What a guest should be told before an Aadhaar check: consent and the DPDP Act

The Digital Personal Data Protection Act, 2023 puts consent and a clear notice at the centre of how personal data is handled. UIDAI describes the Aadhaar App as aligned with it. A hotel that verifies guests should do the same.

What the notice should say

• What is being asked for: name, age, last four digits, photograph, and anything else the hotel adds.
• Why: to confirm the guest's identity at check-in, and nothing else.
• How long it is kept after check-out, and that it is then deleted.
• What the guest may do: refuse, and check in with another ID; ask for a copy of their record; ask for deletion.
• Whom to write to with a question or complaint.

Before anything is read

The notice should come before the card is read or the data is shared, in a language the guest understands. In CheckInKYC the guest sees the notice link and agrees by starting the check, in English or Hindi, and sees exactly what will be shared before pressing Share.

Saying no must be easy

A guest who prefers not to use Aadhaar goes to reception, where staff can use another ID. Nobody should be refused a room for declining.

Acknowledge every attempt

The OVSE terms ask the verifier to tell the holder whether each verification succeeded or failed. CheckInKYC shows the result and a reference on screen and offers a printable receipt.

Keep the record of the consent

Record when the notice was shown, which version, and how the guest agreed. The record should not contain the guest's personal data.

This article explains public information in plain words, as of 18 October 2026. It is not legal advice and rules can change. CheckInKYC is operated by SWASTIK ENTERPRISES, a UIDAI-registered OVSE (No. OR11274063); nothing here says UIDAI endorses or certifies any hotel or product.