Hotels, Homestays and Restaurants: A DPDP Act Impact Study

Executive summary

A guest checking into a resort hands over an identity document, a card and a phone number. A foreign guest's passport and visa details go to the immigration authorities within 24 hours. Cameras record her in the lobby, the Wi-Fi network logs her phone, the spa asks about her blood pressure, and a restaurant may receive her number from a delivery app.

From 13 May 2027 the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 govern all of it. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor handles data on a fiduciary's behalf.

Headline rating: Overall impact High. Five of the twelve areas in the Trayambic scorecard below are rated High for a typical hotel, homestay operator, short-stay platform, restaurant or club.

The three biggest changes:

• Identity collection must shrink to what the law asks for. Foreign guests are reported in Form III under the Immigration and Foreigners Rules, 2025, which replaced Form C. For Indian guests, the duty usually comes from local police orders. The instruments reviewed here ask for verification, not Aadhaar photocopies.
• Old archives become liabilities. Scanned IDs, months of CCTV and years of Wi-Fi logs each need a lawful reason and a deletion date.
• The technology stack becomes the hotel's liability. Section 8(1) makes a fiduciary answerable for its processors "irrespective of any agreement to the contrary", from property management systems to camera vendors.

One boundary helps small operators: the Act covers digital personal data, including paper records later digitised. A paper register is outside it until scanned or photographed.

Background

Four business models share the sector:

• Hotels and resorts. A branded hotel often has three parties: an owner, an operator under a management contract, and a brand under a franchise. Each may hold guest data for its own purposes.
• Homestays and short-stay platforms. Hosts list rooms or homes on platforms that take bookings and pass guest details to the host.
• Restaurants and cloud kitchens, taking reservations directly or through apps and selling through delivery aggregators.
• Clubs, holding data on members, families, guests and staff, and running gyms, pools and events.

The data principals are guests and accompanying guests, children, foreign nationals, diners, loyalty members, club members and their families, and visitors. The data includes identity documents, passport and visa details, contact and payment details, stay history, preferences, allergies, spa health forms, valet vehicle numbers, CCTV and Wi-Fi logs.

The vendors include property management systems, channel managers, booking engines, travel agencies, payment providers, Wi-Fi providers, camera vendors, loyalty and messaging platforms, reservation apps and delivery aggregators.

Legal framework

The DPDP provisions that matter most

• Reach (s.3; s.17(1)(d)). The Act covers digital personal data processed in India, whatever the guest's nationality. An Indian back office serving a foreign hotel group's overseas properties under contract is relieved of most duties except security safeguards.
• Grounds (ss.4, 6, 7; Rule 3). Consent, backed by an itemised notice and as easy to withdraw as to give, or a listed legitimate use: s.7(a) for data a person "has voluntarily provided" for a specified purpose; s.7(d) for obligations under Indian law to disclose information to the State; s.7(e) for compliance with an order issued under any law. There is no "legitimate interests" ground.
• Children (s.9; Rule 10). Verifiable parental consent for anyone under 18; no tracking, behavioural monitoring or targeted advertising directed at children.
• Fiduciary duties (s.8; Rules 6–8, 14). Responsibility for processors, security safeguards, breach notice to each affected person and the Data Protection Board with a detailed report within 72 hours, erasure when the purpose ends, and grievances answered within 90 days.
• Platforms (Third Schedule). E-commerce entities with at least two crore registered users erase data after three years without engagement. Marketplace sellers are excluded, so the clock is the platform's, not the host's.

Sector law that applies alongside

• Immigration and Foreigners Act, 2025 (Act 13 of 2025). Section 8 makes the "keeper of accommodation" report foreign guests to the Registration Officer; non-commercial homes are excluded unless the civil authority directs otherwise. Contraventions can attract up to three years' imprisonment, a ₹3 lakh fine, or both (s.23(b)).
• Immigration and Foreigners Rules, 2025 (G.S.R. 596(E), in force since 1 September 2025), superseding the Registration of Foreigners Rules, 1992. Rule 17 requires keepers to record each foreign guest's particulars, including Overseas Citizen of India cardholders, keep them electronically for at least a year, and transmit Form III within 24 hours of arrival and of departure. Records are open to the Registration Officer, the District Magistrate and police not below head constable. "Accommodation" includes home stays, rented accommodation, paying guest houses, clubs and tents.
• Local police orders under s.163 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS). The South Goa District Magistrate's order in force from 16 July 2024, for 60 days, required hotels and guest houses to verify guests' identity documents and enter their details in the police's PATHIK software.
• Aadhaar (Authentication and Offline Verification) Regulations, 2021. Regulation 14A(1)(b) bars an entity doing offline verification from collecting, using or storing the Aadhaar number or biometrics. As amended in 2025, the Regulations let UIDAI register offline verification seeking entities; UIDAI's page for them lists hospitality and tourism first.
• Telangana Public Safety (Measures) Enforcement Act, 2013 (Act 6 of 2013): establishments where 100 or more people may gather must install CCTV, store footage for 30 days and give it to the police on request.
• Public Wi-Fi rules. The Department of Telecommunications (DoT) direction of 23 February 2009 (No. 820-1/2008-DS PUI) covers hotspots at hotels and restaurants: users are registered by keeping a photo ID copy, or by SMS login with the mobile number kept, for one year. Under PM-WANI, the aggregator keeps user data for a year, in India; DoT Circular 1/PM-WANI/2026 of 22 May 2026 adds QR login for second devices.
• CERT-In Directions of 28 April 2022: incidents reported within six hours; logs kept in India for 180 days.
• Consumer and tax law. The Consumer Protection (E-Commerce) Rules, 2020 bind booking sites (grievance officer; no pre-ticked boxes). Disclosing a consumer's personal information given in confidence, other than in accordance with law, is an unfair trade practice (Consumer Protection Act, 2019, s.2(47)(ix)). Invoices are kept for 72 months after the annual return's due date (CGST Act, s.36).
• The 2011 SPDI Rules (G.S.R. 313(E)) treat health, biometric and card data as sensitive and require written consent, until IT Act s.43A is omitted on 13 May 2027.

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other laws; s.38(2) makes it prevail in a conflict. Reporting foreign guests falls within s.7(d), and the one-year record within the s.8(7) exception for retention required by law. Police orders in force fit s.7(e). Section 16(2) preserves stricter localisation rules such as PM-WANI's, although no country is restricted under s.16(1).

The dates

Consent manager provisions commence on 13 November 2026; the main duties, rights and penalties on 13 May 2027. As of October 2026 no compression of this timeline had been notified and no Board appointments announced.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Check-in: collect what the law asks for

Front desks collect more than any law requires. Sort what you take into three lanes:

• Foreign guests. Form III asks for name, nationality, passport and visa or OCI number, arrival and departure details and purpose of visit, with a photograph. It does not ask for a passport photocopy. Keep the electronic record for at least a year, as rule 17 requires, and then delete it unless another law needs it.
• Indian guests. The duty to verify identity comes from local orders, which differ by district and are short-lived by design: the South Goa order ran for 60 days. Track the order in force for each property. Where none applies, identity checks rest on s.7(a): the guest shows a document to get a room, which supports a check, not a copy.
• Aadhaar. Do not photocopy or scan Aadhaar cards. Regulation 14A(1)(b) bars an entity doing offline verification from storing the Aadhaar number. Use QR-code or app-based verification, or accept another document. Trayambic's article on background checks and employee monitoring covers Aadhaar offline verification in more detail.

Accompanying guests are the gap. A booker who lists a spouse and two colleagues provided their data; they did not. Where a local order requires each adult's identity, s.7(e) covers it; otherwise ask each adult to show a document at check-in and record only the document type and last digits.

Short-stay hosts carry the same duties. "Accommodation" includes home stays and rented accommodation, so a host renting a flat to a foreign guest must file Form III within 24 hours. Platforms should give hosts only what the stay needs and leave masking of contact numbers on by default. Trayambic's impact study on e-commerce covers the platform side of the fiduciary map.

Cameras and Wi-Fi: the logs nobody reads

CCTV is the hardest ground question in hospitality, because the DPDP Act has no "legitimate interests" ground. Where a state law requires cameras, such as Telangana's for venues of 100 or more people, recording and producing footage for the police is tied to a legal duty and its disclosure falls within s.7(d). Elsewhere, a sign at the entrance gives notice but is a weak basis for consent, which must be a clear affirmative act. Until the Board gives guidance, the defensible posture is narrow: cameras only in public and security areas, never in rooms, spa cabins or changing areas; signage that meets Rule 3; footage kept for a fixed, short period such as Telangana's 30 days; and access logged and limited.

Wi-Fi brings telecom rules into the lobby. Of the two registration options in the 2009 DoT direction, choose SMS login: it avoids another stack of ID copies. Where the hotel joins PM-WANI as a public data office, the aggregator keeps user data, so the hotel should not run a parallel log. Keep the logs the hotel does hold for the longest period a rule requires, then delete them.

Loyalty, platforms and the aggregator wall

Loyalty and marketing. A stay supports s.7(a) processing for that stay. Loyalty enrolment, festival offers on WhatsApp and sharing with brand partners are new purposes needing consent and a Rule 3 notice. In a branded hotel, the brand usually runs the loyalty programme and the operator the property systems; contracts should say so.

Restaurants and delivery aggregators. Where a platform passes on a customer's number with consent, the restaurant becomes a fiduciary in its own right. It needs its own notice, its own grounds for marketing, and a withdrawal route as easy as the opt-in. A prompt telling customers their choice cannot be undone would not survive s.6(4).

Reservations. A diner's number supports her booking; her allergy notes support a safe meal, not a marketing segment.

Clubs hold the richest family data in the sector: spouses, children, guests, gym assessments and membership decisions. Section 8(3) requires accurate, complete data where a decision affects the person, as admission and disciplinary records do.

Spa, wellness and guests' children

Spa intake forms ask about pregnancy, heart conditions, medication and allergies. Until 13 May 2027 that is sensitive data under the 2011 SPDI Rules, which require written consent. After that, s.7(a) supports using it for a safe treatment. It does not support a "wellness" marketing segment built from guests' conditions. Keep intake forms in a separate, restricted system and delete them after a set period.

Children appear everywhere: family bookings, kids' clubs, pool and play-area cameras, birthday offers and photographs. Form III applies to every foreigner, including children. Three rules apply:

• Parental consent. The booking adult can be verified as an identifiable adult from details already held, under Rule 10, for any processing beyond the stay itself.
• No targeting. Section 9(3) bars targeted advertising directed at children; addressing offers to parents is safer.
• Kids' clubs are not crèches by default. The Fourth Schedule exempts crèches and child day-care centres for safety purposes. A resort's activity club may or may not be one; do not assume the exemption, and take parental consent for registers, photographs and allergy notes.

Worked example (illustrative): a 90-room beach resort

Consider a family-owned 90-room resort, run by an Indian hotel company under a national brand, with a spa, two restaurants and a kids' club. The front desk scans guests' Aadhaar cards into a shared drive, cameras keep 90 days of footage, and Wi-Fi uses printed vouchers.

Check-in. Foreign guests move to Form III with no passport photocopies. Indian guests' Aadhaar cards are verified by QR code, not scanned. The legacy drive of ID scans is reviewed against the current police order and Form III retention, then deleted.

CCTV and Wi-Fi. Footage drops to 30 days, cameras near the spa are re-angled away from treatment rooms, and Wi-Fi moves to SMS login.

Roles. The brand is a fiduciary for its loyalty programme, the operating company for property systems and marketing, and the owner, which sees only revenue reports, for very little. The agreements are amended to say so, with breach notice and deletion duties.

A breach. A former front-office employee's account, never disabled, is used to download 18,000 guest records from the property management system. The operator tells each affected guest and the Board without delay, sends the Board a detailed report within 72 hours, and reports to CERT-In within six hours. Disabling leavers' accounts the day they leave would have prevented it.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: Form III compliance; stop Aadhaar copies; map data and contracts; track local police orders.
• January to March 2027: purge legacy scans; reset CCTV and Wi-Fi; new notices and consents; vendor and management contract amendments.
• April to May 2027: kids' club consents; test breach and rights workflows; train front office, spa and restaurant staff.
• Ongoing: track reissued police orders; disable leavers' access on the day; audit vendors yearly.

Recommendations

1. 1.Collect identity data in three lanes, foreign guests, local orders and everything else, and keep copies only where a law requires them.
2. 2.End Aadhaar photocopying now; verify by QR code or app and never store the number.
3. 3.Give every record a deletion date: Form III data after a year, CCTV within weeks, Wi-Fi logs after the legal minimum, ID scans as soon as their purpose ends.
4. 4.Write the owner, operator and brand split into contracts, including who notifies a breach.
5. 5.Treat health notes from the spa and allergy notes from restaurants as single-purpose data.
6. 6.Keep children out of targeted offers, and take parental consent for kids' club records and photographs.
7. 7.Make any data you receive from a delivery or booking platform subject to your own notice and an easy opt-out.

Key takeaways

• Form C is gone: the Immigration and Foreigners Rules, 2025 require Form III within 24 hours of a foreign guest's arrival and departure, including homestays and rented flats.
• None of the instruments reviewed requires an Aadhaar photocopy at check-in; verify by QR code or app and never store the Aadhaar number.
• CCTV has no easy ground under the DPDP Act; keep cameras to public areas, signpost them and delete footage within weeks.
• Owner, operator and brand each hold guest data; contracts must say who is the fiduciary and who notifies a breach.
• Restaurants that receive customer numbers from delivery platforms become fiduciaries and must offer an easy way to withdraw.