Every check-in collects names, addresses, identity documents and payment details. The Digital Personal Data Protection (DPDP) Act expects hotels to protect that data, share it carefully and keep it only as long as needed.
The Act and the Digital Personal Data Protection Rules, 2025 apply to every hotel, resort, serviced apartment and homestay that processes digital personal data in India. Here is what they mean for hospitality.
1. Identity documents
Copies of passports and other identity documents are the most sensitive data most hotels hold, and they are often stored in front desk email, open folders or paper files. Collect documents only as required, store copies in one protected system, mask numbers you do not need, and delete them on schedule.
2. Notice and consent at booking
Guests must be told what is collected and why, at booking and at check-in, in the languages they use. Data given to book a room supports the stay. Marketing, loyalty profiling and partner offers need separate consent: a pre-printed line on the registration card is not enough.
3. Reporting guests to the authorities
Where the law requires hotels to report guest details to the authorities, the Act treats this as a legitimate use. Share only what is required, through the official channel, and keep a record of each disclosure.
4. Front office privacy
Confirming a guest’s stay or giving out a room number to a caller or visitor can put the guest at risk. Set clear front office rules, verify requests, and give every staff member an individual login so access to guest data can be limited and traced.
5. CCTV
Cameras belong in public areas, not private ones. Display notices, restrict access to footage, log every request for it, and set a retention period.
6. Brands, booking platforms and transfers
Guest data flows to online travel agencies, channel managers, brand owners and central reservation systems, many outside India. Record each flow, put contracts with data protection terms in place, and check transfers against the Act’s restrictions.
7. Breaches and fraud
Compromised booking platform and email accounts are used to send guests fake payment requests. Multi-factor sign-in on those accounts helps. A personal data breach must be reported to the Data Protection Board of India and the guests affected, with a detailed report within 72 hours.
A practical starting point
- Move identity document copies into one protected system.
- Separate marketing consent from the registration card.
- Record what the law requires you to report, and share only that.
- Give every staff member an individual login.
- Set retention periods for document copies, CCTV and marketing lists.
- Record every booking platform, brand and vendor that receives guest data.
vDPO’s free DPDP gap analysis for hotels asks 35 questions written for hospitality and gives you a score, the gaps found and the corrective action for each. A client workspace then gives you a guest data inventory to start from, privacy notices, DPIAs, a risk register and a breach register.
This article is general information, not legal advice.