DPDP for travel, hotels and hospitality

Travel runs on identity. To sell a flight, a room or a tour you collect names exactly as they appear on a passport, dates of birth, phone numbers, payment details, travel dates and, for international trips, passport and visa data. Then you pass it along a long chain: an OTA to an airline and a hotel, a hotel to the police and to the immigration authorities, an airline to a global distribution system and to customs authorities abroad. Every link in that chain is a place where data can leak or be reused.

The risk sits in three places. First, identity documents collected out of habit rather than law: passport copies on reception desks, Aadhaar photocopies in homestay files, scans in WhatsApp chats with agents. Second, onward sharing that nobody has mapped, including transfers to servers abroad. Third, reuse of booking data for loyalty profiling, partner offers and retargeting. This guide applies the Data Fiduciary playbook to travel and hospitality.

Are you a Data Fiduciary, a processor, or both?

Travel is full of businesses that are fiduciaries for some data and processors for other data. Work it out product by product.

• Online travel agency (OTA): you are a Data Fiduciary for your users: accounts, searches, bookings, reviews and marketing. When you pass a booking to an airline or hotel, the airline or hotel becomes a separate Data Fiduciary for its own use (carrying the passenger, checking in the guest). It is not your processor. Your payment gateway, cloud host, call centre and messaging vendors are your processors.
• Hotel, resort or homestay: you are a Data Fiduciary for guests, including those who booked through an OTA. The guest register, Form C for foreign nationals, the folio, minibar and spa charges, CCTV and your loyalty programme are all yours. Your property management system (PMS), channel manager, booking engine, Wi-Fi provider and CCTV vendor are your processors.
• Hotel chain with franchised or managed properties: decide in writing who is the fiduciary for the central guest profile and loyalty data (usually the brand) and for property-level records (often the owner or operator). Otherwise nobody handles erasure end to end.
• Airline: you are a Data Fiduciary for passengers, frequent flyers and website users. Your GDS, departure control and reservation hosting provider, ground-handling agent and call centre are typically processors. Disclosures to immigration, customs and security agencies in India and abroad are made under legal duties.
• Travel agent or tour operator: you are a Data Fiduciary for your clients. When you book a hotel or flight for them, the supplier becomes a separate fiduciary. Visa facilitation agents, local guides and transport vendors who act on your instructions are your processors.
• Inbound operator or DMC working for an overseas agent: section 17(1)(d) may take the data of people not in India, processed under a contract with a person outside India, out of most of the Act. Sections 8(1) and 8(5) still apply. Once the tourist is in India, the position is less clear. Confirm it with counsel.
• Corporate travel management company: for a client’s employee bookings you usually act as the client’s processor; for your own marketing you are a fiduciary.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Name, mobile, email, account login	Booking engine, OTA or airline account, CRM	Booking, itinerary, updates	Medium	While the account is active, then the inactivity rule or your own limit
Passport number, nationality, date of birth, visa details	Booking records, APIS feeds, PMS, Form C submissions	International travel, immigration reporting	High	As immigration and aviation law require, then erase
Copies of passports, visas and ID cards	Reception scanners, email, WhatsApp, agent files	Check-in, visa processing	High (identity theft)	Avoid keeping copies; if a law requires, keep masked copies for the shortest period
Guest register entries	PMS, paper register at reception	Legal requirement, police checks	Medium to high	As local police or licensing rules require
Travel dates, room and seat, co-travellers	Reservations DB, PMS, departure control	Fulfilment	Medium to high (reveals absence from home, relationships)	Until the stay or trip and any disputes close, plus legal minimums
Payment cards, UPI references, refunds	Payment gateway, PMS folio, refund ledger	Payment, deposits, refunds	High	Card data stays with the gateway; accounting records as tax law requires
Special requests, meal preferences, accessibility needs, medical notes	Booking notes, PMS profile, airline special service requests	Service delivery	High (can reveal health or religion)	Delete after the stay or trip unless the guest asks you to remember
Loyalty and frequent-flyer profiles, points and miles	Loyalty platform, CRM	Rewards, tiers, offers	Medium	While the membership is active; points are virtual tokens
Searches, browsing, device IDs, cookies	Analytics, ad pixels, CDP	Analytics, pricing, retargeting	Medium to high in aggregate	Set short limits
CCTV footage	NVR at property, CCTV vendor cloud	Security, incident investigation	Medium to high	Short rolling period unless an incident or police order needs longer
Wi-Fi logins and logs	Wi-Fi gateway vendor	Guest internet access, legal logging	Medium	As telecom and IT rules require
Reviews, complaints and support calls	Review platforms, helpdesk, telephony vendor	Service recovery, quality	Medium	6–12 months unless a dispute is open
Children’s data (names, ages, passports)	Bookings, PMS, APIS	Family travel	High	Same as the booking; see section 9

Risk hotspots

1. ID copies collected out of habit. Many properties photocopy every guest’s Aadhaar or passport and keep the copies for years. Failure: identity documents leak, are misused by staff, or are kept with no legal ground. Control: record only the fields your legal duty asks for, and accept any government photo ID. If a guest offers Aadhaar, accept a masked Aadhaar or a DigiLocker share. Keep copies only where a law or a written police direction requires it, encrypted, with a deletion date.
2. Form C and foreign national reporting. Accommodation providers must report foreign guests to the immigration authorities online. Failure: passport and visa data stays on reception PCs, in downloads and in email after submission. Control: submit from a controlled account, keep no local copies, restrict passport fields in the PMS, and log access.
3. The booking chain nobody has mapped. An OTA booking can touch a metasearch site, a bed bank, a channel manager, the hotel PMS and a payment provider. Failure: you cannot say who received the data, or make erasure reach everyone. Control: a data-flow map per product, each party marked as fiduciary or processor, and contracts that say so.
4. Transfers abroad. GDS platforms, reservation hosting, CRM and loyalty platforms are often hosted outside India, and international bookings must go to foreign hotels and airlines. Failure: sending data to a country the Government later restricts under section 16(1), or ignoring a stricter sector rule (section 16(2)). Control: a register of every cross-border flow, contracts with security and breach terms, and a plan to re-route if a restriction is notified (rule 15).
5. Loyalty programmes and profiling. Loyalty data reveals where people travel, with whom, and how often. Failure: using stay history for unrelated targeting, or sharing it with partners without consent. Control: consent for profiling and partner offers, separate from membership; a co-brand card bank collects its own consent.
6. CCTV in lobbies, corridors and vehicles. Cameras capture guests, visitors and staff. Failure: cameras where people expect privacy, footage shared on WhatsApp after an incident, or kept for months. Control: signage with a short notice, no cameras where guests undress or sleep, short rolling retention, a log of every export, and a vendor contract.
7. Special requests and health information. Wheelchair, dietary, pregnancy and allergy notes sit in free-text fields every agent can see. Control: structured fields with limited visibility, deletion after the trip, and no reuse for marketing.
8. Agents working on WhatsApp. Agents collect passport scans over WhatsApp and forward them to suppliers. Failure: copies spread across personal phones and groups. Control: a secure upload link, managed devices, and deleting media once the booking is confirmed.
9. Account takeover and loyalty fraud. Points and miles are stolen through weak logins and social engineering of call centres. Control: OTP or passkey login, step-up checks before redemptions or contact changes, and scripts that never read out full passport or card numbers.
10. Shared and family bookings. One person books for a group and provides everyone’s passport data. Failure: co-travellers never get a notice, and their data is reused for marketing. Control: use co-traveller data only for that trip, and send each adult traveller your notice where you have their contact.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Making a booking and issuing tickets or vouchers	7(a): the traveller voluntarily provided data to get the booking	Keep the data set to what the supplier needs.
Passing booking details to the airline, hotel or tour supplier	7(a), where the notice says who receives it	The supplier becomes its own fiduciary for its use.
Guest register and police verification	Retention required by law, where a state or police order requires it	Confirm the requirement for each state where you operate.
Form C and other reporting of foreign nationals	7(d): a legal duty to disclose to the State	Share only the prescribed fields.
Passenger data to immigration, customs and security agencies (APIS, PNR)	7(d) for Indian requirements; foreign legal requirements for international flights	Tell passengers in the notice that this happens.
Booking and stay updates by SMS, WhatsApp and email	7(a)	Transactional only. No promotions in the same message without consent.
Invoices, GST and accounting records	Retention required by law	Keep the minimum; restrict access.
Fraud prevention (chargebacks, fake bookings, stolen cards)	Section 17(1)(c) for preventing offences, otherwise consent	Document the use; do not reuse fraud signals for marketing.
CCTV for security of guests and property	Legal requirement where a police or licensing direction mandates it; otherwise section 17(1)(c) for preventing offences	DPDP has no general “legitimate interests” ground. Confirm the approach with counsel.
Special requests and accessibility needs	7(a) for that trip	Remembering them for future trips needs consent.
Loyalty membership, points and tiers	Consent (joining the programme)	Points are virtual tokens; plan for nomination and erasure.
Personalised offers, retargeting, data shared with ad platforms	Consent	Opt-in only, per channel.
Sharing with partners (insurers, forex, co-brand cards, car rental)	Consent, naming the partner or category	The partner collects its own consent for its product.
Reviews and post-stay surveys	7(a) for a service-feedback request mentioned in the notice; consent to publish with a name or photo	Allow deletion.

Notices and consent: getting the screens right

Channel	Do	Don’t
OTA or airline app and website	Show a short notice at booking that itemises traveller data, who receives it (airline, hotel, authorities) and whether it leaves India. Put marketing opt-ins as separate unticked toggles.	Bundle marketing, partner sharing and profiling into “I agree to the Terms”.
Hotel front desk	Hand or show a one-page notice at check-in, in the guest’s language where you can. Ask only for the fields your legal duty needs.	Photocopy every ID by default or keep copies in a drawer.
Hotel booking engine and direct website	Collect only what the stay needs. Ask for marketing consent on the confirmation page.	Pre-tick “Join our loyalty programme” or “Send me offers”.
Travel agent on WhatsApp or phone	Send a short notice link before asking for passport scans. Use a secure upload link.	Ask clients to send passport photos into group chats.
Call centre	Read a short notice before recording calls. Verify callers before discussing bookings.	Read out full passport or card numbers.
Airport counters and kiosks	Show a notice at the kiosk and in the app. For Digi Yatra or other facial boarding, make clear it is optional and offer the manual route.	Make biometric boarding the only way to fly.
Paper forms (homestays, tour vouchers, waivers)	Print a short notice on the form. Digitise only what you need, then shred the paper on schedule.	Keep old registers and forms in open storage.
Loyalty sign-up	Explain what you track (stays, spend, preferences) and who sees it. Separate membership from profiling and partner offers.	Treat joining the programme as consent to everything.
Existing customers and members	Send a section 5(2) notice by email or in the app with links to manage choices.	Assume old blanket consent covers new purposes.

Each notice must stand on its own, itemise the data and the purposes, describe the goods or services, and link to withdrawal, rights and complaints to the Board (rule 3). Withdrawal must be as easy as giving consent. You must offer the notice in English and the languages of the Eighth Schedule to the Constitution (section 5(3)). For a hotel, start with Hindi and the language of your state; for an OTA or airline, with the languages of your top source markets in India. For foreign guests, an English notice is the practical minimum, and a few major foreign languages help.

Other laws you must line up with

• Immigration and Foreigners Act, 2025 and the rules and orders under it: accommodation providers must report foreign nationals who stay with them (Form C), through the Bureau of Immigration and FRRO portals. Treat this as a disclosure under a legal duty, not as your processor. The Act replaced the Foreigners Act, 1946 and the Registration of Foreigners Act, 1939. Confirm the current requirement with counsel.
• State police and licensing orders on guest registers, ID checks and CCTV: these differ by state and city, and sometimes by district. Collect what they require and no more. Confirm the current requirement with counsel.
• Aadhaar Act, 2016 and UIDAI regulations: you may not insist on Aadhaar where another ID will do, and you must not store full Aadhaar numbers or copies unless permitted. Use masked Aadhaar or offline verification. Confirm the current requirement with counsel.
• DGCA Civil Aviation Requirements and BCAS security rules: passenger data, identity checks and complaint handling for airlines and airports.
• Customs Act, 1962 and the PNR information regulations: airlines share passenger records with Indian customs; foreign governments impose similar rules.
• Consumer Protection Act, 2019, the E-Commerce Rules, 2020 and the dark-patterns guidelines: OTAs are e-commerce entities. Drip pricing, forced add-ons and pre-ticked travel insurance can breach both consumer law and section 6.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents may need to be reported to CERT-In on a much shorter clock than the DPDP 72 hours. Confirm the current requirement with counsel.
• RBI rules on payment data storage and tokenisation: payment system data must be stored in India, and card data stays with tokenised gateways. This is a stricter law under section 16(2).
• FEMA and RBI rules on foreign exchange, and the Income-tax Act: overseas packages and forex involve PAN collection and tax collected at source. Keep those records as long as the law requires.
• GST law: invoices and accounting records override erasure requests for those records only.
• Telecommunications Act, 2023 and TRAI TCCCPR: consent and registration for promotional SMS and calls; rules on logging for guest Wi-Fi. Confirm the current requirement with counsel.

Retention and erasure

1. When the purpose ends (section 8(7)): the trip is over, the stay is checked out, refunds and chargebacks are settled, and any complaint is closed. Stop using the data and erase it, unless a law requires you to keep it. Special requests, ID copies and co-traveller details should go first.
2. The one-year minimum (rule 8(3)): keep the personal data, traffic data and logs of each processing activity for at least one year from the date of processing, for the purposes in the Seventh Schedule, even if the customer deletes the account. After that, erase unless another law requires longer.
3. Legal holds: guest registers, Form C records, tax invoices, forex and TCS records, and aviation records each have their own retention under other laws. Record each hold with the law behind it, the data it covers and the end date. Keep held data away from marketing systems.
4. The Third Schedule three-year rule, for large OTAs: an e-commerce entity with 2 crore or more registered users in India must erase a user’s data three years after the user last approached it for the purpose or exercised a right, or from the Rules’ commencement if that is later (rule 8(1)). At least 48 hours before erasure, tell the user it will happen unless they log in or get in touch (rule 8(2)). Data needed to access the account, and virtual tokens such as wallet balances, travel credits, gift cards and loyalty points, are excluded. A hotel or airline selling on an OTA marketplace is a seller there and is not covered by the OTA’s threshold, but it must still erase when its own purposes end. If it also sells through its own app or website, it may be an e-commerce entity in its own right, so count those registered users separately.
5. CCTV: set a short rolling period and overwrite automatically. Preserve clips only for a logged incident, an insurance claim or a police request.
6. Processors and partners: make your PMS, channel manager, CRM, loyalty platform, call centre and CCTV vendor erase too, and get confirmation. For suppliers who are separate fiduciaries, such as airlines and hotels, pass on withdrawals and erasure requests where your contract allows.
7. Backups: document how long backups keep data and make sure a restore replays erasures.

Rights requests and grievances

• Channels: an in-app or website privacy page, a form, the support chat, an email address, and the front desk for hotels. Publish them with the identifier you need, such as the booking reference, the registered mobile or the loyalty number (rule 14(1)).
• Identity: use an OTP to the registered contact, or match the booking reference with the guest’s name. Do not ask for a passport or ID copy you do not already hold. Never ask for an Aadhaar copy to verify a request.
• Access (section 11): give a summary of profile data, bookings, stays, loyalty activity and marketing preferences. List the other fiduciaries and processors you shared data with: airlines, hotels, tour suppliers, GDS, insurers, partners and ad platforms (if consented). Disclosures made to law enforcement on a written request for preventing or investigating offences need not be listed (section 11(2)).
• Correction (section 12(2)): a misspelt name can stop someone boarding. Correct your records promptly, and explain that a ticket may need reissuing under the airline’s rules.
• Erasure (section 12(3)): erase the account, preferences, saved co-travellers, saved passports and audience memberships. Refuse only what you must keep: guest registers, Form C records, tax and forex records, open disputes and records under legal hold. Tell the person what you kept and why.
• Grievances: acknowledge quickly. Publish a response period well inside the 90-day ceiling in rule 14(3); 15–30 days is good practice. Name the DPO or contact person in every reply (rule 9).
• Nomination (section 14): let members nominate someone. This matters for loyalty points, miles and travel credits after death or incapacity.

Breach readiness

Likely scenarios:

• a reception PC or shared mailbox holding passport scans is compromised
• a channel manager, booking engine or PMS vendor is breached, exposing guests across many hotels
• a misconfigured storage bucket of tickets, vouchers or visa documents
• loyalty account takeovers at scale
• CCTV footage of a guest leaked on social media

Run-book:

1. Contain within hours: revoke credentials, isolate the PMS or booking engine, take exposed storage offline, and ask the vendor for logs.
2. Assess: which data, how many people, and which consequences (identity theft from passport data, fraud from payment data, physical risk from travel dates and room numbers).
3. Notify affected people without delay through their account or registered contact, covering every point in rule 7(1): what happened and when, the likely consequences for them, what you are doing, what they can do (for example, watch for fake “booking change” calls, change their password, ask their bank about card monitoring), and a contact who can answer questions.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)): updated facts, the circumstances and reasons, mitigation, findings about who caused it, steps to prevent a repeat, and a report on the notices sent to people.
5. Report to CERT-In where its directions apply. Inform payment partners if card or payment data may be involved, and airlines, hotels or other suppliers if their customers are affected.
6. Learn: fix the root cause, update vendor contracts, and retrain staff if people were the weak point.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Appoint a DPDP owner and a working group (operations, front office, revenue and distribution, marketing, IT, legal, security).
• [Ops] Map every collection point: website, app, booking engine, OTA feeds, front desk, call centre, WhatsApp, agents, airport counters, paper forms.
• [Eng] Inventory every system holding traveller data: PMS, CRS, channel manager, GDS, CRM, loyalty platform, data warehouse, helpdesk, Wi-Fi gateway, CCTV, backups.
• [Ops] Draw the booking chain for each product and mark each party as fiduciary or processor.
• [Legal] List every place where data leaves India (GDS, hosting, foreign suppliers, overseas CRM) and record the country.
• [Front office] Find every place where ID copies are kept: scanners, reception PCs, shared drives, email, paper files.
• [Legal] Collect the guest register, ID and CCTV requirements for each state and city where you operate.
• [Legal] Document how you submit Form C and other foreign national reports, and where the data goes afterwards.
• [Marketing] List every pixel, tag and SDK on the site and app, and every customer list uploaded to ad platforms.
• [Legal] Collect processor contracts and supplier agreements (hotels, airlines, bed banks, DMCs, visa agents).
• [DPO] If you sell online (as an OTA or through your own app and site), count registered users in India to check the Third Schedule threshold (2 crore or more).
• [Product] Find where children’s data is collected (family bookings, kids’ clubs, school tours).

Phase 2: design and build (days 31–90)

• [Legal] Assign a legal basis to each purpose (use the table above) and stop purposes without one.
• [Legal] Write itemised notices for booking, check-in, loyalty, call centre, CCTV and marketing.
• [Product] Translate notices into Hindi and your top regional languages; make all 22 available on request.
• [Product] Rebuild booking and check-in screens: minimal fields, separate unticked opt-ins for marketing, profiling and partners.
• [Front office] Change the check-in procedure: record only the required fields, accept any government photo ID, and accept masked Aadhaar or DigiLocker.
• [Front office] Stop routine photocopying of ID; where a law requires copies, store them encrypted with a fixed deletion date.
• [Eng] Restrict passport and visa fields in the PMS and booking tools to the roles that need them, and log every view.
• [Ops] Delete local copies after each Form C submission; submit only from a named, controlled account.
• [Eng] Encrypt passport numbers, dates of birth and phone numbers at rest; tokenise payments through the gateway.
• [Eng] Load non-essential tags only after consent; stop session recording on booking and payment pages.
• [Eng] Check consent before every marketing send, audience upload and partner share.
• [Eng] Feed withdrawals in real time to the CRM, loyalty platform, messaging tools and ad-audience sync.
• [Legal] Add DPDP clauses to processor contracts: security, breach notice to you, erasure on instruction, one-year logs, sub-processors, audit, and the hosting country.
• [Legal] Agree with suppliers who is fiduciary for what, and how withdrawals and erasure requests are passed on.
• [Legal] Build a cross-border transfer register and a plan to re-route if the Government restricts a country under section 16(1).
• [Security] Put cameras only in public and back-of-house areas, never in rooms or changing areas; add signage with a short notice.
• [Security] Set CCTV retention to a short rolling period and log every clip exported.
• [Ops] Give travel agents and tour staff a secure upload link and managed devices; ban passport scans in personal WhatsApp groups.
• [CX] Write call-centre scripts that verify callers and never read out full passport or card numbers.
• [Security] Add MFA for admin, PMS, extranet and call-centre consoles, and step-up checks before points redemption or contact changes.
• [Eng] Keep access logs for at least one year.
• [Eng] Build retention jobs: delete special requests and ID copies after checkout, close dormant accounts, apply legal holds for tax and immigration records.
• [Eng] If you are in the Third Schedule, build the three-year inactivity erasure with the 48-hour warning, excluding account access and points, credits and wallet balances.
• [Product] Publish the privacy page: contact person, request channels, identifier needed (booking reference, mobile, loyalty number) and grievance timeline.
• [CX] Set up the rights and grievance workflow with OTP verification, owners and deadlines, including at the front desk.
• [Marketing] Send the section 5(2) notice to existing customers and loyalty members with a link to manage choices.
• [Product] For family bookings, use children’s data only for the trip, and switch off profiling and targeted ads for child travellers.

Phase 3: operate (ongoing)

• [DPO] Review new partners, routes, products, SDKs and campaigns before launch.
• [Front office] Audit reception desks every quarter for stray ID copies, registers and passwords on sticky notes.
• [Legal] Re-check state police orders and immigration reporting rules every year, and when you open in a new state.
• [Marketing] Re-scan site and app tags every month; refresh ad audiences at least weekly so withdrawals take effect.
• [Security] Review CCTV exports and access logs every month.
• [Security] Run a penetration test every year on the booking engine, app, extranet and APIs.
• [Security] Run a breach tabletop drill every year (for example, a channel manager breach) against the 72-hour clock.
• [Ops] Review rights and grievance timelines every month; investigate overdue cases.
• [Legal] Review processor and supplier contracts, and the transfer register, every quarter.
• [HR] Train front office, call-centre and agent staff on ID handling and data requests every year.
• [DPO] Keep evidence: consent records, withdrawal handling, erasure confirmations, training records.
• [Leadership] Re-assess the likelihood of SDF status as bookings and members grow.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Separate booking from marketing and partner offers	Define purposes (booking, itinerary updates, loyalty, personalised offers, partner sharing) once, each tagged consent or legitimate use. The hosted consent page or widget shows each optional purpose as a separate toggle, off by default.	Choosing the moment in the booking journey.
Capture choices at the front desk or on the phone	Record consent captured elsewhere, such as a check-in form or a call, marked as not verified by the guest. Send a QR code at check-in so guests can confirm on their own phone.	Training staff to use it.
Prove consent if a guest complains	Every choice is signed and hash-chained against the exact notice version. The guest gets a receipt, and you can download an evidence pack.
Check consent before every campaign	Call the verify API before sending or uploading an audience; it returns not permitted immediately after a withdrawal.	Wiring it into your CRM and campaign tools.
Make suppliers and vendors stop too	A processor registry links each PMS, CRM, call centre and messaging vendor to purposes and data items. Vendors confirm withdrawals and erasures, and contract expiry dates are flagged.	Signing the contracts and agreeing roles with airlines and hotels.
Offer notices to guests from across India	Notices in English and the 22 Eighth Schedule languages, with machine-translation drafts marked for review.	Reviewing the translations and any foreign-language versions.
Show legal holds honestly	Record retention obligations (guest registers, Form C, tax records) and show them in the notice. The retention job flags data when its period ends.	Deleting rows in your PMS and other systems.
Handle access, correction and erasure	A rights inbox with SLA timers; the guest sees status in their app; erasure closes with a structured proof once processors confirm.	The answers and the ticket reissue rules.
Protect points and miles after death	Nomination and nominee claims.	Your programme rules on transferring points.
Handle child travellers	An age gate and guardian verification through DigiLocker; tracking and ad purposes can never be marked child-safe.	Deciding where children’s data is collected.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices to affected guests, and Board intimation and report documents.	Detecting and investigating.

Not included: myconsentapp is a proposed Consent Manager, not a cookie-banner or tag scanner, a data-discovery tool for your PMS or file shares, or a security programme for your properties. It has no PMS or GDS integration out of the box; you connect it through the API and webhooks. It is not legal advice.

Common mistakes

• Photocopying every guest’s Aadhaar “because the police might ask”, with no written requirement and no deletion date.
• Keeping passport scans in email and WhatsApp long after the visa or ticket was issued.
• Treating the airline or hotel as your processor, or the reverse, so nobody owns erasure or breach notice.
• Assuming GDS and loyalty platforms abroad need no thought because “everyone uses them”.
• Pre-ticking loyalty enrolment, travel insurance or “send me deals” at booking.
• Keeping CCTV footage for months because the recorder has space.
• Using stay and spend history to profile members for partners without consent.
• Leaving full passport and card numbers visible to every call-centre agent.

Frequently asked questions

Do we need consent to share a guest’s passport details for Form C? No. Reporting foreign nationals is a legal duty to disclose to the State, which falls under section 7(d). It is good practice to tell guests that it happens, share only the prescribed fields, and keep the data secure.

Can a hotel insist on an Aadhaar copy at check-in? DPDP does not give you a reason to. Collect what your state or police rules require, accept any valid government photo ID, and if a guest offers Aadhaar, use a masked copy or a DigiLocker share. Do not keep copies unless a law requires it. Confirm the local requirement with counsel.

Our paper guest register is never typed into a computer. Does DPDP apply? The Act applies to personal data collected digitally, or collected on paper and later digitised (section 3(a)). A register that is never digitised falls outside it, but scanning or photographing it brings it in. Most hotels also keep the same data in a PMS, which is covered.

When an OTA sends us a booking, who is responsible for the guest’s data? Both of you, for your own uses. The OTA is the fiduciary for the booking it made. You are the fiduciary for the stay: check-in, the register, the folio and anything you do afterwards. Agree in your contract how withdrawals, erasure requests and breaches are passed between you.

Can we keep sending data to our GDS and hotels abroad? Yes, for now. Rule 15 allows transfers abroad, subject to any requirements the Government sets, and section 16(1) lets it restrict specific countries. Keep a transfer register so you can react, and follow stricter sector rules such as RBI’s payment data localisation.

Is CCTV allowed without consent? DPDP does not have a general legitimate-interests ground, so you need a basis. Where a police or licensing direction requires CCTV, rely on that. Otherwise, section 17(1)(c) for preventing and investigating offences is the usual argument, with signage, short retention and strict access. Confirm the approach with counsel.