Sector guide · Hospitality
DPDP Act for hotels and restaurants
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Hotels collect identity documents at check-in, restaurants collect phone numbers for tables and loyalty, and both run booking engines, Wi-Fi portals and marketing lists. Identity data collected under other laws has a legal retention period; everything collected for marketing needs consent, a purpose and an erasure date.
Check-in data has a legal ground and a legal clock
Guest registers and identity copies are collected because other laws require them, which is a legitimate use under Section 7(c) for compliance with a legal obligation. That ground covers the register. It does not cover using the same details for offers, nor keeping identity copies beyond the retention the other law sets. Section 8(7) requires erasure after that.
Wi-Fi portals, booking engines and OTAs
A captive Wi-Fi portal collects a phone number and a device identifier; a booking engine collects card and contact details; an online travel agency shares guest data both ways. Each third party is either a Data Processor needing a Section 8(2) contract or a Fiduciary with its own ground, and the Rule 3 notice must describe the sharing.
Loyalty and marketing
A loyalty programme is a purpose that needs consent specific to it under Section 6, with withdrawal as easy as joining. A phone number taken to seat a table is not consent to a promotional SMS list.
First five actions
- Separate legally required check-in data from marketing data in the notice and in storage.
- Set retention for identity copies to the legal minimum and erase on it.
- Put Section 8(2) contracts in place with the PMS, booking engine, Wi-Fi and messaging vendors.
- Make loyalty and offers opt-in with one-tap withdrawal.
- Publish the Section 8(9) contact on the website and at the front desk.
Questions people ask
- Can we keep guest ID copies indefinitely?
- No. Keep them for the period the applicable law requires, then erase under Section 8(7).
- Is a Wi-Fi login page processing?
- Yes. It collects a phone number and a device identifier and usually hands them to a portal vendor, a Data Processor.
- Can we message past guests about offers?
- Only with consent for marketing under Section 6. The stay gives a ground for the stay, not for promotions.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.