Overview
OYO operates across 800+ cities through a franchise model — OYO branded hotels are independently owned and operated. When a guest books, their personal data (ID documents, phone number, stay details) flows to both OYO’s platform and the independent hotel operator. This creates thousands of uncontrolled data access points.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
OYO guests provide:
- Government ID documents (Aadhaar, PAN, passport) — scanned and stored
- Phone numbers shared with hotel owners
- Stay patterns (frequency, locations, solo vs. couple bookings)
- Payment information
Unique concern: In India, OYO bookings have social stigma implications. “Couple bookings” and “local ID” policies create data that reveals sensitive personal situations. This data should have enhanced privacy protections.
Section 9 — Data Retention 🔴
No retention timelines for:
- ID document scans (Aadhaar numbers stored on hotel owners’ phones)
- Stay history across 800+ cities
- Co-guest information
- Booking modification patterns (room upgrades, late checkouts)
Section 11 — Rights of Data Principal 🔴
- Can guests request deletion from both OYO and the hotel operator?
- ID scans on hotel owners’ devices — uncontrollable
- No data portability for stay history
- No nomination rights
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| ID document handling | Critical | Aadhaar scans on thousands of hotel operators’ devices |
| Franchise data governance | Critical | Independent operators = uncontrolled data access |
| Stay pattern inference | High | Booking patterns reveal lifestyle and relationships |
| Data retention | High | ID documents with no defined lifecycle |
Recommendations
- Implement centralized ID verification — Hotels verify through OYO’s platform; never retain raw ID scans
- Establish franchise data agreements — All hotel partners must sign data handling commitments
- Mask guest phone numbers — Route communications through OYO platform
- Define stay data retention — “Active booking: until checkout + 24 hours; ID verification: system-verified, raw scans deleted; stay history: 1 year”
- Add enhanced privacy for sensitive bookings — Option to minimize data shared with hotel operators for privacy-sensitive stays
How Does Your Policy Compare?
Analysis conducted by DPDP Consulting, a Meridian Bridge Strategy initiative. For a comprehensive compliance roadmap, book a free consultation.