DPDP Act for Travel, Hotels & Ride-Hailing: Guide
Airlines, hotels, travel agents, booking platforms and ride-hailing apps collect passports and ID cards, payment details, itineraries, preferences and live location. The DPDP Act and Rules apply to all of it, including when partners and systems sit in several countries.
Most of your data comes straight from customers who give it for a booking, which can be used for that stated purpose. The challenges are what happens next: sharing with many partners, legal reporting to authorities, marketing and loyalty programmes, live location, and international data flows. Foreign platforms selling to people in India are covered too. Most duties take effect on 13 May 2027.
Who this covers
Airlines and airports are Data Fiduciaries for passenger and booking data, and share some of it with authorities.
Hotels, resorts and homestays hold guest registers, ID copies, payment details, CCTV and loyalty data.
Online travel agencies and tour operators collect traveller data and pass it to airlines, hotels and insurers.
Ride-hailing, car rental and mobility apps process live location, trip history and driver data.
Booking engines, payment processors and distribution systems are usually Data Processors.
Personal data you are likely to hold
Key provisions for Travel, Hospitality & Mobility
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Data voluntarily provided for a booking, and disclosures to the State that a law requires, are legitimate uses.
Itemised notice and consent for marketing, loyalty profiling and partner sharing.
Security, breach intimation, erasure and written processor contracts.
Bookings for children need care: tracking and targeted ads aimed at children are barred.
Foreign platforms selling to people in India are covered.
Transfers abroad are allowed unless the Central Government restricts a country.
Penalties up to ₹250 crore for security failures.
01Bookings, travellers and partners
A traveller who gives you details to make a booking has provided them for that stated purpose, a legitimate use under Section 7. Sharing the data with the airline, hotel, insurer or car-rental firm that delivers the trip is part of that purpose, provided the notice tells the traveller who the partners are.
Anything beyond it needs consent: marketing, partner upsells, profiling for dynamic offers, and sharing with companies that will use the data for their own purposes. Group and corporate bookings add complexity because the booker is not always the traveller. Pass on the notice and collect only what is needed about companions.
02ID documents, guest registers and reporting to authorities
Airlines, hotels and mobility operators must collect IDs and share information with authorities under immigration, aviation security and local police requirements. Disclosures to the State that a law requires fall within the legal-obligation legitimate use in Section 7, subject to that law.
- Collect only the ID fields and copies the law requires, not photographs of everything.
- Keep them for the legally required time, then erase them under Section 8.
- Store ID scans in a controlled system, not in front-desk email or messaging chats.
03Live location, ride data and CCTV
Ride-hailing, car rental and fleet apps depend on location. Collect it only while it is needed for the trip, explain it in the notice, and keep trip histories only as long as the purpose and law require. Using location for advertising or analytics is a separate purpose. Driver data is also personal data, so notice and safeguards must cover them too.
Hotels and airports use CCTV widely. Put up clear notices, limit who can view footage, and set a retention period.
04Loyalty programmes, marketing and children
Loyalty programmes build rich profiles. Treat profiling and personalised offers as optional uses that need consent, and let members opt out without losing basic benefits. Travel often involves children. Section 9 bars tracking and behavioural advertising aimed at them, and parental consent is needed where you process a child's data for your own purposes.
05International travel, overseas systems and security
Travel data flows across borders constantly. Section 16 allows transfers abroad unless restricted, and Rule 15 keeps that model. Foreign platforms are covered if they sell to people in India (Section 3).
Rule 6 sets safeguards. A breach means telling each affected traveller and the Board, with a detailed report within 72 hours (Rule 7). Airline and hotel breaches typically involve passport numbers and payment data, so plan the communication in advance.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Move them to a controlled system, limit access and set a deletion date. Chat groups are not a safe store.
Name the partners and get separate consent. Do not bundle it with the booking.
Stop collecting when the trip ends unless there is a stated reason, and set a clear retention period for trip history.
Check the request and the law it relies on, and disclose only what it requires.
You remain the fiduciary. Notify affected travellers and the Board, and file the detailed report within 72 hours.
Compliance checklist
Common mistakes to avoid
Keeping ID copies in chat apps and personal email.
Collecting location continuously, not just during the trip.
Sharing traveller data with partner brands under one blanket tick-box.
Keeping loyalty and trip histories forever.
Leaving hotel and agency staff outside privacy training.
Common questions
Do we need consent to collect passport details?
Where a law requires the data, or the traveller provides it voluntarily for the booking, you can use it for that purpose without separate consent. Use beyond that purpose needs consent.
Can we share bookings with hotels and airlines?
Yes, where it is needed to deliver the booking and the notice says so. Sharing for partners' own marketing needs consent.
Does the Act cover foreign travel platforms?
Yes, if they process personal data in connection with offering services to people in India.
How long can hotels keep guest ID copies?
For the period the relevant law requires, and then erase. Do not keep them indefinitely.
Do ride-hailing drivers have rights?
Yes. Drivers are Data Principals, so notice, safeguards and rights apply to their data too.
What if our booking partner has a breach?
You remain responsible as the Data Fiduciary for processing done on your behalf, so your contract with them must require prompt breach notice.