Resources Categories
INDUSTRY FACT FILE · HOSPITALITY, TRAVEL & TOURISM
Industry Overview: Hospitality, Travel and Tourism in India
Who runs India's hotels, travel platforms, tour operators, restaurants and venues, the payment, data, tax, immigration and cyber obligations that apply, who buys cybersecurity and why each type of business needs a distinct approach.
|
In this document 1. Why hospitality and travel cybersecurity matters now 2. The ecosystem at a glance 3. Categories of hospitality, travel and tourism businesses 4. The payment, data, tax, immigration and cyber framework at a glance 5. Government, industry and private participants 6. Who buys cybersecurity inside a hospitality or travel company 7. Why each type of business needs a different approach 8. How Codec Networks works with hospitality and travel companies |
|
Sector scope Sector: hotel chains and owners, online travel agencies and booking platforms, tour operators, restaurant and QSR chains, event venues, loyalty and travel technology providers. Primary service proposition: guest data protection, booking and payment security, Wi-Fi testing, SOC and brand monitoring. Aviation, railways and retail have separate fact files. |
1. Why hospitality and travel cybersecurity matters now
India recorded 9.95 million foreign tourist arrivals in 2024 and close to 295 crore domestic tourist visits, with foreign exchange earnings from tourism of about ₹2.93 lakh crore. The sector spans international and Indian hotel chains, thousands of owners and franchisees, online travel agencies that sell most air tickets and a growing share of hotel rooms, tour operators and destination management companies, restaurant and quick-service chains, and convention centres and event venues. Several of the largest groups are listed, and a web of property management, channel management, booking engine, payment and Wi-Fi vendors runs much of the technology.
|
9.95 m Foreign tourist arrivals in India in 2024 |
339 m Guest records exposed in the Marriott Starwood breach |
£18.4 m UK ICO fine imposed on Marriott in 2020 |
6 hours To report cyber incidents to CERT-In |
Every stay leaves a data trail. Hotels collect passports and identity documents at check-in, report foreign guests to the Bureau of Immigration through Form C within 24 hours, take card payments at the front desk, in restaurants and through booking engines, run guest and conference Wi-Fi, and hold loyalty profiles and travel histories across brands. That data sits in vendor-run platforms, is shared with OTAs and payment providers and is reached by staff at hundreds of properties—an attack surface that criminals have learned to exploit.
The incidents are large and well documented. Marriott disclosed in 2018 that its Starwood reservation database had been accessed since 2014, exposing about 339 million guest records including unencrypted passport numbers; the UK ICO fined it £18.4 million in 2020 and a US$52 million settlement with US state attorneys general followed in 2024 alongside an FTC order. In September 2023 attackers linked to Scattered Spider disrupted MGM Resorts' reservations, room keys and casino systems and stole Caesars' loyalty database. Sabre's SynXis reservation platform leaked hotel card data in 2017, Omni Hotels suffered a multi-day outage in 2024 and the Otelier breach exposed reservation data for major brands in 2024-25. Phishing campaigns against hotels' Booking.com extranet accounts now message guests directly for payment. In India, Cleartrip confirmed a security incident in its internal systems in July 2022, and Taj Hotels said in November 2023 that it was investigating a threat actor's claim to hold 1.5 million customer records.
The obligations are converging. CERT-In's Directions require six-hour incident reporting and 180-day logs; its 2025 audit guidelines expect independent audits covering applications and cloud. RBI's card-on-file tokenisation has prohibited merchants from storing card data since October 2022, and PCI DSS v4.0.1 applies to payment environments. The DPDP Act and Rules will govern guest, loyalty and employee data from May 2027. The Immigration and Foreigners Act 2025, in force since September 2025, continues Form C reporting of foreign guests; GST e-invoicing reaches most chains and the September 2025 GST change moved hotel rooms to 5 and 18 per cent slabs; listed companies disclose cyber incidents quarterly under SEBI's LODR. Brands, owners and OTAs add their own security standards by contract.
|
Key takeaway In hospitality and travel, cybersecurity is guest trust, payment integrity and brand reputation in one. Guest identity and card data, the booking and payment flows that move them, the vendors who hold them and the networks guests touch must be protected together. |
2. The ecosystem at a glance
Figure 1: India's hospitality, travel and tourism ecosystem.
3. Categories of hospitality, travel and tourism businesses
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Hotel chains and management companies |
Brands operating hotels under management contracts and franchises |
Listed and private Indian and global groups |
Companies Act; SEBI LODR (listed); CERT-In; DPDP; PCI DSS; immigration reporting |
|
Hotel owners and franchisees |
Owners of branded, boutique and budget properties |
Private companies and family groups |
Brand standards; CERT-In; DPDP; PCI DSS; GST; state licences |
|
Online travel agencies and booking platforms |
Air, hotel, bus, rail and holiday booking, metasearch |
Listed and private technology companies |
Consumer Protection (E-Commerce) Rules; RBI tokenisation; DPDP; CERT-In |
|
Tour operators and destination management |
Inbound, outbound and domestic packages, MICE |
Private companies, Ministry of Tourism-recognised operators |
Ministry of Tourism recognition; DPDP; CERT-In; partner contracts |
|
Restaurants and QSR chains |
Dine-in, delivery, cloud kitchens, franchising |
Listed and private chains |
FSSAI; GST; PCI DSS; DPDP; CERT-In |
|
Event venues and convention centres |
Conferences, exhibitions, weddings, banquets |
Public and private operators |
State licences; PCI DSS; DPDP; CERT-In |
|
Loyalty and travel technology providers |
PMS, channel managers, booking engines, loyalty, payment and Wi-Fi vendors |
Private vendors, global SaaS |
Customer contracts; DPDP as processors; PCI DSS; CERT-In |
|
Attractions and leisure |
Parks, resorts, wellness, cruises, experiences |
Private operators, state tourism boards |
State rules; DPDP; PCI DSS; CERT-In |
4. The payment, data, tax, immigration and cyber framework at a glance
|
Instrument or expectation |
What it means for hospitality and travel companies |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, cloud and applications |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notices, consent, safeguards, retention limits and breach intimation for guest, loyalty, employee and CCTV data; most obligations from May 2027 |
|
RBI card-on-file tokenisation (from 1 October 2022); PCI DSS v4.0.1 |
Merchants and payment aggregators may not store card numbers; tokens replace them; PCI DSS governs booking engines, PoS and payment environments |
|
Immigration and Foreigners Act 2025 and Rules; Form C |
Hotels and other accommodation providers report foreign guests to the Bureau of Immigration within 24 hours of arrival—identity data that must be handled securely |
|
GST law: e-invoicing and the 2025 rate change |
E-invoicing for businesses above the turnover threshold (₹5 crore since August 2023); hotel rooms taxed at 5 per cent up to ₹7,500 and 18 per cent above from 22 September 2025 |
|
SEBI LODR Regulations (listed companies) |
Cyber incidents and data loss disclosed in the quarterly corporate governance report |
|
Brand, owner, OTA and card-scheme standards |
Contractual security standards, audits and breach notification between brands, owners, OTAs, acquirers and schemes |
|
How these apply Payment obligations depend on your role in the card flow; immigration reporting on whether you accommodate foreign guests; cyber obligations are cross-sector and depend on listing status. Confirm against the official instruments and your contracts. |
5. Government, industry and private participants
- The Ministry of Tourism and state tourism boards promote destinations and run voluntary hotel classification through the Hotel and Restaurant Approval and Classification Committee.
- The Ministry of Home Affairs and the Bureau of Immigration administer Form C reporting; CBIC and GST authorities administer e-invoicing and rates; FSSAI licenses food businesses.
- CERT-In handles incident response; MeitY administers DPDP; RBI regulates payments and tokenisation; SEBI governs listed-company disclosure.
- Hotel chains, owners and franchisees run properties; OTAs and booking platforms distribute inventory; tour operators and venues deliver experiences.
- PMS, channel manager, booking engine, payment, loyalty and Wi-Fi vendors operate most of the sector's technology.
- Acquirers, payment gateways and card schemes process payments and enforce PCI DSS.
6. Who buys cybersecurity inside a hospitality or travel company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CEO |
Guest trust, brand reputation, disclosure, owner relations |
Board advisory, resilience programmes, crisis exercises |
|
CISO, CIO and CTO |
IT and application security, audits, vendor risk |
Audits, assessments, SOC, GRC programmes |
|
Revenue, distribution and e-commerce |
Booking engine uptime, OTA integrations, fraud |
Platform and API testing, extranet controls |
|
Property and general managers |
Check-in continuity, Wi-Fi, PoS, keys |
Property assessments, Wi-Fi testing, playbooks |
|
Finance and payments |
PCI DSS, chargebacks, payment fraud |
PCI DSS readiness, payment flow controls |
|
Loyalty and marketing |
Member accounts, CRM data, campaigns |
Loyalty fraud controls, DPDP |
|
Legal, privacy and compliance |
DPDP, Form C, SEBI, contracts |
Privacy programmes, incident records |
|
Procurement and asset management |
Vendor, brand and owner obligations |
Third-party programmes, standards audits |
7. Why each type of business needs a different approach
|
Business type |
Highest-consequence risk |
Starting point for assurance |
|
Hotel chain |
Multi-property breach through PMS or vendor platforms |
Vendor assurance, DPDP programme, SOC across properties |
|
Hotel owner or franchisee |
Ransomware halting check-in, PoS and keys |
Property assessment, segmentation, backups, Wi-Fi testing |
|
OTA or booking platform |
API and account takeover at scale; payment fraud |
Application and API testing, bot defence, PCI DSS |
|
Tour operator |
Payment diversion and partner data leaks |
Payment verification, partner programme, awareness |
|
Restaurant or QSR chain |
PoS malware and delivery platform compromise |
PoS and app testing, PCI DSS scoping |
|
Event venue |
Conference network exposure and ticketing fraud |
Wireless testing, segmentation, event monitoring |
8. How Codec Networks works with hospitality and travel companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For hospitality and travel companies we deliver DPDP programmes for guest data, booking engine, app, OTA integration and payment testing, PCI DSS v4.0.1 readiness, guest and conference Wi-Fi testing, vendor and platform assurance, 24x7 SOC with brand monitoring and crisis exercises with properties and vendors—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, tax or regulatory advice. Obligations differ by business model, payment role, listing status, brand and owner contracts and the data held; confirm them against the official CERT-In, MeitY, RBI, PCI SSC, MHA, CBIC, Ministry of Tourism and SEBI instruments and your contracts.