DPDP Act Compliance for Indian Hotels: Guest Privacy Guide

TL;DR: The hospitality sector is now a prime target for ransomware syndicates like “Sinobi.” Under India’s DPDP Act, hotels act as Data Fiduciaries and face up to ₹250 crore in penalties for data breaches. This guide provides a 5-step playbook to transition your property from reactive security to auditable, proactive data compliance.

The lobby of a luxury resort is a masterclass in sensory design—a space carefully crafted to wrap guests in an environment of absolute security and flawless comfort. When a traveler steps up to the front desk, an effortless, fluid exchange occurs: they hand over personal documents like a passport or proof of residence, swipe a credit card, and casually share personal preferences ranging from dietary restrictions to their favorite pillow choices.

To the guest, this seamless interaction is simply the hallmark of premium hospitality. To a hotel’s backend servers, however, it represents something else entirely: a massive, continuous, and highly concentrated influx of deeply personal, high-value data. 

Traditionally, safety within the premium hospitality sector was a tangible, visible operational mandate anchored by elite security personnel, rigorous fire drills, and robust perimeter checks.  Today, however, the risk landscape has fundamentally transformed. The modern threat does not necessarily walk through the grand entrance; instead, it enters invisibly via guest Wi-Fi networks and distributed cloud architecture, quietly creating a data vulnerability that physical defenses cannot contain. 

The Mayfair Attack

On February 19, 2026, Mayfair Hotels & Resorts—a prominent luxury hospitality chain operating across India—found itself listed on the dark web leak site of “Sinobi”, a notorious ransomware syndicate. The hackers claimed they had successfully breached the group’s internal networks and threatened to dump a massive trove of confidential data unless a hefty ransom was paid.

While the forensic details continue to unfold, this crisis shines a much needed spotlight on a systemic reality: modern hotels are no longer just brick-and-mortar properties. They are incredibly complex, interconnected digital ecosystems where a single guest’s journey leaves a sprawling digital breadcrumb trail across booking portals, property management platforms, CRM systems, third-party payment gateways, and even simple guest Wi-Fi networks. 

When a hotel collects this sprawling web of preferences, passports, and payment details, they aren’t just providing seamless service, they are acting as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“Act”). 

Data Leaks and Liability: Managing DPDP Compliance for Indian Hotels

Under the Act and the Digital Personal Data Protection Rules, 2025 (Rules), hotel operators are classified as Data Fiduciaries because they determine the purpose and means of processing personal data. 

Under Section 2(t), the Act defines “personal data” as any data about an individual who is identifiable by or in relation to such data. In the hospitality sector, this encompasses a wide range of information, including guest reservation details, identity documents, payment information, loyalty programme records, CCTV footage, employee records, and payroll information.

Equally important is the Act’s broad definition of a “personal data breach” under Section 2(u). A breach is not limited to the theft or public disclosure of data. It also includes any unauthorized processing, accidental disclosure, altering, or even a temporary loss of access that compromises data availability. Consequently, if ransomware renders a hotel’s property management system (PMS), reservation database, or guest records inaccessible, the incident may qualify as a personal data breach even if no data has been exfiltrated.

Under Section 8(6) of the Act read with Rule 7 of the DPDP Rules, once a Data Fiduciary becomes aware of a personal data breach, it must notify both the Data Protection Board of India (DPBI) and every affected Data Principal without undue delay. The Rules further require the Data Fiduciary to submit a detailed report to the Board within the prescribed 72-hour timeframe, outlining the nature of the breach, its impact, the remedial measures undertaken, and other prescribed particulars.

Failure to comply with these obligations can attract significant financial penalties under the Act, including:

• Up to ₹250 crore for failing to implement reasonable security safeguards, such as appropriate encryption, multi-factor authentication, access controls, and secure backup mechanisms.
• Up to ₹200 crore for failing to comply with the mandatory breach notification requirements applicable to the Board and affected Data Principals.

Given the scale of these obligations and the potential financial exposure, hotels should move beyond a reactive approach to cybersecurity and establish an auditable compliance framework that combines robust technical safeguards, clear incident response procedures, and effective governance mechanisms.

The Indian Hospitality Blueprint: A 5-Step DPDP Action Playbook 

To move past reactive security and establish an auditable, DPDP-aligned data governance model, corporate leaders should prioritize the following five operational steps:

• Strengthen Access Governance: Conduct regular reviews of privileged systems, including property management systems (PMS), ERP, and client databases. Remove legacy or shared credentials and enforce multi-factor authentication (MFA) as the organizational default.
• Enforce Supply Chain Visibility: Contractually bind all third-party vendors and data processors to the same security baselines. Ensure vendor service level agreements (SLAs) mandate immediate incident escalation to preserve your 72-hour regulatory reporting timeline.
• Maintain Auditable Logs: Enforce Rule 6 by ensuring all systems maintain detailed access records for at least one year. These logs must be readily accessible to support compliance reviews or rapid forensic analysis during an incident.
• Practice Incident Response: Develop explicit, step-by-step breach response playbooks. Test coordination and communication protocols through regular simulations so leadership can manage regulatory timelines efficiently during a crisis.
• Conduct DPDP Act & Awareness Training: Data breaches frequently stem from human factors, ranging from external phishing campaigns to inadvertent internal disclosures. Hospitality brands should implement continuous, function-specific scenario based training for everyone within the organization on handling data responsibly. 

While this five-step framework provides an essential blueprint for compliance, executing it effectively requires moving beyond theoretical checklists into deeply ingrained corporate behavior. This is where specialized, professional guidance becomes indispensable.

Turning Legal Mandates into Daily Habits 

Achieving comprehensive DPDP Act readiness requires translating abstract statutory obligations into daily corporate behavior. Rainmaker helps organizations bridge the gap between cybersecurity, privacy, and workplace accountability through dedicated compliance solutions:

• DPDP Act Readiness Assessments & Privacy Audits: We conduct detailed evaluations of your current data lifecycles, identifying hidden security gaps and drafting custom, defensible data privacy policies tailored to your operational environment.
• Connected Privacy & Security Training: We deploy a dual training framework using our e-modules: WorkWISE for core DPDP compliance alongside WorkSECURE to build daily employee habits against phishing and data leaks. 
• DPO Consultation & Incident Playbooks: We provide DPO Advisory Services to manage ongoing compliance governance, execute Data Protection Impact Assessments (DPIAs), and drive executive risk accountability. We also co-create step-by-step breach response notices and management guidance to ensure strict alignment with the statutory  reporting obligations

Organizational resilience is measured by the steps leadership takes to prepare its corporate culture before a crisis occurs. Connect with Rainmaker today to strengthen your privacy infrastructure and ensure complete compliance in the DPDP era.

Suggested Reading

• DPDP Act Vendor Liability: Why Third-Party Breaches Sit With You
• USHA Ransomware Breach: DPDP Lessons for Indian Manufacturers on SAP and Employee Data Risk
• DPDP Act in the Boardroom: Governance FAQs for Indian Companies
• When Delay Becomes Non-Compliance: The Reality of the DPDP 18-Month Window
• India’s DPDP Act, 2023: How Data Principals and Data Fiduciaries Are Redefining Data Protection, Digital Trust, and Leadership in India’s Digital Economy