Travel and hospitality DPDP compliance
knowing where the data went.

Section 16 lets travel businesses send data abroad to airlines, hotel chains, global distribution systems and overseas partners, unless the government restricts a country. Permissive is not the same as unrecorded. The obligation that bites is knowing which data went to whom, because rights requests and inspections ask exactly that.

Most transfers happen inside booking integrations: an OTA's API call to a GDS, a channel manager pushing guest details to a property system hosted abroad, an airline sharing a PNR with a codeshare partner. Nobody wrote them down because nobody decided them; they came with the integration. When a customer asks under section 11 for a summary of the personal data processed and the identities of those it was shared with, the answer has to come from somewhere.

The work is a transfer map: for each integration, what data, to which recipient, in which country, for which purpose, and whether the recipient is your processor or a fiduciary in its own right. Keep it current, because the government can notify restricted countries at any time. The DPDP cross-border transfer guide covers section 16 and Rule 15.

Much traveller data is collected because a law requires it: foreign guest registration, passenger records for customs, identity checks at check-in. Processing for those purposes is lawful. Using the same records for loyalty marketing, profiling or resale is a new purpose that needs its own consent.

Hotels are the sharpest example. Since the Immigration and Foreigners Act, 2025 came into force, the keeper of any accommodation, from a chain hotel to a homestay, must report every foreign guest on Form III within 24 hours of arrival and again on departure, and OCI cardholders are no longer exempt. That record, and the passport scan behind it, is held to meet a legal duty. The guest's loyalty profile, stay preferences and marketing consent are separate, even when the property system stores them in the same table.

Airlines face the same split with the PNR regulations. The customs targeting centre may keep PNR data for up to five years for its purposes. That period belongs to customs. The airline's own retention of booking and loyalty data needs its own basis and period under the DPDP Act.

Travel is one of the few sectors where the customer routinely supplies other people's data: co-travellers, children, employees on a corporate booking. Each is a Data Principal. The booker's click on the notice does not tell the co-travellers anything, and children's data carries the section 9 rules.

Three cases cover most of it. Family and group bookings: the lead booker provides names, dates of birth and passport numbers for everyone. The data is needed to perform the booking, but the notice should say how co-travellers' data is used and how they can exercise their rights. Children: a parent booking for their own child is an identifiable adult providing the child's data, which fits section 9(1) far better than a teenager booking alone. Section 9(3) still bars targeted advertising directed at the child, so the child's profile should not feed the recommendation engine. Corporate travel: the employer usually books under an employment purpose, which section 7(i) recognises. The travel management company is then the employer's processor for the booking and a fiduciary in its own right only for anything it does beyond it, such as enrolling the traveller in its own loyalty scheme.

The DPDP Act has no higher tier for passport or identity data. It requires reasonable security safeguards for all personal data under section 8(5). But the Board sets penalties by the gravity of a breach, and a leak of passport scans enables identity fraud, so expect the safeguards to be judged against that harm.

In practice that means scans encrypted at rest, access restricted to the staff who check guests in, and no copies in email or messaging groups, which is where front-desk teams often keep them. Retention should match the legal requirement, not the hotel's storage capacity. The Act's cap for failing to take reasonable security safeguards is ₹250 crore.

The cross-border transfer guide covers section 16 in depth, and the data discovery engine maps cross-border flows with the residencies named. For the law underneath all of it, read the DPDP Act and Rules 2025 guide. To see what your own website does before a visitor answers the banner, run the free two-pass cookie scan. The consent platform holds versioned notices in 22 languages, a hash-chained consent ledger, withdrawal relayed to each processor, and rights requests and breaches on their statutory clocks. The industries overview compares all eight sectors.