The DPDP Act for hotels means one thing in practice: every guest detail you collect digitally (name, phone, email, ID, stay history) needs a clear purpose and a plain-language notice. Where consent is the basis, the guest must be able to withdraw it. Your hotel decides why the data is used, so you carry the responsibility.
Key Takeaways
- The DPDP Act applies to any hotel that processes digital personal data of guests in India, whatever its size. Your hotel is the Data Fiduciary, the party that decides why and how guest data is used.
- As of October 2026, most notice and consent rules (Rules 3 and 5 to 16) commence on 13 May 2027, so the next six months are your build window.
- Take booking consent and marketing consent separately. Never pre-tick a newsletter or loyalty box inside the booking flow.
- Map every touchpoint: booking engine, website forms, ID capture, Wi-Fi, newsletter, CRM, OTAs and payment tools. Each needs a stated purpose and a named owner.
- Vendors that handle guest data for you (booking engine, CRM, email tool) need written processor terms. The hotel stays accountable for them.
- Set a retention period per data type, and keep any log or record that another law requires. Get counsel to confirm the periods before you publish them.
This guide is for hotel owners, general managers and revenue or marketing managers who need a touchpoint checklist rather than a legal lecture. At Cyberdunes, we build booking-led hotel websites on Apex®, the AI-native digital experience platform (DXP). The same questions come up in every project: what do we ask, when, and who else touches the data? This is not legal advice, so have a qualified privacy lawyer review your final wording and policies.
Does the DPDP Act Apply to Hotels?
Yes. The Digital Personal Data Protection (DPDP) Act, 2023 covers digital personal data processed in India. A hotel of any size that takes bookings, registers guests or runs a mailing list is processing it. In the Act's terms, your hotel is a Data Fiduciary and the guest is a Data Principal.
When Do the Rules Start?
The Government notified the DPDP Rules in November 2025 with a phased start. You can read the details in the Press Information Bureau release on the DPDP Rules and the notified Rules document.
As of October 2026, the Consent Manager provisions (Rule 4) start 13 November 2026. The notice, consent, rights and security rules (Rules 3 and 5 to 16) start 13 May 2027. Confirm the dates with counsel, because commencement details are the part most often misquoted.
What About Foreign Guests and Group Bookings?
If you process guest data in India, treat foreign and domestic guests the same way for planning. Group and corporate bookings add a wrinkle, because the travel desk gives you data about people who never spoke to you. So ask the booker to confirm they have told attendees, and keep a record of that confirmation.
Where Do Hotels Collect Guest Data? A Touchpoint Map
Most hotels collect guest data in at least seven places, and only two or three sit under the front desk's eye. The table below maps each touchpoint to the data collected, the likely basis and the fix we suggest. The "likely basis" column is a planning view, not a legal opinion.
| Touchpoint | Data collected | Likely basis (confirm with counsel) | What to do |
|---|---|---|---|
| Booking engine | Name, phone, email, dates, payment token, special requests | Consent or voluntary provision for the stay | Short notice beside the form, link to the full notice, no pre-ticked marketing box |
| Website enquiry and contact forms | Name, phone, email, message | Consent for the specific enquiry | State the purpose in one line under the button |
| Check-in and guest registration (ID capture) | ID type and number, address, nationality, photo | Often tied to a legal requirement; check which | Collect only what the rule needs, restrict access, avoid photocopies in open drawers |
| Guest Wi-Fi portal | Phone or email, device identifiers | Consent, or a legal requirement where one applies | Separate "get connected" from "send me offers" |
| Newsletter and offers | Email, phone, preferences | Consent for marketing | Unticked box, one purpose, easy withdrawal link |
| CRM and loyalty | Stay history, preferences, spend, notes | Consent for each purpose | Tag every record with source, purpose and date |
| OTAs and channel manager | Guest name, contact, booking details | Shared with you by the OTA for the booking | Use for that stay only unless the guest opts in with you |
| Cookies, analytics and ad pixels | Browsing behavior, identifiers | Consent for non-essential tracking | Cookie banner with real choices and a policy page |
| CCTV and door-lock logs | Video, access times | Security purpose; check applicable rules | Post a notice, set a deletion cycle |
Which Touchpoint Should You Fix First?
If you only fix one row this quarter, fix the booking engine. It is the highest-volume touchpoint. It is also the easiest for a regulator or a guest to see.
What Guest Data Can a Hotel Collect?
A hotel should collect only what it needs for a stated purpose. The DPDP Rules require a notice that lists the data and the purpose in plain language. So a vague "to improve services" no longer works as a reason for collecting something.
A Simple Field Test
For every field on a form, write down which task needs it. If you cannot name the task, drop the field. Date of birth for a standard room booking is a common offender. So are anniversary dates "for offers" and mandatory nationality on a restaurant table enquiry.
Common Mistakes We See on Hotel Sites
- One checkbox for everything. "I agree to the terms, privacy policy and promotional messages" bundles three purposes into one tick.
- Pre-ticked marketing boxes inside the booking engine.
- A privacy policy copied from another site that mentions systems you do not use and misses the ones you do.
- Tracking pixels firing before the guest chooses. The banner shows, but the scripts already ran.
- Enquiry forms that email details to a shared inbox nobody cleans, so data sits for years.
- Free-text special requests that capture health or religious details, with no thought about who reads them.
- ID photos stored in WhatsApp groups or on personal phones.
DPDP Guest Registration: What About ID Capture?
ID capture at check-in is usually driven by other laws, not by your marketing wishes. So treat it as its own purpose with its own handling rules. Do not reuse ID data for marketing, and do not store it where the front-desk team can casually export it.
The Act recognizes certain legitimate uses where consent is not the basis, and legal obligations are one area. Which exact obligations apply to your property is a question for counsel, not for a blog post. From build experience, though, we can say this: separate the registration step from the booking and marketing steps in your system. Then you can show what each piece of data was collected for.
Handling Rules for ID Data
- Capture only the ID fields the applicable requirement calls for.
- Limit access by role (front desk, not sales).
- Encrypt stored scans and avoid sending them over chat apps.
- Set a deletion date and log who accessed what.
How to Take Consent at Booking: Wording and Flow
Show a short notice next to the booking form, then ask for marketing consent separately and unticked. The Rules expect a notice that is itemized, clear and presented independently of other terms, per the Seqrite summary of the final Rules. So do not bury it inside terms and conditions.
A Hotel Booking Engine DPDP Flow That Works
- Step 1, form. Ask only for what the booking needs.
- Step 2, notice line. Directly under the "Confirm booking" button, say what you collect and why, with a link to the full notice.
- Step 3, optional marketing box. Unticked, one purpose, plain words.
- Step 4, confirmation email. Repeat what was agreed, and include a link to manage or withdraw consent.
- Step 5, record. Store the wording version, timestamp and channel against the guest record.
Sample Consent Wording
This is illustrative text for a hotel website consent line. Adapt it to your systems and have counsel review it before use.
Notice at booking: We use your name, phone number, email and stay dates to confirm and manage your booking, and to contact you about your stay. We share payment details only with our payment provider. Read our full notice and learn how to access, correct or erase your data, withdraw consent or complain at [link].
Optional marketing box (unticked): Send me offers and news from [Hotel name] by email and WhatsApp. You can unsubscribe any time using the link in every message.
Notice what the second line does not do. It does not tie the booking to the box, and it names the channels. If a guest declines, the booking still goes through.
Cookies and the Hotel Website Consent Banner
Hotel website consent also covers cookies. Show a banner with equal-weight accept and reject options. Block non-essential scripts until the guest chooses, and explain what you use in a cookie policy. Our own privacy policy shows the structure of a plain-language notice, but yours must reflect your systems.
How Should a Hotel Take Consent for Marketing and Loyalty?
Take marketing consent for each purpose and channel separately, and keep it apart from booking and loyalty enrollment. A guest who joins your loyalty program has agreed to points and perks. That does not mean they agreed to WhatsApp promotions.
Purposes to Keep Separate
Break consent into purposes you can name:
- Booking and stay service (needed for the stay)
- Offers by email
- Offers by WhatsApp or SMS
- Loyalty program membership and profiling
- Sharing with partner brands (if you do this at all)
Withdrawal should be as easy as giving consent. If a guest ticked a box with one click, they should be able to untick it with one click. Log every change.
Where Consent Managers Fit
The upcoming Consent Manager regime may add another route for guests to manage permissions. The text of Rule 4 sets who can register. Our note on the DPDP Consent Manager deadline covers what marketers should change, and a TaxGuru explainer on Consent Managers covers the business implications. Still, neither replaces your own consent records.
Old Mailing Lists
Many hotels hold years of guest emails with no record of how they were collected. Before May 2027, split the list: guests with a documented opt-in, and everyone else. For the second group, plan a fresh, clearly worded re-permission message or stop mailing them. Ask counsel how the Act treats data collected before commencement.
Do OTAs Share Responsibility? Working With OTAs and Vendors
Online travel agencies are generally responsible for what they collect on their own platforms. Your hotel is responsible once the data is in your systems. So do not assume an OTA booking gives you the right to market to that guest. Use the details for the stay, and invite the guest to opt in with you directly.
Vendors as Data Processors
Vendors are different. Your booking engine, CRM, email platform, payment gateway, channel manager and Wi-Fi provider process data on your behalf. The Act makes the Data Fiduciary responsible even where a processor does the work, so you need a written contract. Rule 8 also refers to processing done by a Data Processor on your behalf, per the text of Rule 8.
What to Ask Every Vendor
- Where is guest data stored, and who can access it?
- What security safeguards are in place, such as encryption and access logs?
- How fast can you delete or export one guest's data on request?
- What happens to our data if we end the contract?
- How will you notify us of a breach, and how quickly?
- Which sub-vendors do you use?
For websites, a website security checklist is a good first test of the basics. The customer experience management system guide for hotels also explains how a connected guest record changes your data picture.
How Long Can a Hotel Keep Guest Data?
Keep each type of guest data only as long as its purpose lasts, or longer where another law requires it. The DPDP Rules do not give one number for every hotel. So you need a retention schedule that you can defend.
What Rule 8 Says
Two points from the Rules are worth knowing. Rule 8 requires personal data, traffic data and processing logs to be retained for at least one year for specified purposes, then erased unless another law requires longer. It also requires a warning to the guest at least 48 hours before erasure in the cases it covers. Read the Rule 8 text with counsel, because which classes of business it covers is a legal call.
An Illustrative Retention Schedule
Here is an illustrative starting schedule. These periods are placeholders, not legal advice.
| Data type | Purpose | Illustrative review trigger | Owner |
|---|---|---|---|
| Booking details | Stay service, accounting | Check-out plus the period tax and accounting law requires | Finance and front office |
| ID records | Legal registration | As the applicable requirement states | Front office manager |
| Marketing contacts | Offers | Withdrawal, or periodic re-permission | Marketing manager |
| Wi-Fi logs | Access and security | As required by applicable rules | IT lead |
| Enquiries that did not convert | Respond to the enquiry | A short fixed period you define | Sales |
| CCTV | Security | A fixed overwrite cycle | Security head |
A Hotel DPDP Readiness Checklist With Owners
You can cover the main gaps in about six months if you start with the touchpoints guests see first. The plan below runs against the 13 May 2027 date for most obligations, as of October 2026.
The Ten-Step Plan
| Step | Task | Owner | Effort |
|---|---|---|---|
| 1 | List every system holding guest data, including spreadsheets and chat apps | GM and IT lead | 1 to 2 weeks |
| 2 | Fill in the touchpoint map with purpose and legal basis (with counsel) | GM and counsel | 2 weeks |
| 3 | Rewrite the booking notice and separate the marketing consent box | Marketing manager and web team | 1 to 2 weeks |
| 4 | Fix the cookie banner so scripts wait for the choice | Web team | 1 week |
| 5 | Set up a consent log: wording version, timestamp, channel | Revenue manager and CRM admin | 2 to 3 weeks |
| 6 | Sign processor terms with every vendor | GM and counsel | 3 to 4 weeks |
| 7 | Create a retention schedule and a deletion routine | Front office manager and IT lead | 2 weeks |
| 8 | Build a way to handle guest requests (access, correction, erasure, withdrawal) | Guest relations | 2 weeks |
| 9 | Write a breach response plan and train staff | GM and IT lead | 2 weeks |
| 10 | Counsel reviews the full pack, then you publish the notice | Counsel | 1 to 2 weeks |
Staff Habits Matter as Much as Software
Most privacy slips at hotels happen on phones and shared inboxes, not in the booking engine. Tell the team plainly: no guest IDs on personal WhatsApp, no exporting guest lists to personal email and no sharing guest details with outside promoters. Put these three rules on the staff-room wall.
What Does a Compliant Hotel Site Look Like in Practice?
It looks ordinary to the guest: a short booking form, a clear notice line and an optional offers box. The work happens behind it, in consent logs, vendor contracts and deletion routines.
The Majestic Suites site is the sort of booking-led hotel build where these touchpoints live. Cyberdunes built it on Apex®. The Majestic Suites case study reports 65% increased revenue and 73% improved operational efficiency. Those are whole-site results, not privacy results, and we do not claim otherwise. The point is that clean data capture and a fast, simple booking path belong in the same project.
Accessibility in the Same Pass
Accessibility belongs in that same pass. A consent box a screen reader cannot announce is a bad box. Our WCAG 2.2 AA checklist covers the form basics.
How Cyberdunes and Apex® Help With DPDP Readiness
Cyberdunes builds hotel websites and booking journeys on Apex®, which includes controls that support GDPR, CCPA and India's Digital Personal Data Protection (DPDP) Act compliance. Hosting runs on AWS with TLS encryption (AES-256). Apex® also connects to your CRM, analytics and marketing tools through an API layer, so you can see the data flows you need to map.
We do not give legal advice, and no platform makes a hotel compliant on its own. What we can do is rebuild your forms, notices, cookie banner and consent capture so the flow is clean. Then we work with your counsel's wording. If your site is also due for a rebuild, our web development services show how it fits together.
Talk to us about DPDP-ready hotel websites
Sources
- Government notifies DPDP Rules to empower citizens and protect privacy, Press Information Bureau, November 2025
- DPDP Rules, 2025 Notified, Press Information Bureau, November 2025
- Rule 4 of the Digital Personal Data Protection Rules 2025, DPDPA.com
- Rule 8 of the Digital Personal Data Protection Rules 2025, DPDPA.com
- Consent Managers under DPDP Act, 2023: Registration, Responsibilities and Implications for Businesses, TaxGuru
- DPDP Rules Under the DPDP Act: Key Changes Explained, Seqrite
