dpdpr.in
Am I covered?

The hotel insisted on keeping a photocopy of my Aadhaar, or refused me a room over ID

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

"The receptionist said no room without a photocopy of my Aadhaar. I offered my driving licence and a masked Aadhaar and she refused."

The situation in a citizen's own words, paraphrased from public reports. No names or personal details.

UIDAI says unlicensed private entities like hotels are not permitted to collect or keep Aadhaar copies. Offer a masked Aadhaar or another valid photo ID. A refusal only because of who you are is a separate matter for the police and the consumer helpline.

Safety first. Threatened or in danger: call 181 (women) or go to the nearest police station. Lost money: call 1930 at once.

Your rights

  • Right to use a masked Aadhaar. UIDAI says do not share a photocopy of your Aadhaar; use a masked Aadhaar showing only the last 4 digits, downloadable from myaadhaar.uidai.gov.in.
  • Right not to have your Aadhaar copied by unlicensed entities. UIDAI said in 2022 that hotels are not permitted to collect or keep copies of Aadhaar and that it is an offence under the Aadhaar Act.
  • Right to another way to identify yourself. UIDAI's offline verification rules say the entity must offer other viable ID and must not deny service if you can identify yourself another way.
  • Right to compensation for deficiency in service. Under the Consumer Protection Act, 2019 you can claim compensation before a Consumer Commission. File within 2 years.
  • Right to police help. The police must take your complaint about threats, stalking or harassment. You can also report online at cybercrime.gov.in.
  • DPDP rights from 13 May 2027. You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)).

How to fight it, step by step

One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to If it is fake.

  1. Save the evidence before you block or delete anything.
    What to write: A short note with the date, time, number used, and exactly what was said or what details they knew.
    What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen.
    What you get back: A record that cannot later be denied.
    How long to wait: Do this the same day.
  2. At the desk, offer a masked Aadhaar or let them scan the QR code (offline verification), or offer another valid photo ID.
    What to write: Nothing; say calmly that UIDAI asks hotels not to keep Aadhaar copies.
    What to attach: Your masked Aadhaar on your phone or on paper.
    What you get back: Check in without a full copy being kept.
    How long to wait: On the spot.
  3. If they insist, write to the hotel manager or the booking platform.
    What to write: Letter 2 below, question 6.
    What to attach: Booking ID and a photo of what was asked.
    What you get back: A written reply.
    How long to wait: 7 days.
  4. Complain to UIDAI by calling 1947 or using Grievance and Feedback on uidai.gov.in.
    What to write: Hotel name, address, date and what they kept.
    What to attach: Photos if any.
    What you get back: A complaint reference.
    How long to wait: Track as UIDAI says.
  5. Call the National Consumer Helpline on 1915, or file on consumerhelpline.gov.in.
    What to write: The company's name, your complaint number with it, what went wrong, and what you want (for example: action against the person, written confirmation, compensation).
    What to attach: Your complaint, the company's replies, and screenshots.
    What you get back: A docket number. The helpline takes your complaint up with the company. It is free and comes before a court case.
    How long to wait: Give it a few weeks. If nothing changes, go to the Consumer Commission.
  6. File a consumer case for deficiency in service on e-Jagriti.
    What to write: Who you are, the company, what service you used, what went wrong, the loss and distress caused, and the compensation you claim.
    What to attach: Everything above: evidence, letters, replies, helpline docket.
    What you get back: A case number and hearing dates. You can argue the case yourself. The District Commission hears cases where the value of what you paid is up to Rs 50 lakh, the State Commission up to Rs 2 crore, and the National Commission above that (2021 Rules).
    How long to wait: File within 2 years of the problem.
  7. Get a lawyer if the stakes are high.
    What to write: Nothing yet. Take your full file to the lawyer.
    What to attach: All of the above.
    What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages.
    How long to wait: Before you send any legal notice or file a suit. This page is not legal advice.

What people tried and what worked

  • People offered another ID or a masked Aadhaar, or refused.
  • Some were refused rooms; masked Aadhaar was suggested again and again.
  • A single reported case described a refusal after the ID was checked; it is listed here as a reported case.

Based on reports on public forums, and the news reports listed below. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route.

News reports

Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

Step 1: stay safe and find out who it is

  1. Do not share an OTP, PIN, password or card number.
  2. Ask for their name, company, role and ID. Write it down.
  3. Hang up and call the company on a number you find yourself, on its official website or app.
  4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below).

If it is genuine: hold the company accountable

Which rules this may break

  • UIDAI caution (PIB, 27 May 2022): hotels and similar unlicensed private entities may not collect or keep Aadhaar copies.
  • UIDAI Dos and Don'ts for offline verification: verify only with consent; offer alternatives; do not store the Aadhaar number unless redacted; tell UIDAI and you within 72 hours of misuse.
  • Consumer Protection Act, 2019: deficiency in service.
  • DPDP Act from 13 May 2027: purpose limitation and erasure.

What the company must do, and by when

  • Accept a masked Aadhaar or offline verification, or another valid ID.
  • Not keep an unmasked Aadhaar copy.
  • Delete copies when the stay is over, and say so in writing if you ask.

Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, The Manager, [Hotel or homestay name]
Subject: Please confirm whether this person works for you

Dear Sir or Madam,

I am your customer. My booking ID: [number].

On [date] at [time] I received a call or message from [phone number]. This is not an official number. The person said they were [name], [role or employee ID], from the hotel. They knew my [list the details they knew].

Please confirm in writing within 7 days:
1. Whether this person is your employee, agent, booking platform, staff member or partner.
2. If yes, their name, role and the agency they work for.
3. Whether you allow staff or agents to contact customers from personal numbers.
4. If they are not connected with you, please say so, so I can report the number.

Name:
Registered mobile number:
Date:

Letter 2: ask how your data got there

To: The Grievance Officer, The Manager, [Hotel or homestay name]
Subject: How did my personal data reach a personal phone? Complaint number [if any]

Dear Sir or Madam,

On [date] a person connected with you, [name if known], contacted me from a personal number [number] and knew my [details]. [Describe what they did.]

Please tell me in writing:
1. What personal data about me this person could see, and through which system or app.
2. Whether you shared my data with any agency, booking platform, staff member, partner or processor, and their names.
3. How my data reached a personal phone or account outside your official systems.
4. What action you have taken against the person or agency, including suspension while you investigate.
5. What you have done to stop this happening again.
6. Whether you kept a copy of my Aadhaar or other ID, where it is stored, who can see it, and when you will delete it.
UIDAI has said that unlicensed private entities such as hotels are not permitted to collect or keep copies of Aadhaar, and that it is an offence under the Aadhaar Act (PIB, 27 May 2022). UIDAI's instructions for entities doing offline verification say they must offer other ways to identify yourself, must not deny service if you can identify yourself another way, and must not store the Aadhaar number unless it is masked.

From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply.

Please reply within 7 days. If I do not hear from you, I will escalate to UIDAI, the National Consumer Helpline and the police.

Name:
Registered mobile number:
Date:

Evidence to keep

  • Screenshots of calls and messages with numbers, dates and times.
  • Order, booking, policy or account numbers.
  • Your complaint numbers and the company's replies.
  • A note of what the caller knew or did.

More in the evidence checklist.

Can you sue? What realistically happens

  • Consumer Commission: the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
  • IT Act section 43A (until 13 May 2027): if the company was negligent with sensitive personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
  • Civil suit for damages: possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
  • Police: only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
  • Realistic outcome: most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

From 13 May 2027: the Data Protection Board

From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

If it is fake: urgent steps

  1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud.
  2. Call 1930 if money was lost, then file on cybercrime.gov.in.
  3. Report the number on Chakshu (Sanchar Saathi).

Step by step guides:

Check and lock your Aadhaar

Check and lock your Aadhaar

You can see every time your Aadhaar was used for authentication, and lock your biometrics or your whole Aadhaar number. You need the mobile number registered with Aadhaar.

Keep this ready before you start:

  • Aadhaar number or Virtual ID (VID).
  • The phone with your Aadhaar registered mobile number.
  1. Open myaadhaar.uidai.gov.in, or the official Aadhaar app.
  2. Choose Aadhaar Authentication History. Enter your Aadhaar or VID and the OTP.
  3. Check each entry: the type, date and time, and the name of the agency (AUA) that asked.
  4. Take screenshots of any entry you do not recognise.
  5. To lock biometrics, use the biometric lock in the Aadhaar app or on the UIDAI website. Unlock only when you need to use your fingerprint or face.
  6. To lock your whole Aadhaar number you first need a 16 digit VID. Get one by SMS: send GVID, a space, and the last 4 or 8 digits of your Aadhaar to 1947 (for example GVID 1234).
  7. Call UIDAI on 1947 (voice menu 24x7; staff 7 AM to 11 PM Monday to Saturday, 8 AM to 5 PM Sunday), email [email protected], or use Grievance and Feedback on the UIDAI website.

Checked on 1 November 2026 against: UIDAI: Aadhaar authentication history, UIDAI: Aadhaar Online Services (biometric lock, Aadhaar lock, VID by SMS), UIDAI: grievance channels (1947, email, portal).

National Consumer Helpline, then the Consumer Commission

National Consumer Helpline, then the Consumer Commission

The National Consumer Helpline (NCH) is run by the Department of Consumer Affairs. It forwards your complaint to the company and tracks the reply. If that fails, you can file a case before a Consumer Commission on e-Jagriti.

Keep this ready before you start:

  • Bill, invoice, order ID or account number.
  • Your complaint to the company and its reply, if any.
  • Screenshots and dates.
  1. Call 1915 or 1800114000 (8 AM to 8 PM), or WhatsApp +91 8800001915.
  2. Or open consumerhelpline.gov.in and click Register Grievance. You can also use the NCH app or the UMANG app.
  3. Describe the problem, the company and what you want.
  4. Save the grievance number you are given.
  5. Use Track Your Grievance to see the company's reply. Use Upload Documents to add proof.
  6. If the company still does not fix it, you can file a consumer case on e-Jagriti, the official portal for Consumer Commissions. It uses OTP registration, online fees and virtual hearings.
  7. File the case within 2 years of the problem. This is the limit in section 69 of the Consumer Protection Act, 2019.

Checked on 1 November 2026 against: National Consumer Helpline (Department of Consumer Affairs), e-Jagriti: file a case before a Consumer Commission.

Related guides

See also when a platform shares your data with a third party and the escalation ladder.

Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

On this page
  1. Your rights
  2. How to fight it
  3. What people tried
  4. Step 1: verify
  5. If genuine
  6. Letters
  7. Can you sue?
  8. Data Protection Board
  9. If fake
  10. Sources