Unauthorised Surveillance Through MyGate, NoBroker & Society Apps: Who Can Access Your Home, Vehicle and Visitor Data?

World Engineer | India • Policy • Technology • Economy • Engineering • Global Lessons

विचार से समाधान तक | नीति से प्रभाव तक | Building a Better India

1. The Issue: A Serious Residential Digital Security Concern

Hi All,

I would like to raise a serious concern regarding the security and privacy of residents using MyGate, NoBroker and similar residential society management applications.

How can an unauthorised person be added to my flat as a family member without my knowledge or consent?

I have become concerned that a person whose addition I did not authorise is receiving notifications and information related to my flat, including:

• 🚗 Vehicle Movement Notifications: Information relating to the movement of vehicles associated with my flat.
• 🚪 Visitor Approvals: Notifications and requests concerning guests visiting my residence.
• 🧹 Domestic Help Entries: Information related to the entry or approval of household help.
• 🏠 Family Member Access: Access to information linked to my flat through the society application.

The immediate question is not merely who added this person. The more important questions are:

1. Who authorised the addition?
2. Was the flat owner’s consent obtained and recorded?
3. Which mobile number, account, administrator or device initiated the change?
4. Did the system send an OTP or other verification request to the registered owner?
5. What information has already been accessed by the unauthorised account?
6. Can the same process be exploited in other flats?

These questions require an immediate, documented investigation.

Important clarification: The actual method of addition, the permissions granted and the extent of access must be established through system records. The incident should not be treated as proof of deliberate surveillance or wrongdoing by a particular company or individual before the evidence is examined.

2. Why This Is More Than an App-Management Issue

Residential applications increasingly act as digital access-control systems for gated communities. They may connect residents, security guards, visitors, vehicles, domestic workers and society administrators.

If access permissions are incorrectly granted, the potential consequences can extend beyond inconvenience.

Possible risks include:

• Unauthorised knowledge of household movements.
• Unauthorised approval of visitors or service personnel.
• Exposure of residents' routines and household information.
• Social engineering and impersonation.
• Potential exploitation of access-control weaknesses by malicious individuals.

A vulnerability does not automatically mean a theft has occurred. However, a system that can grant access to sensitive residential information without reliable authorisation creates a risk that deserves urgent attention.

A residential security app must protect the home; it must not become a weak point in the home's security.

3. Legal Framework in India: What Action Can Be Taken?

The applicable law depends on how the account was created, whether anyone acted dishonestly, what data was accessed or disclosed, the company's role, and whether negligence or a contractual breach can be established.

A. Information Technology Act, 2000

Section 43 — Unauthorised access and compensation

Section 43 addresses specified acts involving computer resources without permission, including unauthorised access, alteration and certain forms of data extraction. Its application depends on the facts and statutory requirements.

Section 66 — Computer-related offences

Where conduct covered by Section 43 is committed dishonestly or fraudulently, Section 66 may apply. It provides for imprisonment of up to three years, a fine of up to ₹5 lakh, or both.

Section 66C — Identity theft

This provision may be relevant if someone dishonestly or fraudulently uses another person's password, electronic signature or other unique identification feature.

Section 66D — Cheating by personation

This may be relevant if someone uses a computer resource or communication device to cheat by impersonating another person.

Section 72A — Disclosure of personal information in breach of a lawful contract

This provision may be relevant where its requirements are met, including disclosure of personal information without consent or in breach of a lawful contract, with the specified wrongful-loss or wrongful-gain intent or knowledge.

These provisions are not automatically attracted merely because an unfamiliar person appears in a family-member list. Investigators must establish the relevant conduct and legal elements.

Official reference: Information Technology Act, 2000 — India Code.

B. Bharatiya Nyaya Sanhita, 2023 (BNS)

For conduct occurring after the new criminal laws came into force on 1 July 2024, the Bharatiya Nyaya Sanhita (BNS), rather than the repealed Indian Penal Code (IPC), is generally the relevant criminal code.

Depending on the evidence, police may examine provisions relating to:

• Section 318 — Cheating: If the facts establish the elements of cheating.
• Section 319 — Cheating by personation: If someone fraudulently impersonated another person.
• Section 336 — Forgery: If a false document or electronic record was made in circumstances covered by the provision.

Other provisions may be relevant depending on whether threats, theft, dishonest access or other offences are established.

Important: Do not automatically label every unauthorised account addition as hacking, identity theft, forgery or cheating. The appropriate offences must be determined from the audit trail and evidence.

C. Digital Personal Data Protection Act, 2023 (DPDP Act)

A flat's vehicle-related records, visitor approvals, household access records and linked account information may constitute digital personal data when they relate to identifiable individuals.

The DPDP Act establishes a framework for lawful processing and protection of digital personal data. However, its commencement is phased.

As of 29 October 2026, the substantive provisions scheduled to commence 18 months after the 13 November 2025 notification are not yet in force; that date falls in May 2027. Therefore, the precise commencement status of the relevant provision must be checked before asserting a particular DPDP obligation or penalty against an app provider.

Reference: MeitY — Digital Personal Data Protection Rules, 2025.

The absence of an already-operative DPDP provision does not mean that every form of unauthorised access is lawful. Other applicable laws, contractual obligations and consumer remedies must be assessed independently.

D. Consumer Protection Act, 2019

Where a resident qualifies as a consumer and the relevant legal requirements are met, a complaint may be considered under the Consumer Protection Act, 2019.

Potential issues include deficient service, unfair trade practices and misleading representations about security or access controls.

Whether a particular resident, RWA or app-related dispute falls within the Act depends on the transaction and the facts. A consumer complaint should identify the service, the failure, the resulting harm and the relief sought.

Official reference: Department of Consumer Affairs.

4. Can MyGate, NoBroker or Another App Be Held Responsible?

The answer depends on evidence—not merely on the name of the application.

An investigation should determine whether the incident resulted from:

1. A software design or permission-control weakness.
2. An employee or administrator granting access improperly.
3. An RWA or society-management account making an unauthorised change.
4. A compromised resident account or mobile device.
5. An impersonation or social-engineering incident.
6. A failure to implement or follow the applicable verification process.

The company, RWA, administrator or individual may have different responsibilities depending on their actions, contractual roles and applicable law.

If a company has enabled a process that permits sensitive access without adequate authorisation, that process should be independently reviewed. If a person has deliberately impersonated the owner or misused credentials, the matter may also warrant a criminal investigation.

No company should be declared guilty without evidence, but no serious security complaint should be closed without a traceable investigation.

5. Proposed Legal Reform: Minimum 10% of Annual Turnover as a Penalty

India needs a stronger and more explicit accountability framework for digital residential security platforms.

I propose that the Government examine a statutory penalty framework for serious, proven security failures involving unauthorised access to residents' accounts, visitor permissions, vehicle records and other sensitive residential information.

Proposed penalty framework

• Minimum proposed penalty: 10% of the company's annual global turnover for a proven, serious and systemic violation involving unauthorised access or a major failure of security controls.
• Risk-based assessment: Consider the number of affected residents, duration of exposure, sensitivity of data, actual harm, previous violations and the company's level of cooperation.
• Repeat violations: Apply stronger consequences for repeated or deliberate failures, subject to the applicable law.
• Independent security audit: Require an independent technical investigation and corrective-action report for serious incidents.
• Resident notification: Require timely, meaningful notification to affected residents where legally appropriate.
• Executive accountability: Examine management responsibility where evidence establishes deliberate concealment or serious disregard of statutory duties.

Is a 10% turnover penalty already mandatory under Indian law?

No. The 10% minimum proposed above is a policy recommendation, not a currently established universal penalty for this type of incident.

A penalty can be imposed only by a competent authority under an applicable legal provision and within its prescribed powers. Legislators and regulators would need to establish the proposed minimum, its calculation basis, procedural safeguards, proportionality and appeal mechanism.

This is particularly important for companies operating across several business lines: the law must define whether turnover means global turnover, Indian turnover, relevant business turnover or another measure.

The objective should be meaningful deterrence—not an arbitrary penalty without due process.

6. Mandatory OTP-Based Consent: A Minimum Security Standard

Every residential application that allows a person to be added as a flat owner, family member or resident with access to sensitive information should adopt strong, auditable authorisation controls.

I recommend the following safeguards:

1. Registered-owner authorisation

Adding a new family member or granting access to sensitive residential records should require explicit approval from the registered owner or another person with independently verified legal authority.

2. OTP verification

An OTP sent to the owner's previously registered mobile number should be required for high-risk account additions, alongside clear details of the person being added and the permissions being granted.

OTP should be one part of a secure process, not the sole safeguard against SIM swaps, compromised phones or social engineering.

3. No unrestricted RWA override

An RWA, security guard or application administrator should not be able to silently add an individual to a resident's family account or grant equivalent access without verified authority and a recorded reason.

Exceptional administrative access, where necessary, should be limited, documented and independently auditable.

4. Least-privilege access

A person who only needs visitor-management access should not automatically receive vehicle movement history or unrelated household information.

5. Instant alerts

Every addition, removal, permission change and recovery action should generate a notification to the registered owner.

6. Complete audit trail

The system should record the action, timestamp, account or administrator involved, authorisation method, permission changes and relevant verification outcome.

7. Immediate revocation

Residents must have a simple way to suspend suspicious access and revoke permissions without waiting for a lengthy support process.

These safeguards should apply to MyGate, NoBroker and other comparable residential platforms, irrespective of the company's size or market position.

7. Immediate Corrective Action Required in This Incident

The following actions should be initiated without delay.

Action 1 — Secure the account

• Review the family-member list and all assigned permissions.
• Revoke the disputed account's access, subject to preserving evidence.
• Change the resident account password or PIN, if applicable.
• Review active sessions and other linked devices.
• Notify society security that disputed digital approvals should not be treated as independent proof of the owner's consent.

Action 2 — Preserve the evidence

The company and the RWA should preserve relevant logs before making changes that could destroy evidence.

Request records showing:

• The date and time the person was added.
• The identity or account that initiated the addition.
• Whether the action originated from a resident account, administrator account, support team or another workflow.
• The verification method used, including OTP generation and validation records, where applicable.
• The permission set assigned to the person.
• Notifications and account changes generated by the system.
• Relevant login, device and session records, to the extent available and lawfully disclosable.
• Whether the disputed account accessed, viewed, approved or changed any records.

Request that evidence be preserved in its original form and that the company provide a written incident reference number.

Action 3 — Obtain a written explanation

The app provider should explain the actual mechanism through which access was granted, identify any control failure and confirm the corrective measures taken.

Sensitive information relating to another person should be handled through an appropriate, lawful process; the resident should receive the information necessary to understand and challenge access to their own account.

Action 4 — Escalate if the explanation is inadequate

Depending on the evidence and the nature of the failure, the resident may approach:

• The app provider's grievance or security team.
• The RWA or society management committee.
• The National Cyber Crime Reporting Portal at cybercrime.gov.in.
• The local police or cybercrime police station where a suspected offence needs investigation.
• The relevant consumer commission, if a consumer-law remedy is available.
• The appropriate data-protection authority once the relevant statutory provisions and complaint mechanism are operative.

For urgent financial cyber fraud, India's cybercrime helpline is 1930. A residential account-access incident should also be reported through the appropriate police or cybercrime channel if the facts warrant it.

8. A Formal Demand to MyGate, NoBroker and All Similar Platforms

I call upon all residential application providers and RWAs to adopt the following minimum principles:

1. No family member should be added without verified owner authorisation or independently established legal authority.
2. High-risk additions should require OTP-based verification and explicit consent.
3. RWA and administrator access must be role-based and auditable.
4. Residents should receive immediate alerts for every sensitive permission change.
5. Audit logs must be preserved when an unauthorised-access complaint is received.
6. Complaints must receive a written response with a clear investigation outcome.
7. Any confirmed security vulnerability should be corrected and affected residents informed as appropriate.
8. Companies must provide an accessible process to report, challenge and revoke unauthorised access.
9. Regulators should consider proportionate but substantial penalties for proven, serious or repeated security failures.
10. The law should be strengthened to ensure that the cost of weak security does not fall entirely on residents.

9. Message for Residents and RWAs

Dear Residents and RWA Members,

Please review the family-member and access permissions linked to your flat in MyGate, NoBroker or any similar application.

If you find an unfamiliar account, document the details, secure your account and raise a written complaint. Do not assume that an unfamiliar name necessarily proves malicious activity, but do not ignore unexplained access either.

The RWA should seek a documented explanation from the app provider and confirm that no person can receive sensitive residential notifications without appropriate authorisation.

Digital convenience must never come at the cost of residential privacy and physical security.

Conclusion: Secure the Digital Gate to Every Home

A physical gate is only one layer of residential security. In a digitally connected society, the application controlling entry approvals, visitor information and household notifications is also part of the security infrastructure.

If access to a home-related digital account can be granted without the owner's knowledge, the system needs immediate scrutiny.

The solution is clear: verified consent, strong authentication, least-privilege permissions, immutable audit trails, rapid incident response and meaningful legal accountability.

India's digital governance framework must ensure that technology companies and society administrators remain accountable for the access they grant and the security controls they operate.

The principle should be simple: No verified authorisation, no access. No unexplained account addition, no closure of the complaint without an audit.

Disclaimer: This article provides general public-interest information and policy recommendations, not a legal opinion on the liability of any specific company or individual. The proposed 10% turnover penalty is a recommendation for legal reform. Actual legal remedies depend on the evidence, the applicable law and the relevant commencement dates.

---

Title: Unauthorised Access in MyGate & NoBroker: Privacy Laws, Cybercrime and Proposed 10% Penalty

Description: Can someone be added to your society app without consent? Explore India's IT Act, BNS, DPDP Act, cybercrime complaints, OTP safeguards and a proposed 10% turnover penalty for serious security failures.

Keywords: MyGate unauthorised access, NoBroker privacy issue, society app security, residential app surveillance, family member added without OTP, RWA app security, India IT Act 2000, BNS cybercrime, DPDP Act 2023, unauthorised visitor approval, vehicle movement data privacy, cybercrime complaint India, data protection reform India.

Labels: Digital Privacy, Cyber Security, MyGate, NoBroker, RWA, Consumer Rights, India Policy Reform, Data Protection