Identity documents
Collect identity documents only as required, store copies in one protected system, and delete them on schedule.
Hotels and hospitality
Every check-in collects identity documents and personal details. The DPDP Act expects you to protect them.
Hotels hold bookings, identity document copies, payment details, preferences, loyalty profiles and CCTV footage, shared with booking platforms, brands and authorities. vDPO helps you map it, secure it and keep only what you need.
The DPDP Act
What it means for hotels
The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 apply to every organisation that processes digital personal data in India. These are the areas that need the most attention in this sector.
Notice and consent at booking
Guests must be told what is collected and why. Marketing and loyalty consent must be separate from the booking or registration card.
Reporting to authorities
Reporting guests to the authorities as the law requires is a legitimate use. Share only what is required, through the official channel.
Front office privacy
Do not confirm stays or give out room numbers without permission. Individual logins make misuse traceable.
Brands and booking platforms
Guest data flows to booking platforms, brand systems and partners, often abroad. Record each flow and put contracts in place.
Breaches and fraud
A breach must be reported to the Data Protection Board of India and the guests affected, with a detailed report within 72 hours.
vDPO
What vDPO gives hotels
Start with the free gap analysis. A client workspace then turns the gaps into an inventory, notices, assessments and registers you can keep up to date.
Gap analysis
Answer 35 questions written for hotels and get a score, the gaps found and the corrective action for each. Free, with no login.
Start gap analysisPersonal data inventory
Start from a list of the activities, systems and recipients typical of hotels, then confirm or edit each one.
Privacy notice and retention schedule
A plain-language privacy notice for each group of people, and a retention schedule, written from the inventory.
Data Protection Impact Assessments
Assess new systems and uses of personal data, with questions for hotels alongside the standard ones.
Risk register
Turn gap analysis answers into risks, and add the risks hotels commonly face as a starting list.
Breaches, requests and grievances
A breach register with the 72-hour countdown and draft notices, and a log of requests and grievances with their due dates.
What the DPDP Act Means for Hotels
Identity documents, booking consent, reporting to authorities, front office privacy and booking platforms: the DPDP Act for hotels and hospitality.
Read the article