India's Data Protection Law Pushes Hotels to Revise Contracts

The Digital Personal Data Protection Act, 2023, and its 2025 rules have come into force in India, compelling the hospitality sector to treat hotels as "Data Fiduciaries" under the law. After an 18‑month compliance window, hotel groups and chains operating in the country must reassess and amend existing contracts to embed robust data‑privacy clauses. Large operators may be classified as "Significant Data Fiduciaries," triggering heightened obligations when handling guest, employee, vendor or website‑user information, including cross‑border data transfers and legacy records digitisation. The legal shift mirrors the EU GDPR, requiring hotels to manage personal data of multiple stakeholders and to ensure that franchise partners, travel agencies, payment gateways and IT providers adhere to the new standards.