Overview
MakeMyTrip (MMT) is India’s largest online travel company. The platform collects uniquely sensitive data: passport numbers, government ID documents, travel destinations (revealing religious pilgrimages, lifestyle choices, relationship patterns), hotel booking details, co-traveler information (revealing relationships), and payment data for high-value transactions.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
MMT’s consent is bundled for all travel services. Problematic data includes:
- Passport numbers and government IDs — shared with airlines and hotels without granular consent
- Travel destinations — Amarnath/Vaishno Devi bookings reveal religion; Goa party destinations reveal lifestyle
- Co-traveler details — Booking for a partner reveals relationships
- Hotel room preferences — Single vs. double, room type preferences
DPDP concern: Travel data reveals religion, relationships, and lifestyle choices. Enhanced consent beyond standard e-commerce is needed.
Section 7 — Certain Legitimate Uses ⚠️
Booking fulfillment requires sharing data with airlines/hotels. But:
- Post-travel retention for “recommendations” — needs separate consent
- Travel pattern analytics — overreach
- Third-party travel insurance data sharing — separate consent needed
Section 8 — Obligations of Data Fiduciary ⚠️
PCI compliance for payments is strong. However:
- Passport and ID document security needs enhanced encryption
- Hotel partner access to customer data varies by property
- Airline data sharing is governed by IATA, not Indian data protection law
Section 9 — Data Retention 🔴
No retention timelines for:
- Passport numbers and ID documents
- Travel booking history
- Hotel stay details
- Co-traveler information
- Destination search history
Critical question: Can MMT reconstruct 5 years of your travel history including every hotel you stayed at and every person you traveled with?
Section 11 — Rights of Data Principal 🔴
- No mechanism to delete passport data while keeping the account
- No transparency on travel data shared with airline/hotel partners
- No data portability for travel history
- No nomination rights
Section 12 — Right of Grievance Redressal ⚠️
Grievance officer exists. No DPB pathway. No mechanism for data complaints about partner hotels/airlines.
Section 16 — Cross-Border Data Transfer 🔴
International travel inherently involves cross-border data:
- Airline bookings: data sent to international airline systems (GDS)
- International hotel bookings: data shared with properties abroad
- Payment processing: international payment gateways
This is one of the most legitimate cross-border use cases but still needs DPDP-compliant safeguards.
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| Regulatory fine | High | Up to ₹250 Cr |
| ID document handling | Critical | Passport data breach = severe |
| Travel pattern inference | High | Religious/lifestyle patterns from destinations |
| Partner data sharing | High | Uncontrolled data flowing to hotels/airlines |
| Data retention | Critical | Complete travel diary with no deletion |
The Travel Data Inference Problem
Travel bookings reveal deeply personal information:
| Booking Type | Inference | Sensitivity |
|---|---|---|
| Amarnath/Vaishno Devi trip | Hindu religious practice | High |
| Haj/Umrah package | Muslim religious practice | High |
| Medical tourism destination | Health condition | Very High |
| Romantic getaway for two | Relationship | High |
| Solo hotel booking | Single status | Personal |
| Business class vs. economy | Income level | Moderate |
| Frequency of travel | Professional pattern | Moderate |
Recommendations
- Implement ID document security tier — Passport data encrypted at rest, masked in display, auto-deleted after trip completion
- Add destination sensitivity controls — Don’t use religious/medical travel destinations for marketing analytics
- Define travel data retention — “Active bookings: until trip completion; historical bookings: 2 years; passport data: deleted 90 days post-trip; search history: 6 months”
- Build partner data agreements — Ensure hotels and airlines handle Indian traveler data per DPDP
- Separate co-traveler consent — Co-travelers whose data is submitted by a primary booker should be able to control their own data
How Does Your Policy Compare?
Take the free 60-second DPDP Audit to check your own company’s liability under the DPDP Act — 16 quick questions, instant risk report.
Analysis conducted by DPDP Consulting, a Meridian Bridge Strategy initiative. For a comprehensive compliance roadmap, book a free consultation.