Skin
Free gap analysis · Hotels

DPDP Gap Analysis for Hotels and Hospitality

Measure your hotel’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to hotels, resorts, hotel chains, serviced apartments, homestays, guest houses and other hospitality businesses operating in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the hotel assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the hotel identified when it acts as a Data Fiduciary and when its management company, brand owner, booking platforms and vendors act as Data Fiduciaries or Data Processors?
03 Are data protection responsibilities defined for the front office, reservations, sales and marketing, food and beverage, spa, security, finance and IT?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Guest Data Inventory and Mapping
05 Has the hotel identified the personal data it holds about guests, visitors, corporate clients, employees and other individuals?
06 Has the hotel documented the purposes for processing personal data, including reservations, check-in, billing, security, loyalty, marketing and guest preferences?
07 Has the hotel mapped how guest data flows between booking channels, the property management system, point-of-sale systems, Wi-Fi and central brand systems?
08 Does the hotel maintain an inventory of systems, devices and vendors that store or process personal data?
09 Has the hotel identified personal data shared with booking platforms, the brand owner, travel agents, corporate clients and authorities?
3. Notices and Consent
10 Does the hotel give guests a clear privacy notice at booking and check-in explaining what personal data is processed, why, and how they can exercise their rights?
11 Has the hotel identified which processing relies on consent and which on a legitimate use under the DPDP Act, such as providing the stay or meeting a legal obligation?
12 Is consent for marketing, loyalty profiling and sharing with partners obtained separately, without pre-ticked boxes, and recorded?
13 Can guests withdraw consent and unsubscribe easily, and does the hotel apply it across properties, the brand and partners?
14 Are notices consistent across the booking engine, online travel agencies, Wi-Fi login, spa and restaurant forms and event registrations?
4. Guests, Identity Documents and Security
15 Does the hotel collect and keep copies of guests’ identity documents only to the extent required, and protect them?
16 Has the hotel recorded what guest information it must share with authorities, and does it share only that?
17 Does the front office protect guest privacy, for example by not disclosing room numbers or confirming a guest’s stay to callers?
18 Is CCTV limited to appropriate areas, with footage access restricted and retained only as long as needed?
19 Does the hotel handle children’s data, such as for family stays and kids’ clubs, with verifiable parental consent where required and without targeted marketing?
5. Guest Rights and Retention
20 Can guests obtain a summary of their personal data, correct it and request erasure where the law allows?
21 Does the hotel have a procedure for verifying, tracking and responding to guest requests and grievances?
22 Has the hotel defined retention periods for guest profiles, registration records, identity document copies, billing records, CCTV and marketing lists?
23 Does the hotel securely erase or destroy personal data, including registration cards and paper files, when it is no longer required?
24 Can the hotel implement and verify deletion across its systems, the brand’s systems and Data Processors?
6. Data Security and Breach Management
25 Has the hotel implemented appropriate technical and organisational security safeguards to protect guest data?
26 Do staff use individual logins to the property management and point-of-sale systems, with access limited by role and logged?
27 Does the hotel have documented procedures to detect, investigate, respond to and record personal data breaches?
28 Can the hotel notify affected guests and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, Travel Platforms and Cross-Border Processing
29 Does the hotel assess the data protection practices of vendors such as the property management system, channel manager, Wi-Fi, key card and marketing providers?
30 Do contracts with Data Processors include provisions for data protection, security, breach reporting and deletion?
31 Has the hotel assessed the privacy risks of guest profiling, revenue management, facial recognition or Artificial Intelligence (AI) tools?
32 Has the hotel identified guest data processed or accessed outside India, for example by global brand systems, central reservations or travel platforms, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are front office, reservations, sales, food and beverage, spa and security staff trained on handling guest data?
34 Does the hotel assess privacy risks before introducing new systems, devices or significant changes to processing, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the hotel periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.