DPDPA 2023 · DPDP Rules 2025
DPDPA Compliance for Hotels & Restaurants
DPDPA compliance for hotels and restaurants handling guest IDs, bookings and loyalty data.
Why this matters in India: Guest ID and payment data make hospitality a frequent breach target; security failures carry up to ₹250 crore.
Overview
Hospitality businesses collect guest identity proofs, contact details, stay history, payment data and loyalty profiles — often retained well beyond the stay.
Does DPDPA apply to you?
DPDPA applies. ID collection at check-in and marketing to past guests are the key compliance pressure points.
Personal data you typically process
- Guest ID proofs
- Booking & stay history
- Contact & payment details
- Loyalty programme profiles
- CCTV footage
Your biggest compliance risks
- ID scans retained indefinitely
- Marketing to guests without consent
- OTA/agent data sharing undocumented
- CCTV without notice or limits
What the DPDP Act requires you to do
- Consent for marketing/loyalty use
- Notice at check-in/booking
- Retention limits for ID and stay data
- Processor contracts with OTAs and PMS vendors
- CCTV signage and retention
Common violations regulators look for
- Promotional messages without consent
- ID photocopies kept for years
- No privacy notice at check-in
Quick wins you can do this week
- Add consent at booking/check-in
- Purge old ID scans on a schedule
- Publish a guest privacy notice
- Document OTA/PMS data sharing
Generate your DPDPA documents free
Don't just read about it — produce a compliant privacy notice, consent notice and grievance page for your hospitality / hotels & restaurants in minutes, and download a Board-ready evidence pack.
Start free — generate my documentsFrequently asked questions
- Can we keep guest ID copies after checkout?
- Only as long as a lawful purpose and any statutory requirement need it — then erase.
- Can we message past guests with offers?
- Only with consent collected for marketing, with an easy opt-out.
Related industries
This page is educational and does not constitute legal advice. It reflects the DPDP Act 2023 and DPDP Rules 2025 as understood at publication.