewal — a written pack, a tested export, a dated receipt — first when the builder hands over, then yearly.

The handover pack, itemised

Handover fails because it is treated as a conversation, not a list. Write it once into your standing orders and it survives every committee — and add the physical tail: master keys, the society seal, unused cheque books, and the SIMs receiving gate calls and OTPs.

The account owner must be the association, not an office bearer

Every online account has an owner record. If it names a person, an association asset has become a personal one — and you find out in the week that person stops answering.

• Owner record: the association's registered name and number, billed to the society's address — never a personal PAN.
• Registered email: a role mailbox the association controls, with password and recovery codes in society custody — never a bearer's personal Gmail.
• Two-factor authentication: keep recovery codes in the safe and the recovery number on an association SIM. 2FA bound to one handset is how societies lock themselves out.
• Never one super-admin: two administrators from different households at all times, scoped roles below (billing, notices, ledgers, gate), and a log of who granted or revoked access.

The recovery route — ask before you need it

Ask your vendor in writing: what does the association submit to have admin rights transferred when the outgoing bearer is unreachable or uncooperative? A serious answer names documents — certified resolution, election minutes, registration certificate, ID of the incoming bearers — plus a notice period and a turnaround in days. If the answer is "the existing admin must approve", the product has designed your ownership away.

Handover also means revoking, which committees forget: app admin, net banking, payment gateway, CCTV access, gate and biometric controllers, the WhatsApp Business number, domain registrar, shared drives, accounting software and tax portals.

What the contract must say about your data

A society platform holds member names, phone and vehicle numbers, staff identity documents, visitor histories and often photographs. Under India's Digital Personal Data Protection Act, 2023, whoever determines the purpose and means of processing is the data fiduciary and carries the obligations; a vendor acting on documented instructions is a processor. The association is almost always the fiduciary — make that a written clause, and settle these with it:

• Purpose limitation — data used to run the service and nothing else: no marketing to members, no resale, no onward sale of insights from your gate logs, and a named list of sub-processors that touch it.
• Breach notification within a stated number of hours — the association has its own obligations to meet.
• Retention and deletion — a schedule per data type (billing records need years, visitor photographs do not), and deletion on termination certified in writing, backups included.
• Resident rights — who answers a correction or erasure request, how fast, and the grievance contact.

A vendor never asked to state a position in writing is itself a signal; we publish ours in our trust centre so that a supplier's position can be read without negotiating for it.

The termination export, and the drill you run at renewal

The export clause is the only part of the contract that matters on your worst day, and the only part nobody tests. A complete return includes the member master, billing masters, every bill and receipt, ledgers and trial balance with opening balances, payments with gateway references, complaints with their threads, gate logs, attachments with a manifest, and the user list.

Judge it on shape: numeric data as CSV or Excel, documents as documents, and a stable key on every row — flat number or member ID — so files join. A folder of PDFs is a printout, not an export.

Run it sixty days before renewal

Raise a genuine export request while you still have money to withhold. Time it, check the files against last cycle's dashboard totals, tie the ledger's closing balance to the audited figure, ask for the deletion certificate wording, then minute the result.

Lock-in signals worth naming

• A "backup file" only the vendor's software reads, and no API — or a read-only one behind a tier you were never quoted.
• Export priced as a service or behind an exit fee — the price of leaving, disclosed early.
• PDF-only reports, and attachments downloadable one at a time.

Portability is decided early in a product's life, not at exit — so put the question to MyCommunity as bluntly as to any paid platform. A committee that cannot leave cannot govern.

Resident data: who sees what, and what ends when an owner sells

Least privilege here is the difference between a directory and a leak. A guard needs a name, a flat and an approval status — not every resident's phone number — and vehicle numbers belong to the gate and parking record, not a browsable list. Visitor photographs need a retention period, named viewers for historic images, and a rule on export. Staff identity documents deserve the shortest retention of all.

When an owner sells, run a checklist, not a memory:

1. Close the flat record, never delete it — billing history is audit evidence.
2. Revoke the seller's login; unlink family members, vehicles and gate passes on that flat.
3. Remove them from the directory, notice lists and groups that week, not at year end.
4. Delete or archive stored identity documents per your retention rule, and record it.
5. Transfer the parking allotment, share certificate or membership entry, and any deposit.
6. Onboard the buyer as a new record, so consent and contacts are theirs, not inherited.

The same routine, minus the membership transfer, applies when a tenant leaves — biometrics and gate passes removed on the tenancy's last day.

The first handover: builder or promoter to the association

Committee-to-committee handovers inherit whatever the builder handed over, so a weak first one poisons every one after it. Under section 17 of the Real Estate (Regulation and Development) Act, 2016, the promoter must execute a registered conveyance of the undivided proportionate title in the common areas to the association of allottees, hand over possession of those areas, and pass on the documents and plans. The Act allows three months from the occupancy certificate where local law is silent. Demand:

• Approvals: building plan, commencement and occupancy certificates, fire NOC, lift licence, electrical sanction, water and sewerage connections and STP consent.
• As-built drawings for plumbing, electrical, fire-fighting and drainage — the likeliest to be missing and the most valuable.
• Equipment manuals, warranties and AMC position for every serialised asset, plus utility deposits and the unsold units on which the promoter owes maintenance.
• An audited statement of maintenance collected in advance, and the corpus or interest-free maintenance deposit with accrued interest, paid into the association's account, not set off against dues.
• The digital estate: the app tenant, resident data in the builder's sales CRM, gate and CCTV admin, the domain and website, and WhatsApp lists built from your residents.

Run a joint snag inspection of the common areas before signing anything, photographed and dated, and keep it as a live register, not a one-time letter. Section 14(3) of the Act gives allottees five years from possession to report structural defects and defects in workmanship, quality or services, with rectification due within thirty days — worthless without dated evidence, so log defects in your own system from day one. Developers running land-to-handover in one system — the discipline behind BuildersERP — hand over cleanly because approvals, drawings and warranties were captured as they were created.

Bank signatories, resolutions and the gap weeks

The predictable crisis is not the app. It is the fortnight when the society legally cannot pay anyone. The sequence: elect the committee, pass a resolution in the bank's format naming the bearers and the operating mandate (jointly by any two of three is common), file a certified true copy on letterhead with attested signatures, complete KYC for each signatory and re-KYC for the society, then issue net-banking tokens, reissue the cheque book and re-point standing instructions. Plan for weeks rather than days:

• Pass the resolution on AGM day, not a fortnight later — it gates everything downstream.
• Where the bye-laws allow, add incoming signatories before removing outgoing ones.
• Pay AMCs and premiums falling due in the window early, and tell vendors.
• Start the payment gateway's re-KYC in parallel — it is separate from the bank's.
• Never route collections to a personal UPI QR because "the account is stuck" — that creates a tax and audit problem larger than the delay.

When it is contested — and when this is more process than you need

If the election is disputed or the outgoing bearer refuses, the records still belong to the association; the objective is preservation, not confrontation. Send a minuted request with a deadline by a method that leaves proof, and put recovered records into interim custody — the auditor, the registrar, or a sealed cabinet under two keys — not the new secretary's home. Reduce the old administrator to read-only rather than deleting the account, so the audit trail survives. Tell the bank and vendors the mandate is in transition, then escalate under your state's law.

Contested or friendly, close with a handover receipt: one or two pages, itemised against the pack, signed and dated by both parties before a witness. It must name what was not handed over — "FD receipt for the corpus deposit not produced" — because a silent gap becomes nobody's fault. Attach the export file list and read the receipt into the next general body meeting.

The honest counter-case

This can be too much apparatus. A twenty-flat association with no employed staff, one bank account, one AMC and a treasurer of six years' standing does not need a nine-part pack and a renewal fire drill — a shared drive, a signed one-page list and a clean mandate change serve it honestly, and the ceremony costs more goodwill than it saves. The pack starts paying when you employ people, hold contracts with penalty clauses, file statutory returns, and change committee faster than memory survives. And it cannot rescue a committee that will not use it: process supports the one person each year whose real job is custody; it does not replace them.

What to do in the ninety days before your AGM

Work backwards from the election, not forwards from the crisis. At day 90, run the export drill and confirm every account's owner record names the association. At day 30, assemble the pack and get the auditor's trial balance in a form the incoming treasurer can read. On AGM day, pass the bank resolution; within a week, sign the receipt and revoke old access.

If you are choosing or renewing a platform meanwhile, judge it on this axis before features: can the association be the account owner, can two administrators coexist, can admin transfer without the outgoing bearer's goodwill, and does a full export open in your auditor's spreadsheet? Ask those four questions of us too — MyCommunity is free, so testing the answers costs an evening rather than a budget. For a second opinion on a handover in progress, or an export clause you have been asked to sign, write to us — a senior engineer, not a sales bot, replies within 24 hours. The answer may be a one-page list rather than software, and we would rather say so.