Hotels in India routinely ask guests for identity documents at check-in. The request is familiar, but the way properties handle it varies widely: some photocopy every page, some photograph documents on a personal phone, and some keep copies in an unlocked drawer for years.
Identity documents are among the most sensitive personal information a hotel holds. A clear process for checking, storing and eventually deleting them protects guests and reduces the hotel's own risk.
Why ID verification needs a process
The purpose of checking identity is narrow: to confirm that the person checking in is who the booking says, and to meet the reporting and record-keeping rules that apply to the property. Every step beyond that purpose, such as keeping extra copies or sharing them over messaging apps, adds risk without adding value.
India's Digital Personal Data Protection Act, 2023 sets out duties for organisations that handle personal data, including using it for a specified purpose, protecting it with reasonable security safeguards and not keeping it longer than needed. Local police and state rules may also specify what hotels must record. Confirm the requirements that apply to your property with your local authorities and legal adviser, and build the desk process around them.
What to check at arrival
Verification is more than receiving a document. At arrival, the desk should check that:
- the name on the document matches the booking or is explained, for example a guest booking on behalf of a colleague;
- the photograph matches the person at the desk;
- the document appears genuine and is not expired;
- details needed for the guest register are recorded accurately.
Decide in advance whether every adult guest in a room needs to show identification, and apply that rule consistently. Inconsistent practice is where problems arise: one shift checks every adult, another checks only the lead guest.
The hotel check-in process places identity checks within the wider arrival workflow, alongside reservation review, room readiness and payment.
Indian guests and masked Aadhaar
Guests may offer different government-issued documents, such as a passport, driving licence, voter ID card or Aadhaar. Publish the documents your property accepts so staff are not improvising at a busy desk.
If you accept Aadhaar, prefer a masked Aadhaar, in which only the last four digits of the Aadhaar number are visible. UIDAI encourages the use of masked Aadhaar where the full number is not required. Guests can download it themselves, and staff should not ask for, photograph or store the full number when a masked copy serves the purpose. Train staff to check that a copy is genuinely masked before it is stored.
Foreign guests: passport, visa and Form C
For foreign nationals, the desk normally checks the passport and a valid visa, and the hotel must report the guest's stay through Form C on the Bureau of Immigration's online system. The reporting is generally expected within 24 hours of arrival; confirm the current timeline and procedure on the Bureau of Immigration website or with your local Foreigners Registration Office.
Make Form C part of the check-in checklist for foreign guests rather than a task someone remembers later. Record that it was submitted and by whom, so the property can show it was done if asked.
Store ID copies securely
Where the hotel needs to keep a copy of an identity document, store it in a system designed for sensitive data rather than in email, shared drives or staff phones. Good practice includes:
- keeping copies encrypted where they are stored;
- accepting only the file types you need, such as images or PDF, with a sensible size limit;
- removing location data and other hidden metadata from photographs;
- never printing or emailing copies unless there is a specific, recorded reason.
Paper copies need the same care. If a property still keeps printed registers or photocopies, lock them away, restrict who has the key and plan how they will be destroyed when no longer needed.
Limit who can view ID copies
Not everyone who works at the desk needs to open stored identity documents after check-in. Restrict viewing to roles with a genuine need, such as managers handling a police enquiry, and record each time a copy is opened along with the reason.
Access logs serve two purposes. They discourage casual browsing, and they let the hotel answer a guest or authority who asks who has seen a document. The staff access controls guide explains how to match permissions to responsibilities and review them when staff change roles.
Keep ID only as long as needed
Decide how long identity copies must be retained to meet the rules that apply to you, and delete them after that period. Retaining everything indefinitely increases the damage of any future breach without helping the hotel operate.
Deletion should be routine rather than a once-a-year clean-up. When a guest record is anonymised or a document is replaced with a newer copy, the old file should be removed as part of that action, not left behind in storage.
Train staff and handle requests
Most ID problems start with a well-meaning receptionist under pressure: a guest asks for their documents to be emailed, a caller claims to be from the police, or a colleague asks to see a copy "just to check". Give staff short written answers for these situations.
Requests from authorities should go to a manager, who verifies the request before sharing anything and records what was provided. Guests who ask what the hotel holds about them should receive a clear answer through a defined channel. Include ID handling in induction training and refresh it whenever the process changes.
How NivaasCloud handles guest ID documents
In NivaasCloud, staff can attach scans of identity documents to a guest at check-in or walk-in. Images and PDFs up to 5 MB are accepted; large photos are reduced in size and their hidden metadata is removed before upload. Files are stored encrypted rather than as ordinary images on a server.
Aadhaar copies are accepted only when staff confirm they are masked. Viewing a stored document requires the appropriate permission and a reason, and each view is written to the audit log. Stored files are removed when a document is replaced, when the guest record is anonymised, or when the retention period for the record ends.
See how guest records fit together on the guest management feature page, or book a NivaasCloud demo to walk through a check-in with ID upload and restricted viewing.
Common questions
Can a hotel keep a photocopy of Aadhaar?
Where an Aadhaar copy is needed, use a masked Aadhaar that shows only the last four digits, store it securely and keep it only as long as the applicable rules require. Avoid storing the full Aadhaar number when it is not necessary.
Do all guests in a room need to show ID?
Requirements can depend on local police instructions and the guest's nationality. Many hotels check every adult guest. Decide your rule after confirming local requirements, and apply it consistently across shifts.
What if a guest refuses to share ID?
Explain why the document is needed and which alternatives you accept. If the guest still cannot provide acceptable identification and the rules that apply to your property require it, follow your written policy and involve a manager rather than leaving the decision to the receptionist alone.