Quick Answer
Hotels, resorts, and hospitality chains collect personal data including passport details, payment information, health requirements, and guest preferences. Under the DPDP Act 2023, hospitality companies must obtain consent before collecting non-essential data, define retention periods for guest records, and ensure third-party booking platforms sign DPAs. CCTV footage and access control data of guests and staff also falls under DPDP Act obligations.
Quick AnswerHotels must collect only what is legally required for check-in (e.g., Aadhaar/passport as mandated by police regulations), obtain separate consent for marketing, and delete guest data within defined retention periods.
DPDP Compliance Checklist
- Separate mandatory data collection (police regulations) from voluntary marketing data
- Obtain explicit opt-in consent before adding guests to email/WhatsApp marketing lists
- Implement secure storage for passport and national ID copies — encrypt at rest
- Restrict access to guest data: only front desk, reservations, and security should have access
- Publish privacy notice on booking confirmation and website
- Allow guests to opt out of loyalty program data profiling at any time
- Review third-party OTA (online travel agency) data-sharing agreements for DPDP compliance
- Train front desk and reservations staff on data handling and guest data requests
- Implement data retention policy: delete guest data within 2 years of last stay (unless legally mandated longer)
- Conduct annual DPDP readiness review covering PMS, CRM, and loyalty systems
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Do hotels need to collect Aadhaar from guests?+
Hotels must comply with local police regulations requiring guest registration. However, storing Aadhaar beyond this legal requirement is not permitted without explicit guest consent.
Can hotels share guest data with partner brands?+
Only with explicit guest consent. Sharing data with airline loyalty programs, restaurant chains, or advertisers without consent violates DPDP Act 2023.
What is the retention period for hotel guest data?+
DPDP requires data retention only as long as necessary. Best practice: 2 years post-stay for CRM, 7 years for financial records, immediate deletion for copies of identity documents.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
