DPDP Act

A guest books a room online.

They provide their name, phone number and email address. At check-in, the hotel may collect additional information. During the stay, the guest connects to Wi-Fi, orders room service, books a spa treatment and makes payments.

After checkout, the hotel may still have their booking history, contact details, preferences and other information in its systems.

Now consider how many systems may have touched that data.

The hotel’s website. Booking engine. PMS. Front desk. OTA connections. CRM. Wi-Fi system. POS. Payment provider. Email platform.

This raises an important question for every hotel and resort in India:

How should guest data be collected, used, stored and protected under India’s data protection law?

The Digital Personal Data Protection Act, 2023, commonly known as the DPDP Act, establishes India’s legal framework for processing digital personal data. The Act received Presidential assent on August 11, 2023.

The Government later notified the Digital Personal Data Protection Rules, 2025 on November 13, 2025. The Rules provide additional details on how several provisions under the Act are to operate.

For hotels, the issue is not limited to the IT department.

Guest data is part of everyday hotel operations.

From reservations and check-in to marketing and guest loyalty, personal data can move through almost every stage of the guest journey.

This guide explains the DPDP Act 2023, the DPDP Rules 2025, the phased implementation timeline, key requirements for hotels and resorts, and how hotel technology such as Hotelogix can support the operational side of data protection.

Important: This article is for educational purposes and is not legal advice. Hotels should consult qualified legal or privacy professionals about their specific processing activities and obligations.

What Is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s law governing the processing of digital personal data within the scope defined by the Act.

It establishes a framework around:

• Processing of personal data
• Consent
• Responsibilities of Data Fiduciaries
• Rights of Data Principals
• Children’s personal data
• Data security
• Personal data breaches
• Significant Data Fiduciaries
• The Data Protection Board
• Financial penalties

The Act is designed to balance an individual’s right to protect their personal data with the need for organizations to process personal data for lawful purposes.

What Does DPDP Act Stand For?

DPDP stands for Digital Personal Data Protection.

The full name of the law is the Digital Personal Data Protection Act, 2023.

Who Is a Data Principal?

A Data Principal is the individual to whom personal data relates.

For hotels, this can include a guest whose personal information the hotel processes.

Who Is a Data Fiduciary?

A Data Fiduciary is a person who determines the purpose and means of processing personal data.

A hotel may fall into this role when it decides why and how guest data is processed.

Who Is a Data Processor?

A Data Processor processes personal data on behalf of a Data Fiduciary.

For example, a hotel may use technology providers or other service providers to process personal data on its behalf.

The actual legal role of each organization depends on the specific processing arrangement, not simply on whether it is called a PMS, OTA, CRM or another type of provider.

DPDP Act 2023 vs DPDP Rules 2025: What’s the Difference?

The DPDP Act 2023 and DPDP Rules 2025 work together, but they serve different purposes.

DPDP Act 2023

The Act establishes the broader legal framework, including:

• Consent
• Data Fiduciary obligations
• Data Principal rights
• Children’s data
• Significant Data Fiduciaries
• Personal data breaches
• Data Protection Board
• Penalties

DPDP Rules 2025

The Rules provide additional operational details around several requirements.

They cover areas including:

• Privacy notices
• Consent mechanisms
• Security safeguards
• Personal data breach notifications
• Certain retention and erasure requirements
• Children’s personal data
• Significant Data Fiduciary obligations
• Contact information and other operational requirements

The Government notified the Digital Personal Data Protection Rules, 2025 on November 13, 2025.

Importantly, the Rules do not all take effect at the same time.

When Does the DPDP Act Apply to Hotels in India?

The DPDP Act applies to the processing of digital personal data within India in the circumstances specified by the Act.

It can also apply to certain processing outside India where the processing is connected with offering goods or services to Data Principals in India.

That makes the law relevant to hotels using digital systems to manage guest information.

Hotels should therefore ask:

• What guest data do we collect?
• Why do we collect it?
• Who has access to it?
• Where is it stored?
• Which vendors receive it?
• How long do we retain it?
• What happens if a guest asks us to correct or erase it?
• What happens if the data is breached?

These questions form a practical starting point for a hotel’s DPDP compliance program.

What Personal Data Do Hotels Typically Process?

Hotels can process personal data at almost every stage of the guest journey.

Reservation Data

This may include:

• Guest name
• Phone number
• Email address
• Booking dates
• Number of guests
• Room details
• Booking preferences

Check-In Data

Depending on the hotel’s process and applicable requirements, this can include:

• Identity information
• Address information
• Identification document details
• Guest registration information

Hotels should assess what information is actually needed for the relevant purpose rather than collecting information simply because a system allows it.

Payment-Related Data

Hotels may process information related to:

• Payments
• Billing
• Transactions
• Refunds

The exact data flow will depend on how the hotel and its payment provider handle payment information.

Guest Experience Data

Hotels may maintain:

• Guest preferences
• Service requests
• Feedback
• Loyalty information
• Stay history

Marketing Data

Marketing systems may contain:

• Email addresses
• Phone numbers
• Communication preferences
• Consent information
• Campaign activity

This is particularly important because information collected for a reservation should not automatically be treated as blanket permission for every future marketing activity.

Wi-Fi and Digital Access Data

Hotels may also collect information connected with guest access to digital services, depending on how those systems operate.

Want to See Hotelogix in Action

Book a Live Demo →

Are Hotels Data Fiduciaries Under the DPDP Act?

A hotel can be a Data Fiduciary when it determines the purpose and means of processing personal data.

For example, a hotel may decide to process guest information to:

• Manage reservations
• Provide hotel services
• Communicate booking information
• Manage a guest account
• Meet applicable legal requirements

The DPDP Act places obligations on the Data Fiduciary and states that where a Data Processor is engaged for relevant activities, the relationship must be governed by a valid contract.

Hotel as Data Fiduciary

The hotel determines why and how the personal data is processed.

PMS or Technology Provider

A technology provider may be a Data Processor when it processes personal data on behalf of the hotel.

OTA or Other Vendor

The role depends on the actual relationship and processing activity.

This distinction is important.

A hotel should not assume that using a PMS or another technology provider automatically transfers its legal responsibilities to that provider.

DPDP Act Compliance Requirements for Hotels and Resorts

There is no single checklist that can make every hotel compliant.

Hotels need to understand the Act and Rules and then apply the requirements to their own data, systems, people and processes.

Here are the major areas hotels should review.

1. Give Guests a Clear Privacy Notice

Guests should be able to understand what information the hotel is collecting and why.

The DPDP Act requires notice about personal data being processed and the purpose of processing, along with information about exercising applicable rights and making complaints.

The 2025 Rules provide additional requirements for notices, including using clear and plain language and providing an itemised description of personal data and the specified purpose.

For hotels, a privacy notice may need to cover data collected through:

• Website
• Booking forms
• PMS
• Mobile applications
• Loyalty programs
• Guest Wi-Fi
• Marketing forms

A privacy notice should not be treated as something that exists only on the website.

It should reflect the hotel’s actual data practices.

2. Obtain Valid Consent Where Consent Is Required

The DPDP Act defines consent as being:

• Free
• Specific
• Informed
• Unconditional
• Unambiguous
• Given through clear affirmative action

The consent should relate to personal data necessary for the specified purpose.

For hotels, this distinction is important.

A guest may provide an email address because they need a booking confirmation.

That does not automatically mean the same action should be treated as blanket consent for every promotional campaign.

Hotels should identify:

Purpose → Data required → Applicable legal basis → Notice/consent → Processing

3. Make Consent Withdrawal Easy

Where consent is the basis for processing, Data Principals have the right to withdraw consent.

The DPDP framework requires withdrawal to be as easy as giving consent.

For hotels, this can affect:

• Email marketing
• Promotional SMS
• WhatsApp campaigns
• Loyalty communications
• Promotional offers
• Personalized marketing

Hotels should have a process to record and act on a guest’s withdrawal request across relevant systems.

4. Give Guests a Way to Exercise Their Data Rights

The DPDP Act gives Data Principals rights including:

• Access to information about their personal data and processing
• Correction
• Completion
• Updating
• Erasure, subject to the Act
• Grievance redressal
• Withdrawal of consent where applicable

A hotel should have a practical process for handling such requests.

For example:

“What personal data do you have about me?”

“My email address is incorrect.”

“Please update my phone number.”

“I want my personal data erased.”

“I want to raise a privacy complaint.”

Erasure does not mean every record must always be deleted immediately. The Act includes circumstances where retention is necessary for the specified purpose or to comply with law.

5. Keep Guest Data Accurate Where Required

Hotels often maintain guest profiles for operational reasons.

That information can become outdated.

A guest may have:

• A new phone number
• A new email address
• A changed address
• An incorrect name
• Duplicate profiles

The DPDP Act requires Data Fiduciaries to correct inaccurate or misleading personal data, complete incomplete data and update personal data in response to applicable requests.

A well-managed guest profile can help hotels handle these updates in a structured way.

6. Protect Personal Data With Appropriate Security Safeguards

Security is one of the most important areas for hotel operators.

The 2025 Rules require reasonable security safeguards to prevent personal data breaches.

The safeguards described in the Rules include measures such as:

• Encryption
• Obfuscation
• Masking
• Virtual tokens where applicable
• Access controls
• Logs
• Monitoring
• Review
• Backups
• Appropriate contractual provisions with Data Processors
• Technical and organizational measures

For a hotel, data security should not stop at the server.

7. Control Who Can Access Guest Data

Not every employee needs access to every piece of guest information.

Hotels should review access according to job responsibilities.

For example:

Front Desk

May need access to:

• Reservations
• Guest profiles
• Arrivals
• Departures
• Room information

Housekeeping

May need access to:

• Room status
• Relevant service information

Finance

May need access to:

• Billing
• Financial records

Marketing

May need access to:

• Appropriate marketing information
• Communication preferences

A role-based approach can reduce unnecessary access to guest information.

8. Maintain Appropriate Logs and Backups

The 2025 Rules recognize safeguards such as logs, monitoring, review and backups as part of reasonable security measures.

Logs can help hotels understand relevant system activity.

Backups can help maintain availability and continuity when data is compromised.

The Rules also prescribe retention of certain personal data and logs for at least one year for the purposes covered by the relevant provision, unless another applicable law requires otherwise.

This should not be interpreted as:

“Keep every guest record for one year.”

Hotels need to distinguish between specific security-log retention requirements and their broader guest-data retention policies.

9. Create a Personal Data Breach Response Process

Imagine a hotel discovers that unauthorized access has exposed guest information.

What happens next?

If nobody knows who should respond, valuable time can be lost.

The 2025 Rules require Data Fiduciaries, after becoming aware of a personal data breach, to inform affected Data Principals without delay with specified information about the breach and measures taken or proposed.

The Data Fiduciary must also intimate the Data Protection Board without delay.

The Rules require detailed information to be provided to the Board within 72 hours of becoming aware of the breach, unless the Board allows a longer period following a written request.

This is an important distinction:

The 72-hour requirement is not a statement that every aspect of breach response must wait until 72 hours.

The initial notification requirement is framed as without delay.

10. Review Data Retention and Deletion

Hotels should know:

• What guest data they have
• Why they have it
• Where it is stored
• Who can access it
• How long it needs to be retained
• When it can be deleted

Avoid creating one blanket retention period for every type of guest information.

Different records can have different purposes and legal requirements.

A hotel should build a data-retention schedule that considers:

Data type → Purpose → Applicable requirement → Retention period → Deletion process

The DPDP Rules also contain specific requirements relating to erasure and retention for certain categories and purposes.

11. Review Contracts With Technology Vendors

Hotels work with many external providers.

For example:

• PMS providers
• Booking engines
• OTAs
• CRM platforms
• Payment providers
• Wi-Fi providers
• Email platforms
• Marketing tools
• Cloud providers
• Analytics platforms

Hotels should know:

• What information is shared
• Why it is shared
• Who processes it
• What contractual protections apply
• How security incidents are handled
• What happens when the contract ends
• How data is returned or deleted

The DPDP Act requires relevant Data Processor arrangements to be governed by a valid contract.

Vendor review should therefore become part of a hotel’s privacy program.

12. Publish an Appropriate Privacy Contact

Guests should have a clear way to ask privacy-related questions or raise concerns.

The DPDP framework provides for contact information for a Data Protection Officer where applicable or another person authorized to respond to communications concerning Data Principal rights.

For a hotel, that could mean clearly publishing an appropriate privacy contact through:

• Website privacy page
• Guest communication
• Booking journey
• Other appropriate channels

The contact details should be kept current.

DPDP Act Rules for Hotel Marketing and Guest Communications

Marketing is one area where hotels need to be particularly careful.

A hotel may send many types of communication.

Transactional Communication

Examples include:

• Booking confirmation
• Payment confirmation
• Check-in instructions
• Cancellation confirmation
• Invoice
• Stay-related communication

Marketing Communication

Examples include:

• Weekend offers
• Holiday packages
• Room upgrades
• Spa promotions
• Loyalty offers
• Birthday offers
• Repeat-stay promotions

These activities can involve different purposes and legal considerations.

Hotels should therefore avoid treating all communications as one category.

Want to See Hotelogix in Action

Book a Live Demo →

Can Hotels Use Guest Data for Personalized Marketing?

Hotels need to identify the purpose and applicable legal basis before using guest information for personalized marketing.

The DPDP Act permits processing on the basis of consent or certain legitimate uses specified in the Act.

For example:

A guest provides an email address to receive information about their reservation.

The hotel should not automatically assume that this means the guest has agreed to receive every future promotional campaign.

Instead, hotels should ask:

• Why are we using this information?
• What information are we using?
• What notice was provided?
• Is consent required?
• Has consent been withdrawn?
• Who else receives the information?
• How long is the information retained?

This approach becomes especially important when guest information is shared between a PMS, CRM, marketing platform and other systems.

DPDP Act Requirements for Children Staying at Hotels

The DPDP Act defines a child as an individual who has not completed 18 years of age.

It requires verifiable parental consent before processing a child’s personal data, subject to the Act and applicable exemptions.

The Act also contains restrictions relating to processing likely to cause detrimental effects on children, tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exceptions.

The 2025 Rules provide additional requirements for obtaining verifiable parental consent.

This can matter to:

• Resorts
• Family hotels
• Kids’ clubs
• Children’s activities
• Family loyalty programs
• Child-focused digital services

Hotels should examine the actual data-processing activity rather than assuming that every family reservation creates exactly the same compliance requirement.

DPDP Act and Hotel Data Stored Outside India

Hotels using cloud platforms should therefore understand their actual data flows.

Ask technology providers:

• Where is data hosted?
• Who can access it?
• What security controls are used?
• Which subprocessors are involved?
• What contractual protections apply?
• What happens when the hotel leaves the platform?
• How is data deleted?

The key is to understand the arrangement rather than assuming that “cloud” automatically means compliant or non-compliant.

DPDP Act Compliance Checklist for Hotels

Use this checklist with your hotel management, IT, legal and operations teams.

Governance

• Identify the entity determining the purpose and means of processing
• Map personal-data processing
• Identify relevant Data Processors and vendors
• Assign internal privacy responsibilities

Guest Data

• List personal data collected
• Identify the purpose for each category
• Review whether all collected information is necessary
• Review privacy notices
• Review consent mechanisms

Guest Rights

• Create an access-request process
• Create a correction process
• Create an erasure process
• Create a consent-withdrawal process
• Create a grievance process

Security

• Review user permissions
• Review authentication controls
• Review security safeguards
• Review encryption where appropriate
• Review monitoring
• Review logs
• Review backups
• Review incident-response procedures

Vendors

• Identify every system receiving guest data
• Review vendor contracts
• Review Data Processor responsibilities
• Review breach obligations
• Review data-sharing arrangements
• Review subprocessors where relevant

Marketing

• Separate transactional and promotional communication
• Review marketing consent
• Provide an appropriate withdrawal mechanism
• Maintain communication preferences

Retention

• Create a data inventory
• Map retention requirements
• Identify deletion triggers
• Review legal retention requirements
• Review vendor deletion procedures

Breach Response

• Create an incident-response plan
• Define internal escalation
• Define responsibilities
• Prepare communication procedures
• Establish Board-notification procedures where applicable

Want to See Hotelogix in Action

Book a Live Demo →

How Hotelogix Can Support Hotels With Data Privacy and Security

The DPDP Act is not a software certification.

Using a PMS does not automatically make a hotel compliant.

A hotel’s compliance depends on much more than its technology. It includes its policies, contracts, notices, consent practices, staff processes, data flows, retention policies and security controls.

However, technology can support many of the operational controls that form part of a hotel’s broader privacy and security program.

This is where Hotelogix can help.

Role-Based User Access

Hotel operations involve different teams with different responsibilities.

Controlled user access can help hotels limit information according to employee roles.

This can reduce unnecessary access to guest information.

Audit Trail

An audit trail provides visibility into relevant system activity.

For hotel teams, this can help with accountability and tracing activity when an operational issue needs investigation.

Guest Information Management

Hotelogix provides a centralized environment for managing guest information as part of hotel operations.

This can help reduce reliance on scattered spreadsheets and disconnected manual records.

Cloud-Based Hotel PMS

Hotelogix is a cloud-based hotel PMS that brings core hotel operations into one platform.

Reservations, front desk, housekeeping, billing and other hotel workflows can be managed through a connected system.

A centralized platform can make it easier for hotel teams to understand where information is being used within the PMS environment.

Backups and Business Continuity

Backups form part of the security safeguards described in the DPDP Rules.

Hotels should understand how their PMS provider manages backups, availability and recovery.

Multi-Property Operations

For hotel groups, guest data can move across multiple properties.

A multi-property PMS can help central teams manage hotel operations while applying appropriate access controls across properties.

The hotel should still decide which employees require access to which properties and information.

What Hotels Should Ask Their PMS Provider About DPDP Compliance

DPDP Act Compliance Roadmap for Hotels: 2026–2027

Hotels should not wait for the final implementation milestone before reviewing their data practices.

The Government’s commencement notification establishes a phased implementation of the DPDP Act.

The notification dated November 13, 2025 states that some provisions came into force immediately, some take effect one year after publication, and a larger set takes effect 18 months after publication.

That 18-month milestone falls on May 13, 2027.

The DPDP Rules also use a phased commencement structure.

Phase 1: Understand

Identify:

• What data you collect
• Why you collect it
• Where it is stored

Phase 2: Map

Map the journey:

Guest → Website → Booking → PMS → OTA → CRM → Marketing → Other Vendors

Phase 3: Review

Review:

• Privacy notices
• Consent
• Guest rights
• Marketing practices

Phase 4: Secure

Review:

• Access controls
• Authentication
• Monitoring
• Logs
• Backups
• Vendor security

Phase 5: Test

Test your processes for:

• Access requests
• Correction requests
• Erasure requests
• Consent withdrawal
• Breach response

Phase 6: Train

Train employees who work with guest information.

This can include:

• Front desk
• Reservations
• Sales
• Marketing
• Finance
• IT
• Management

Phase 7: Review

Privacy compliance is not a one-time exercise.

Hotels add systems, change vendors, launch new campaigns and collect new types of information.

The privacy program should change with the hotel.

Want to See Hotelogix in Action

Book a Live Demo →

Common DPDP Compliance Mistakes Hotels Should Avoid

Mistake 1: Treating a Booking as Blanket Marketing Consent

A booking and a promotional campaign can have different purposes.

Mistake 2: Collecting Every Possible Guest Detail

If information is not needed for a defined purpose, hotels should question why it is being collected.

Mistake 3: Keeping Every Guest Record Forever

Retention should be based on applicable purposes and legal requirements.

Mistake 4: Giving Every Employee Broad PMS Access

Access should match job responsibilities.

Mistake 5: Ignoring Third-Party Vendors

Guest information can move through many systems outside the hotel.

Mistake 6: Having No Breach Response Plan

A hotel should know what to do before an incident occurs.

Mistake 7: Using One Consent Mechanism for Everything

Different processing purposes may require different approaches.

Mistake 8: Assuming a PMS Makes the Hotel Compliant

Technology can support compliance.

It cannot replace the hotel’s legal and operational responsibilities.

Mistake 9: Forgetting Children’s Data

Hotels and resorts serving families should assess whether their activities involve processing children’s personal data.

Mistake 10: Waiting Until 2027 to Start

Data mapping, vendor review and process changes can take time.

Starting earlier gives hotels more time to identify gaps.

DPDP Act Penalties: What Hotels Need to Know

Final Takeaway: Guest Data Privacy Is Now a Hotel Operations Issue

Guest data does not stay at the front desk.

It moves through:

Reservations → PMS → Front Desk → Payments → Wi-Fi → CRM → Marketing → Connected Systems

Every system can create another place where guest information is collected, accessed, shared or stored.

The DPDP Act 2023 and DPDP Rules 2025 give hotels a strong reason to look closely at those data flows.

Hotels should know:

• What guest data they collect
• Why they collect it
• Who can access it
• Which vendors process it
• How guests can exercise their rights
• How the information is protected
• How long it should be retained
• What happens when something goes wrong

The May 13, 2027 milestone makes this a timely issue, but hotels should not wait until then to start preparing.

Hotelogix can support the technology side of this work through capabilities such as user access controls, audit trails, guest information management, cloud-based hotel operations and backups.

But technology is only one part of the picture.

A strong DPDP program brings together:

People + Processes + Policies + Contracts + Technology

Preparing your hotel for India’s DPDP requirements?

See how Hotelogix can help you manage guest information and everyday hotel operations through one connected cloud PMS.

Request a Hotelogix Demo