Can a hotel make a copy of your passport at check-in?

At a glance

A hotel can ask for ID to verify who you are — but whether it needs a full copy depends on who you are. For foreign guests, immigration law requires the hotel to report the stay, so passport details are genuinely needed. For Indian guests, verifying identity rarely requires a full passport or Aadhaar scan on file. Under India’s DPDP Act the hotel must limit what it collects, secure it, and delete it once the purpose ends — so you can question an unnecessary copy.

Educational resource only. This explains how hotels’ handling of your ID at check-in is treated under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

On this page

• Can a hotel ask for your ID at all?
• Foreign national? Why the rule is different for you
• Indian guest — do they need a full copy?
• What happens to the copy after you leave?
• What you can do about it
• FAQ

The situation

You reach the check-in desk and the clerk asks to photocopy or scan your passport, or snap your Aadhaar. It’s so routine that saying “why do you need a copy?” feels rude. But a copy of your passport or Aadhaar sitting in a hotel’s files — or a WhatsApp thread — is a real identity risk if it leaks, and whether the hotel actually needs it depends on details worth understanding.

Can a hotel ask for your ID at all?

Yes — verifying your identity is a legitimate purpose, so a hotel can ask to see ID; the real question is whether it needs to keep a copy. Your ID is personal data and the hotel holding it is a Data Fiduciary. Under the DPDP Act it must give a clear notice of why it’s collecting (Section 5), and its collection is limited to what the stated purpose needs (Section 6). Seeing and verifying your identity is one thing; taking and storing a full copy is a bigger step that has to be justified by an actual purpose — not habit.

Foreign national? Why the rule is different for you

If you’re a foreign guest, the hotel is legally required to report your stay to the authorities — so collecting your passport and visa details here is genuinely necessary. Indian immigration law requires anyone providing accommodation to a foreign national to file a report (the Form C process) with the Foreigners Regional Registration Office (FRRO), typically within 24 hours of arrival. To do that, the hotel must collect and verify your passport and visa. This is a legal obligation on the hotel, and it’s a clear case where the data is needed.

Even here, though, the minimisation and security duties still apply: the hotel should collect what the reporting needs, keep it secure, and not repurpose your passport copy for marketing or hand it around casually.

Indian guest — do they need a full copy?

For an Indian guest, verifying your identity usually doesn’t require a full passport or Aadhaar scan kept on file — and where some ID is needed, a masked version does the job. There’s no general central law forcing a hotel to photocopy an Indian citizen’s passport at check-in the way the foreigner-reporting rule does (some state police rules require a guest register, but that’s identity verification, not a mandate to hoard full ID scans). So the DPDP test applies in full: does keeping a complete copy actually serve a necessary purpose? Often it doesn’t.

Where the hotel genuinely needs to record an ID, you can offer a lighter proof — a driving licence or Voter ID, or a masked Aadhaar (which hides the first eight digits) — rather than a full passport or Aadhaar copy scanned “for records.”

What happens to the copy after you leave?

Whatever the hotel keeps must be secured and deleted once its purpose is over — an old ID copy shouldn’t sit on its systems indefinitely. The DPDP Act requires a Data Fiduciary to protect the data it holds and erase it once the purpose is served (Section 8). A stack of guest ID photocopies in a back office, or scans sitting in an unsecured folder or a staff WhatsApp group, is a security failure the hotel is liable for — not just untidy record-keeping. Once your stay (and any reporting duty) is done, there’s usually no reason for it to keep a full copy of your ID.

What you can do about it

Show ID rather than surrender a copy where you can, mask what you must give, and ask what happens to it.

1. Offer to show, not hand over. For verification, letting staff view your ID is often enough — ask whether a stored copy is really needed.
2. Give the masked or minimal version. A masked Aadhaar, or only the ID actually required — not your full document set.
3. Ask the purpose and the retention. Why is a copy needed, where is it stored, and when is it deleted? A vague answer is a flag.
4. Avoid insecure channels. Don’t let your ID be sent over a personal WhatsApp or email; use the hotel’s proper process.
5. Escalate if mishandled. If a hotel over-collects, refuses to explain, or won’t delete an unnecessary copy, raise a grievance with it, then the Data Protection Board of India.

FAQ

Can a hotel legally photocopy my passport? It can verify your ID, and for foreign guests it must collect passport and visa details to file the required stay report. For an Indian guest, a full stored copy usually isn’t necessary — you can ask why it’s needed and offer a masked ID instead.

Why do hotels insist on ID for foreigners specifically? Because immigration law requires the hotel to report a foreign national’s stay to the FRRO (the Form C process), which needs passport and visa details. That’s a legal duty on the hotel.

Can I refuse to give my Aadhaar at a hotel? You can decline a full Aadhaar copy where it isn’t necessary and offer a masked version or another ID. No private business can force Aadhaar-based biometric authentication either.

Is it safe for a hotel to keep a copy of my ID? Only if it’s needed and properly secured. The hotel must protect it and delete it once the purpose is over; loose copies in drawers or chat apps are a security failure.

How long can a hotel keep my ID copy? As long as the purpose — your stay and any legal reporting — lasts. After that, the DPDP Act’s erasure duty means it should be deleted, and you can ask for confirmation.