Airlines, Airports and Travel: A DPDP Act Impact Study

Executive summary

A domestic flight booked on a travel app passes the traveller's data through the app, a global distribution system (GDS), the airline's reservation platform, a payment chain and the airport. An international flight adds two government systems that receive the booking days ahead. With Digi Yatra, her face is matched at the gate too.

From 13 May 2027 the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 govern each step. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor handles data on a fiduciary's behalf.

Headline rating: Overall impact High. Six of the twelve areas in the Trayambic scorecard below are rated High for a typical airline, airport operator, online travel agency (OTA), tour operator or travel management company (TMC).

The three biggest changes:

• The booker is rarely the only traveller. Parents, assistants and corporate travel desks supply other people's names, dates of birth and passport numbers. Every use beyond the journey needs a ground the co-traveller can see.
• Data owed to the State needs its own lane. Customs and the immigration authorities receive booking and passport data under Indian law, which the Act accommodates. Foreign governments' demands, marketing and analytics do not ride on that ground.
• The distribution chain becomes the seller's liability. Section 8(1) makes a fiduciary answerable for its processors "irrespective of any agreement to the contrary": GDS providers, ground handlers, call centres, visa partners and biometric gate vendors included.

The Directorate General of Civil Aviation (DGCA), the Bureau of Civil Aviation Security (BCAS), Customs and the immigration authorities still decide what must be collected and shared; the DPDP Act decides how it is explained, protected and erased.

Background

Five business models share the sector:

• Airlines: reservations, check-in, frequent flyer programmes, call centres and refund desks.
• Airport operators: terminals, lounges, retail, Digi Yatra gates and entry permits for thousands of workers.
• Online travel agencies (OTAs): flights, hotels, visas and insurance sold through apps and websites.
• Tour operators: packaged travel, often with passport scans for visas and dietary or medical details.
• Travel management companies (TMCs): bookings for employers under a travel policy, with stored traveller profiles.

The data principals include bookers, co-travellers, children and infants, persons with disability and their escorts, loyalty members, corporate travellers, airport visitors and permit-holding staff. The data runs from names, contacts and dates of birth to passport and visa details, payment tokens, itineraries, special service requests for wheelchairs or medical needs, facial images, CCTV and call recordings.

The vendors include GDS and reservation platforms, payment gateways, ground handlers, call centres, visa partners, loyalty partners, advertising tools and biometric gate integrators.

Legal framework

The DPDP provisions that matter most

• Reach (s.3; s.17(1)(d)). The Act covers processing in India and processing abroad connected with offering goods or services to people in India, so a foreign airline selling tickets to Indian residents is caught. An Indian service centre handling non-residents' data under a contract with a foreign client is relieved of most duties, though not security safeguards.
• Grounds (ss.4, 6, 7; Rule 3). Consent, backed by an itemised notice and as easy to withdraw as to give, or a listed legitimate use. Section 7(a) covers data a person "has voluntarily provided" for a specified purpose; s.7(d) covers obligations under Indian law to disclose information to the State. There is no "legitimate interests" ground.
• Children and persons with disability (s.9; Rules 10–11). Verifiable consent of a parent for anyone under 18, and, after the DPDP (Removal of Difficulties) Order, 2026, of the lawful guardian of a person with disability; no tracking, behavioural monitoring or targeted advertising directed at children.
• Fiduciary duties (s.8; Rules 6–8, 14). Responsibility for processors; accuracy where data drives a decision or goes to another fiduciary; security safeguards; breach notice to each affected person and the Data Protection Board, with a detailed report within 72 hours; erasure when the purpose ends; and grievances answered within 90 days.
• Significant Data Fiduciaries (s.10; Rule 13). A designated Significant Data Fiduciary (SDF) needs an India-based Data Protection Officer, an independent data auditor and an annual impact assessment.

Sector law that applies alongside

• Immigration and Foreigners Act, 2025 (Act 13 of 2025). Section 17 requires carriers to furnish the manifest, advance passenger information (API) and passenger name record (PNR) data, with penalties up to ₹50,000 (s.18). The Immigration and Foreigners Rules, 2025 (G.S.R. 596(E), in force since 1 September 2025) require API within fifteen minutes of wheels-off from a foreign port, and PNR data at 72, 24 and 8 hours before, and at, scheduled arrival or departure (rule 22(1)).
• Passenger Name Record Information Regulations, 2022 (CBIC Notification 67/2022-Customs (N.T.), 8 August 2022). PNR data must reach the National Customs Targeting Centre-Passenger no later than 24 hours before departure. The 19 listed elements include contact and payment details, frequent flyer data and special service remarks. Customs may not process data revealing religion, health or sexual life (reg. 7(2)), and masks data after five years (reg. 8).
• It replaced the Aircraft Act, 1934, keeps existing rules alive so far as consistent (s.43), and lets the BCAS Director General issue security directions (s.6).
• Aircraft (Security) Rules, 2023 (G.S.R. 596(E), 9 August 2023). Aerodrome entry only for bona fide passengers or permit holders (r.22), background checks for airside staff (r.25), approved security programmes (r.10), and records kept as the Director General specifies (r.57).
• Digi Yatra. The Ministry of Civil Aviation's Biometric Boarding System policy (version 7.8, 4 March 2021) and DGCA Aeronautical Information Circular 09/2022 (18 April 2022); launched on 1 December 2022.
• Consumer Protection (E-Commerce) Rules, 2020 for OTAs and booking sites: a grievance officer, one-month redress and no pre-ticked boxes (rules 4(4), 4(5), 4(9)).
• RBI rules: no stored card data after tokenisation; payment system data stored only in India.
• CERT-In Directions of 28 April 2022: incidents reported within six hours; logs kept in India for 180 days.
• The 2011 SPDI Rules (G.S.R. 313(E)), which treat biometric and health data as sensitive and require written consent, until IT Act s.43A is omitted on 13 May 2027.

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other laws; s.38(2) makes it prevail in a conflict. Most sector duties fit inside it: State disclosures fall within s.7(d), and mandated retention within the s.8(7) exception. Section 16(2) preserves stricter transfer rules, so RBI payment-data localisation keeps binding although no country is restricted under s.16(1).

The dates

Consent manager provisions commence on 13 November 2026; the main duties, rights and penalties on 13 May 2027. As of October 2026 no compression of this timeline had been notified and no Board appointments announced.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

One booking, many travellers

Section 7(a) is the natural ground for the core transaction: a traveller who books a seat has voluntarily provided her data to be flown, checked in and refunded. But she is often not the person typing.

A parent books for a family, an assistant for a director, a TMC for a sales team. For children the Act treats the parent as the data principal, which helps. For adult co-travellers, whose data someone else provided, s.7(a) fits awkwardly. Three steps keep the position defensible:

• Confine the data to the journey: carriage, check-in, disruption notices and refunds, never marketing lists or lookalike audiences.
• Give each traveller the notice. Where a co-traveller's own email or phone number is captured, send her the itinerary with a short privacy notice.
• Take marketing consent only from the person herself, at her own login, check-in or loyalty enrolment.

TMCs need a clear fiduciary map. The employer decides who travels and under what policy, so the TMC often acts as its processor; reusing profiles for its own analytics or offers makes it a fiduciary for those purposes.

Data owed to the State: API, PNR and the limits of section 7(d)

International operations now run on two government feeds: PNR data to Customs under the 2022 Regulations, and API and PNR data to the immigration authorities under the 2025 Rules, starting three days before the flight. Both are obligations under Indian law to give information to the State, which s.7(d) covers; the agencies' own use falls largely under the s.17(1)(c) exemption for preventing and investigating offences.

Three points need care:

• Accuracy. Section 8(3) requires completeness and accuracy where data goes to another fiduciary or drives a decision. A misspelt passport number can mean a traveller is stopped; Customs regulation 6 already requires prompt correction.
• Free-text remarks. The Customs schedule includes general remarks and special service requests. Customs may not process health data, yet an agent who types "dialysis patient, needs oxygen" into a booking sends that diagnosis to every system the record touches. Use standard service codes and keep clinical detail in a separate, restricted record.
• Foreign governments. Section 7(d) covers Indian law only. Transmissions to destination states rest on the passenger having provided her data for that journey, with a notice that names them, subject to any Rule 15 requirements.

Foreign airlines sit under both regimes: the Immigration Act binds every carrier serving India, and s.3(b) reaches their processing abroad.

Faces at the gate: Digi Yatra

Digi Yatra is built to minimise central storage. The Ministry told the Rajya Sabha in July 2023 that there is "no central storage of passenger's Personally Identifiable Information": the credential sits encrypted in the passenger's smartphone wallet, is shared with the origin airport for a limited time, and is purged 24 hours after departure. The policy (version 7.8) adds a nuance: the airport system keeps travel data, including the Digi Yatra credential, for 30 days for audit by BCAS or authorised agencies.

The Digi Yatra Foundation is a not-for-profit company under s.8 of the Companies Act, 2013, set up by the Airports Authority of India and airport operators, and says it is outside the RTI Act. Unless the Centre exempts it under s.17(2)(a), the Foundation, the airports and the airlines receiving boarding data carry full fiduciary duties.

Four points follow:

• Voluntariness must be real. The policy calls enrolment "completely voluntary", and s.6(1) consent must be free, so manual lanes must stay usable. In a public interest petition on Digi Yatra (W.P.(PIL) 15 of 2026), the Kerala High Court took the prima facie view in July 2026 that other details may not be necessary for registration if the petitioner has other proof of identity.
• Family enrolment. The policy lets a head of family enrol a spouse, minor children and dependent parents. Children need verifiable parental consent under s.9(1); each adult must consent for herself unless she has a lawful guardian.
• Biometrics stay sensitive until May 2027 under the 2011 SPDI Rules. After that the DPDP Act has no special category, but the security duty and its ₹250 crore ceiling apply.
• Add-ons and marketing profiles need separate, explicit consent.

Special assistance, medical refunds and children

Special service data is health data in all but name. In 2014 the Ministry told Parliament that the DGCA disability CAR barred airlines from insisting on medical certificates or special forms from passengers who need only assistance. Since July 2022 the CAR requires an in-person doctor's examination where an airline believes a passenger's health may deteriorate in flight, with written reasons for any refusal. Collect the need, not the diagnosis.

Restrict them and delete them once the refund closes.

• Guardians. The 2026 Removal of Difficulties Order extends s.9(1) to persons with disability who have a lawful guardian, and Rule 11 requires checking the guardian's appointment. Most travellers with a disability book for themselves; never demand a guardian by default.
• Children. A booking parent can be verified as an identifiable adult from account details under Rule 10. Unaccompanied minor forms hold details of the adults handing over and collecting the child; keep them for the journey and its follow-up only. Children's loyalty accounts must stay out of targeted offers (s.9(3)). The Fourth Schedule exemption for transporting children covers providers engaged by schools, crèches and day-care centres, only for location tracking during travel for safety: a tour operator running a school trip may qualify; an airline's general processing does not.

Worked example (illustrative): an OTA with a corporate travel arm

Consider a mid-size Indian OTA that sells flights, hotels and visa services to consumers, runs a TMC for 150 corporate clients, books through a foreign GDS, uses a visa-processing partner and offers a family loyalty programme.

Fiduciary map. The OTA is a fiduciary for its app and loyalty programme, and mostly the employer's processor for corporate bookings. The GDS and visa partner are its processors.

Passport scans. Keep visa customers' scans until the visa decision and any dispute window, then erase them, keeping only the reference and outcome. Never leave scans in inboxes.

Children. Family profiles hold children's names, dates of birth and passport numbers. The parent account holder gives verifiable consent; offers go to the adult, never personalised to the child.

A breach. The visa partner leaves 40,000 passport scans in a publicly readable storage bucket. The OTA must tell each affected traveller and the Board without delay, send the Board a detailed report within 72 hours, and report to CERT-In within six hours. Section 8(1) keeps the liability with the OTA, so its contract needs hours-level breach notice, audit rights, deletion certificates and an indemnity.

Cross-border. GDS processing abroad is permitted, but the OTA should record each vendor's storage locations in case of a Rule 15 order.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map and vendor register with storage locations; check API and PNR feeds; decide on consent manager support.
• January to March 2027: new notices, co-traveller messages and consent screens; revised vendor contracts; clean up reservation remarks.
• April to May 2027: test rights, breach and refund workflows end to end; switch on deletion jobs; train front-line staff.
• Ongoing: watch for Rule 15 orders, SDF designations and DGCA or BCAS changes; audit key vendors yearly.

Recommendations

1. 1.Treat every passenger on a booking as a data principal: confine co-traveller data to the journey and send each traveller her own notice.
2. 2.Run State disclosures as a separate, documented lane under s.7(d), and do not let that lane carry marketing or analytics.
3. 3.Strip diagnoses out of reservation remarks; record the assistance needed, not the medical condition.
4. 4.Delete passport scans and refund medical evidence once their purpose ends, and prove it with deletion logs.
5. 5.Rewrite GDS, visa, call centre and ground-handling contracts around breach notice in hours, audit rights and deletion.
6. 6.Keep biometric boarding genuinely optional and require each adult to consent for herself.
7. 7.Run a breach drill with your largest vendor before May 2027.

Key takeaways

• Section 7(a) covers the traveller who books; co-travellers' data should be confined to the journey and each traveller sent her own notice.
• API and PNR disclosures to Customs and the immigration authorities fall under s.7(d); foreign-government transmissions and marketing reuse do not.
• Digi Yatra purges facial data 24 hours after departure, but the policy lets airports keep travel data for 30 days for security audit.
• Keep diagnoses out of reservation remarks and delete passport scans and refund medical evidence once their purpose ends.
• A GDS, visa or call-centre vendor's breach is the seller's breach: notify travellers and the Board, and CERT-In within six hours.