Aadhaar at Hotel Check-in: Masked Aadhaar, OVSE and DPDP Rules
Hotels need to verify every guest, but Aadhaar photocopies are a liability. Here is how UIDAI’s 2025 offline verification rules, police registers and the DPDP Act fit together at check-in.
Indian hotels and homestays must verify the identity of every guest, but they should not keep photocopies of Aadhaar cards. UIDAI has said unlicensed entities such as hotels should not store Aadhaar copies, and under amendment regulations gazetted on 9 December 2025, entities that verify Aadhaar offline must register with UIDAI as an Offline Verification Seeking Entity (OVSE) and verify through the Aadhaar app QR code or face verification.
Why Aadhaar photocopies are a problem
- The Aadhaar Act restricts collecting and storing Aadhaar numbers during offline verification.
- A drawer of photocopies is a data breach waiting to happen, and from 2027 it is also a DPDP Act problem.
- Guests are increasingly aware of the rules and may refuse to hand over a copy.
What the 2025 OVSE rules change
The Aadhaar (Authentication and Offline Verification) Amendment Regulations, 2025 created a registration route for entities that verify Aadhaar offline. A registered OVSE verifies the guest’s identity through the Aadhaar app QR code or face verification and may store credentials only with explicit consent. More than 100 entities had onboarded by April 2026. Hotel-specific guidance is still evolving, so watch UIDAI’s OVSE page.
Masked Aadhaar: still a sensible practice
A masked Aadhaar shows only the last four digits. UIDAI’s 2022 advisory on it was withdrawn within days, so it is not formal guidance, but storing only masked details is a sensible way to reduce risk. Guests can also use other government ID such as a passport, driving licence or voter ID.
Police guest registers depend on your district
There is no single national rule for police reporting of domestic guests. Requirements come from district magistrate orders and state police directions, for example a guest verification form in North Goa, the PATHIK software in parts of Gujarat and Goa, and KYC norms in Hyderabad. Check your district’s current order.
The DPDP Act timeline for hotels
| Date | What applies |
|---|---|
| 13 November 2025 | DPDP Rules notified; Data Protection Board provisions start |
| 13 November 2026 | Consent Manager rules start |
| 13 May 2027 | Core duties: notice and consent, security safeguards, breach notice, retention and erasure |
Under the Rules, a personal data breach must be reported to the Board and affected guests without delay, with a detailed report to the Board within 72 hours. Penalties for failing to keep reasonable security safeguards can reach ₹250 crore. In January 2026 the government consulted on shortening the timeline, so plan for May 2027 but prepare earlier.
A practical check-in policy
- Ask for ID before arrival through a secure link, not WhatsApp photos.
- Store only what you need: name, ID type, last digits and validity.
- Collect passport and visa details for foreign guests and file Form-III within 24 hours.
- Give guests a short privacy notice explaining why you collect data and how long you keep it.
- Limit who can see guest documents by staff role.
- Delete data you no longer need, and keep a record of when.
How GXP Next handles guest ID
Guests can upload their ID before arrival, Aadhaar is stored masked, staff see only what their role allows and every change is recorded. Foreign guests are added to the Form-III queue automatically.
FAQs
Can a hotel keep a copy of my Aadhaar?
UIDAI has said unlicensed entities such as hotels should not keep Aadhaar photocopies. Offline verification through a registered OVSE is the intended route.
Is masked Aadhaar valid for hotel check-in?
Many properties accept it, and it limits risk, but acceptance depends on your local police requirements.
When does the DPDP Act apply to hotels?
The core duties apply from 13 May 2027 under the Rules notified in November 2025.
Sources: UIDAI OVSE; Business Standard, December 2025; LiveLaw on UIDAI’s photocopy advice; India Briefing DPDP timeline.
Last checked: 9 October 2026. Rules change; confirm anything that affects your filings with your CA, lawyer or the issuing authority. This guide is general information, not legal or tax advice.
Run it from one screen
GXP Next is a cloud property management system built in India. It brings bookings, OTA sync, GST invoices, guest ID capture, a Form-III queue, UPI and WhatsApp into one app that runs in your browser. It is free forever for properties with up to 3 rooms. Book a free demo.
