DPDP by sector
Draft. Awaiting approval.
DPDP for hotels and travel businesses
A hotel or travel business that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Bookings, guest check in with ID, payments, travel bookings for guests.
Where personal data sits
- Front desk (check in register and ID copies)
- Booking phone
- Bookings from travel sites
- CCTV
What Fohrkast maps
- Guest name
- Mobile number
- Email address
- Address
- ID collected at check in
- Bills and payment details
- CCTV footage
- Staff names, phone numbers and salary records
Each use of the data is recorded as a purpose:
- Bookings and stay. Take the booking, check the guest in and handle the stay.
- Bills and payments. Make the bill and record the payment.
- Offers and festive packages. Send offers on stays and packages.
Which duties weigh most
- Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
- Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
- Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
- Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).
Sector rules
The sector regulator's rules for a hotel or travel business: not set.
A short case
Case: not set. Figures: not set. Customers: not set.
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.
Next
- Privacy Check: a look at the website's notices, trackers and forms.
- Plans and prices in INR.
- Book a demo.
Not legal advice.