A guest books a room online. They provide their name, phone number and email address. At check-in, the hotel may collect additional information. During the stay, the guest connects to Wi-Fi, orders room service, books a spa treatment and makes payments. After checkout, the hotel may still have their booking history, contact details, preferences and other information in its systems. Now consider how many systems may have touched that data. The hotel’s website. Booking engine. PMS. Front desk. OTA connections. CRM. Wi-Fi system. POS. Payment provider. Email platform. This raises an important question for every hotel and resort in India: How should guest data be collected, used, stored and protected under India’s data protection law? The Digital Personal Data Protection Act, 2023, commonly known as the DPDP Act, establishes India’s legal framework for processing digital personal data. The Act received Presidential assent on August 11, 2023. The Government later notified the Digital Personal Data Protection Rules, 2025 on November 13, 2025. The Rules provide additional details on how several provisions under the Act are to operate. For hotels, the issue is not limited to the IT department. Guest data is part of everyday hotel operations. From reservations and check-in to marketing and guest loyalty, personal data can move through almost every stage of the guest journey. This guide explains the DPDP Act 2023, the DPDP Rules 2025, the phased implementation timeline, key requirements for hotels and resorts, and how hotel technology such as Hotelogix can support the operational side of data protection. Important: This article is for educational purposes and is not legal advice. Hotels should consult qualified legal or privacy professionals about their specific processing activities and obligations. Read Also – Hotel Data Privacy: A Practical Guide to Protecting Guest Data in 2027 What Is the DPDP Act? The Digital Personal Data Protection Act, 2023 is India’s law governing the processing of digital personal data within the scope defined by the Act. It establishes a framework around: Processing of personal data Consent Responsibilities of Data Fiduciaries Rights of Data Principals Children’s personal data Data security Personal data breaches Significant Data Fiduciaries The Data Protection Board Financial penalties The Act is designed to balance an individual’s right to protect their personal data with the need for organizations to process personal data for lawful purposes. What Does DPDP Act Stand For? DPDP stands for Digital Personal Data Protection. The full name of the law is the Digital Personal Data Protection Act, 2023. Who Is a Data Principal? A Data Principal is the individual to whom personal data relates. For hotels, this can include a guest whose personal information the hotel processes. Who Is a Data Fiduciary? A Data Fiduciary is a person who determines the purpose and means of processing personal data. A hotel may fall into this role when it decides why and how guest data is processed. Who Is a Data Processor? A Data Processor processes personal data on behalf of a Data Fiduciary. For example, a hotel may use technology providers or other service providers to process personal data on its behalf. The actual legal role of each organization depends on the specific processing arrangement, not simply on whether it is called a PMS, OTA, CRM or another type of provider. Read Also – Hotel Data Security: How to Protect Guest Data in 2027 DPDP Act 2023 vs DPDP Rules 2025: What’s the Difference? The DPDP Act 2023 and DPDP Rules 2025 work together, but they serve different purposes. DPDP Act 2023 The Act establishes the broader legal framework, including: Consent Data Fiduciary obligations Data Principal rights Children’s data Significant Data Fiduciaries Personal data breaches Data Protection Board Penalties DPDP Rules 2025 The Rules provide additional operational details around several requirements. They cover areas including: Privacy notices Consent mechanisms Security safeguards Personal data breach notifications Certain retention and erasure requirements Children’s personal data Significant Data Fiduciary obligations Contact information and other operational requirements The Government notified the Digital Personal Data Protection Rules, 2025 on November 13, 2025. Importantly, the Rules do not all take effect at the same time. Read Also – Customer Data Platform for Hotels: The complete guide to unified guest data, personalization, and improved guest experience When Does the DPDP Act Apply to Hotels in India? The DPDP Act applies to the processing of digital personal data within India in the circumstances specified by the Act. It can also apply to certain processing outside India where the processing is connected with offering goods or services to Data Principals in India. That makes the law relevant to hotels using digital systems to manage guest information. 💡 Think about a typical hotel journey: Website ↓ Booking Engine ↓ Reservation ↓ PMS ↓ Front Desk ↓ Guest Services ↓ Billing ↓ CRM / Marketing ↓ Post-Stay Communication At each stage, personal data may be collected, accessed or processed. Hotels should therefore ask: What guest data do we collect? Why do we collect it? Who has access to it? Where is it stored? Which vendors receive it? How long do we retain it? What happens if a guest asks us to correct or erase it? What happens if the data is breached? These questions form a practical starting point for a hotel’s DPDP compliance program. Read Also – Preventing phishing attacks in hotels: A shared responsibility between hotels, technology vendors and guests What Personal Data Do Hotels Typically Process? Hotels can process personal data at almost every stage of the guest journey. Reservation Data This may include: Guest name Phone number Email address Booking dates Number of guests Room details Booking preferences Check-In Data Depending on the hotel’s process and applicable requirements, this can include: Identity information Address information Identification document details Guest registration information Hotels should assess what information is actually needed for the relevant purpose rather than collecting information simply because a system allows it. Payment-Related Data Hotels may process information related to: Payments Billing Transactions Refunds The exact data flow will depend on how the hotel and its payment provider handle payment information. Guest Experience Data Hotels may maintain: Guest preferences Service requests Feedback Loyalty information Stay history Marketing Data Marketing systems may contain: Email addresses Phone numbers Communication preferences Consent information Campaign activity This is particularly important because information collected for a reservation should not automatically be treated as blanket permission for every future marketing activity. Wi-Fi and Digital Access Data Hotels may also collect information connected with guest access to digital services, depending on how those systems operate. Want to See Hotelogix in Action Book a Live Demo → Are Hotels Data Fiduciaries Under the DPDP Act? A hotel can be a Data Fiduciary when it determines the purpose and means of processing personal data. For example, a hotel may decide to process guest information to: Manage reservations Provide hotel services Communicate booking information Manage a guest account Meet applicable legal requirements The DPDP Act places obligations on the Data Fiduciary and states that where a Data Processor is engaged for relevant activities, the relationship must be governed by a valid contract. Hotel as Data Fiduciary The hotel determines why and how the personal data is processed. PMS or Technology Provider A technology provider may be a Data Processor when it processes personal data on behalf of the hotel. OTA or Other Vendor The role depends on the actual relationship and processing activity. This distinction is important. A hotel should not assume that using a PMS or another technology provider automatically transfers its legal responsibilities to that provider. Read Also – Hotel Cybersecurity: 15 Practical Ways to Protect Your Hotel From Cyberattacks DPDP Act Compliance Requirements for Hotels and Resorts There is no single checklist that can make every hotel compliant. Hotels need to understand the Act and Rules and then apply the requirements to their own data, systems, people and processes. Here are the major areas hotels should review. 1. Give Guests a Clear Privacy Notice Guests should be able to understand what information the hotel is collecting and why. The DPDP Act requires notice about personal data being processed and the purpose of processing, along with information about exercising applicable rights and making complaints. The 2025 Rules provide additional requirements for notices, including using clear and plain language and providing an itemised description of personal data and the specified purpose. For hotels, a privacy notice may need to cover data collected through: Website Booking forms PMS Mobile applications Loyalty programs Guest Wi-Fi Marketing forms A privacy notice should not be treated as something that exists only on the website. It should reflect the hotel’s actual data practices. 2. Obtain Valid Consent Where Consent Is Required The DPDP Act defines consent as being: Free Specific Informed Unconditional Unambiguous Given through clear affirmative action The consent should relate to personal data necessary for the specified purpose. For hotels, this distinction is important. A guest may provide an email address because they need a booking confirmation. That does not automatically mean the same action should be treated as blanket consent for every promotional campaign. Hotels should identify: Purpose → Data required → Applicable legal basis → Notice/consent → Processing 3. Make Consent Withdrawal Easy Where consent is the basis for processing, Data Principals have the right to withdraw consent. The DPDP framework requires withdrawal to be as easy as giving consent. For hotels, this can affect: Email marketing Promotional SMS WhatsApp campaigns Loyalty communications Promotional offers Personalized marketing Hotels should have a process to record and act on a guest’s withdrawal request across relevant systems. 4. Give Guests a Way to Exercise Their Data Rights The DPDP Act gives Data Principals rights including: Access to information about their personal data and processing Correction Completion Updating Erasure, subject to the Act Grievance redressal Withdrawal of consent where applicable A hotel should have a practical process for handling such requests. For example: “What personal data do you have about me?” “My email address is incorrect.” “Please update my phone number.” “I want my personal data erased.” “I want to raise a privacy complaint.” Erasure does not mean every record must always be deleted immediately. The Act includes circumstances where retention is necessary for the specified purpose or to comply with law. 5. Keep Guest Data Accurate Where Required Hotels often maintain guest profiles for operational reasons. That information can become outdated. A guest may have: A new phone number A new email address A changed address An incorrect name Duplicate profiles The DPDP Act requires Data Fiduciaries to correct inaccurate or misleading personal data, complete incomplete data and update personal data in response to applicable requests. A well-managed guest profile can help hotels handle these updates in a structured way. 6. Protect Personal Data With Appropriate Security Safeguards Security is one of the most important areas for hotel operators. The 2025 Rules require reasonable security safeguards to prevent personal data breaches. The safeguards described in the Rules include measures such as: Encryption Obfuscation Masking Virtual tokens where applicable Access controls Logs Monitoring Review Backups Appropriate contractual provisions with Data Processors Technical and organizational measures For a hotel, data security should not stop at the server. 💡 It should cover the complete data journey. Guest ↓ Website ↓ Booking ↓ PMS ↓ Front Desk ↓ Connected Systems ↓ CRM / Marketing ↓ Third-Party Vendors 7. Control Who Can Access Guest Data Not every employee needs access to every piece of guest information. Hotels should review access according to job responsibilities. For example: Front Desk May need access to: Reservations Guest profiles Arrivals Departures Room information Housekeeping May need access to: Room status Relevant service information Finance May need access to: Billing Financial records Marketing May need access to: Appropriate marketing information Communication preferences A role-based approach can reduce unnecessary access to guest information. 8. Maintain Appropriate Logs and Backups The 2025 Rules recognize safeguards such as logs, monitoring, review and backups as part of reasonable security measures. Logs can help hotels understand relevant system activity. Backups can help maintain availability and continuity when data is compromised. The Rules also prescribe retention of certain personal data and logs for at least one year for the purposes covered by the relevant provision, unless another applicable law requires otherwise. This should not be interpreted as: “Keep every guest record for one year.” Hotels need to distinguish between specific security-log retention requirements and their broader guest-data retention policies. 9. Create a Personal Data Breach Response Process Imagine a hotel discovers that unauthorized access has exposed guest information. What happens next? If nobody knows who should respond, valuable time can be lost. 💡 Hotels should establish a process covering: Detect ↓ Contain ↓ Assess ↓ Document ↓ Notify ↓ Remediate The 2025 Rules require Data Fiduciaries, after becoming aware of a personal data breach, to inform affected Data Principals without delay with specified information about the breach and measures taken or proposed. The Data Fiduciary must also intimate the Data Protection Board without delay. The Rules require detailed information to be provided to the Board within 72 hours of becoming aware of the breach, unless the Board allows a longer period following a written request. This is an important distinction: The 72-hour requirement is not a statement that every aspect of breach response must wait until 72 hours. The initial notification requirement is framed as without delay. 10. Review Data Retention and Deletion Hotels should know: What guest data they have Why they have it Where it is stored Who can access it How long it needs to be retained When it can be deleted Avoid creating one blanket retention period for every type of guest information. Different records can have different purposes and legal requirements. A hotel should build a data-retention schedule that considers: Data type → Purpose → Applicable requirement → Retention period → Deletion process The DPDP Rules also contain specific requirements relating to erasure and retention for certain categories and purposes. 11. Review Contracts With Technology Vendors Hotels work with many external providers. For example: PMS providers Booking engines OTAs CRM platforms Payment providers Wi-Fi providers Email platforms Marketing tools Cloud providers Analytics platforms Hotels should know: What information is shared Why it is shared Who processes it What contractual protections apply How security incidents are handled What happens when the contract ends How data is returned or deleted The DPDP Act requires relevant Data Processor arrangements to be governed by a valid contract. Vendor review should therefore become part of a hotel’s privacy program. 12. Publish an Appropriate Privacy Contact Guests should have a clear way to ask privacy-related questions or raise concerns. The DPDP framework provides for contact information for a Data Protection Officer where applicable or another person authorized to respond to communications concerning Data Principal rights. For a hotel, that could mean clearly publishing an appropriate privacy contact through: Website privacy page Guest communication Booking journey Other appropriate channels The contact details should be kept current. Read Also – Hotel Data Breach: Causes, Examples, Impact and What Hotels Should Do DPDP Act Rules for Hotel Marketing and Guest Communications Marketing is one area where hotels need to be particularly careful. A hotel may send many types of communication. Transactional Communication Examples include: Booking confirmation Payment confirmation Check-in instructions Cancellation confirmation Invoice Stay-related communication Marketing Communication Examples include: Weekend offers Holiday packages Room upgrades Spa promotions Loyalty offers Birthday offers Repeat-stay promotions These activities can involve different purposes and legal considerations. Hotels should therefore avoid treating all communications as one category. Want to See Hotelogix in Action Book a Live Demo → Can Hotels Use Guest Data for Personalized Marketing? Hotels need to identify the purpose and applicable legal basis before using guest information for personalized marketing. The DPDP Act permits processing on the basis of consent or certain legitimate uses specified in the Act. For example: A guest provides an email address to receive information about their reservation. The hotel should not automatically assume that this means the guest has agreed to receive every future promotional campaign. Instead, hotels should ask: Why are we using this information? What information are we using? What notice was provided? Is consent required? Has consent been withdrawn? Who else receives the information? How long is the information retained? This approach becomes especially important when guest information is shared between a PMS, CRM, marketing platform and other systems. Read Also – GST Rate On Hotel Rooms in India: GST Slab Rates From 12% to 5% [2026] DPDP Act Requirements for Children Staying at Hotels The DPDP Act defines a child as an individual who has not completed 18 years of age. It requires verifiable parental consent before processing a child’s personal data, subject to the Act and applicable exemptions. The Act also contains restrictions relating to processing likely to cause detrimental effects on children, tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exceptions. The 2025 Rules provide additional requirements for obtaining verifiable parental consent. This can matter to: Resorts Family hotels Kids’ clubs Children’s activities Family loyalty programs Child-focused digital services Hotels should examine the actual data-processing activity rather than assuming that every family reservation creates exactly the same compliance requirement. Read Also – Hotel Pricing: Strategy Guide for Small & Independent Hotels DPDP Act and Hotel Data Stored Outside India 💡 Cloud technology raises another common question: Does the DPDP Act require every hotel to store all guest data in India? There is no simple blanket answer of “yes.” The DPDP Act allows the Central Government to restrict transfers of personal data to specified countries or territories through notification and preserves requirements under other applicable Indian laws. The 2025 Rules also provide a framework concerning requirements that may be specified for making personal data available to a foreign State or entities under its control. Hotels using cloud platforms should therefore understand their actual data flows. Ask technology providers: Where is data hosted? Who can access it? What security controls are used? Which subprocessors are involved? What contractual protections apply? What happens when the hotel leaves the platform? How is data deleted? The key is to understand the arrangement rather than assuming that “cloud” automatically means compliant or non-compliant. Read Also – Hotel Folio: A Complete Guide to Guest Billing and Hotel Folio Management DPDP Act Compliance Checklist for Hotels Use this checklist with your hotel management, IT, legal and operations teams. Governance Identify the entity determining the purpose and means of processing Map personal-data processing Identify relevant Data Processors and vendors Assign internal privacy responsibilities Guest Data List personal data collected Identify the purpose for each category Review whether all collected information is necessary Review privacy notices Review consent mechanisms Guest Rights Create an access-request process Create a correction process Create an erasure process Create a consent-withdrawal process Create a grievance process Security Review user permissions Review authentication controls Review security safeguards Review encryption where appropriate Review monitoring Review logs Review backups Review incident-response procedures Vendors Identify every system receiving guest data Review vendor contracts Review Data Processor responsibilities Review breach obligations Review data-sharing arrangements Review subprocessors where relevant Marketing Separate transactional and promotional communication Review marketing consent Provide an appropriate withdrawal mechanism Maintain communication preferences Retention Create a data inventory Map retention requirements Identify deletion triggers Review legal retention requirements Review vendor deletion procedures Breach Response Create an incident-response plan Define internal escalation Define responsibilities Prepare communication procedures Establish Board-notification procedures where applicable Want to See Hotelogix in Action Book a Live Demo → How Hotelogix Can Support Hotels With Data Privacy and Security The DPDP Act is not a software certification. Using a PMS does not automatically make a hotel compliant. A hotel’s compliance depends on much more than its technology. It includes its policies, contracts, notices, consent practices, staff processes, data flows, retention policies and security controls. However, technology can support many of the operational controls that form part of a hotel’s broader privacy and security program. This is where Hotelogix can help. Role-Based User Access Hotel operations involve different teams with different responsibilities. Controlled user access can help hotels limit information according to employee roles. This can reduce unnecessary access to guest information. Audit Trail An audit trail provides visibility into relevant system activity. For hotel teams, this can help with accountability and tracing activity when an operational issue needs investigation. Guest Information Management Hotelogix provides a centralized environment for managing guest information as part of hotel operations. This can help reduce reliance on scattered spreadsheets and disconnected manual records. Cloud-Based Hotel PMS Hotelogix is a cloud-based hotel PMS that brings core hotel operations into one platform. Reservations, front desk, housekeeping, billing and other hotel workflows can be managed through a connected system. A centralized platform can make it easier for hotel teams to understand where information is being used within the PMS environment. Backups and Business Continuity Backups form part of the security safeguards described in the DPDP Rules. Hotels should understand how their PMS provider manages backups, availability and recovery. Multi-Property Operations For hotel groups, guest data can move across multiple properties. A multi-property PMS can help central teams manage hotel operations while applying appropriate access controls across properties. The hotel should still decide which employees require access to which properties and information. Read Also – Hotel Operations Management: Checklist, Software and Best Practices What Hotels Should Ask Their PMS Provider About DPDP Compliance 💡 Instead of asking a technology provider only: “Are you DPDP compliant?” ask more specific questions. 1. Where is our guest data stored? 2. Who can access our guest information? 3. Can we control user permissions? 4. Are relevant system activities logged? 5. How are security incidents handled? 6. What happens if there is a personal data breach? 7. How are backups managed? 8. What happens to our data when we leave the platform? 9. Can we export our hotel data? 10. Which third-party services or subprocessors are involved? 11. What contractual data-protection provisions apply? 12. How does the platform support our internal privacy processes? These questions help a hotel evaluate the actual technology environment instead of relying on a broad compliance statement. Read Also – Hotel Reservation Process: Steps, Types and PMS Workflow DPDP Act Compliance Roadmap for Hotels: 2026–2027 Hotels should not wait for the final implementation milestone before reviewing their data practices. The Government’s commencement notification establishes a phased implementation of the DPDP Act. The notification dated November 13, 2025 states that some provisions came into force immediately, some take effect one year after publication, and a larger set takes effect 18 months after publication. That 18-month milestone falls on May 13, 2027. The DPDP Rules also use a phased commencement structure. Phase 1: Understand Identify: What data you collect Why you collect it Where it is stored Phase 2: Map Map the journey: Guest → Website → Booking → PMS → OTA → CRM → Marketing → Other Vendors Phase 3: Review Review: Privacy notices Consent Guest rights Marketing practices Phase 4: Secure Review: Access controls Authentication Monitoring Logs Backups Vendor security Phase 5: Test Test your processes for: Access requests Correction requests Erasure requests Consent withdrawal Breach response Phase 6: Train Train employees who work with guest information. This can include: Front desk Reservations Sales Marketing Finance IT Management Phase 7: Review Privacy compliance is not a one-time exercise. Hotels add systems, change vendors, launch new campaigns and collect new types of information. The privacy program should change with the hotel. Want to See Hotelogix in Action Book a Live Demo → Common DPDP Compliance Mistakes Hotels Should Avoid Mistake 1: Treating a Booking as Blanket Marketing Consent A booking and a promotional campaign can have different purposes. Mistake 2: Collecting Every Possible Guest Detail If information is not needed for a defined purpose, hotels should question why it is being collected. Mistake 3: Keeping Every Guest Record Forever Retention should be based on applicable purposes and legal requirements. Mistake 4: Giving Every Employee Broad PMS Access Access should match job responsibilities. Mistake 5: Ignoring Third-Party Vendors Guest information can move through many systems outside the hotel. Mistake 6: Having No Breach Response Plan A hotel should know what to do before an incident occurs. Mistake 7: Using One Consent Mechanism for Everything Different processing purposes may require different approaches. Mistake 8: Assuming a PMS Makes the Hotel Compliant Technology can support compliance. It cannot replace the hotel’s legal and operational responsibilities. Mistake 9: Forgetting Children’s Data Hotels and resorts serving families should assess whether their activities involve processing children’s personal data. Mistake 10: Waiting Until 2027 to Start Data mapping, vendor review and process changes can take time. Starting earlier gives hotels more time to identify gaps. Read Also – Hotel Room Allocation: Process, Room Assignment & Best Practices DPDP Act Penalties: What Hotels Need to Know The DPDP Act provides for financial penalties for specified breaches. The Schedule to the Act provides for penalties of up to: ₹250 crore for certain breaches relating to reasonable security safeguards ₹200 crore for certain breaches relating to personal data breach notification ₹150 crore for certain breaches relating to children’s data ₹50 crore for certain other breaches These are maximum amounts associated with specified breach categories. A hotel should not interpret the ₹250 crore figure as an automatic penalty for every DPDP violation. The Act provides for the Board to consider relevant factors when determining penalties. For hotels, the impact of a serious personal data incident can also extend beyond a regulatory penalty. It can affect: Guest trust Brand reputation Corporate relationships Repeat business Partner relationships That is why privacy and security should be treated as part of hotel operations rather than only as a legal exercise. Final Takeaway: Guest Data Privacy Is Now a Hotel Operations Issue Guest data does not stay at the front desk. It moves through: Reservations → PMS → Front Desk → Payments → Wi-Fi → CRM → Marketing → Connected Systems Every system can create another place where guest information is collected, accessed, shared or stored. The DPDP Act 2023 and DPDP Rules 2025 give hotels a strong reason to look closely at those data flows. Hotels should know: What guest data they collect Why they collect it Who can access it Which vendors process it How guests can exercise their rights How the information is protected How long it should be retained What happens when something goes wrong The May 13, 2027 milestone makes this a timely issue, but hotels should not wait until then to start preparing. Hotelogix can support the technology side of this work through capabilities such as user access controls, audit trails, guest information management, cloud-based hotel operations and backups. But technology is only one part of the picture. A strong DPDP program brings together: People + Processes + Policies + Contracts + Technology Preparing your hotel for India’s DPDP requirements? See how Hotelogix can help you manage guest information and everyday hotel operations through one connected cloud PMS. Request a Hotelogix Demo