It is 10:40 on a Sunday night in Lucknow.

Priya has finally got the whole family to agree on Singapore for the December holidays. She opens a travel app, picks a flight and a hotel near the river, and starts typing. Four names, exactly as they appear on four passports. Four passport numbers and expiry dates. Her nine-year-old son's date of birth. A vegetarian Jain meal for her mother-in-law. Wheelchair assistance at the airport, because the knee surgery was only in August. She pays with a saved card, gets an OTP, and closes the app at 10:51.

Eleven minutes.

By the time she puts the phone on the charger, those details have reached an airline, a hotel in another country, a global distribution system, a payment gateway, her bank, a fraud screening engine, an SMS gateway, an email service, a travel insurer, a cab partner in Singapore, a cloud server, two analytics tools and a customer relationship platform. She has heard of perhaps three of them.

Nothing about this is sinister. It is simply how modern travel works. But under the Digital Personal Data Protection Act, 2023, one organisation in that long chain is answerable for all of it. Not the airline. Not the cloud provider. The platform she booked through.

This article is for the people who run those platforms, and for everyone else in the travel business who is quietly wondering how much of this applies to them. Large online travel agencies, global hotel booking sites selling into India, hotel chains with their own booking engines, visa and tour operators, corporate travel desks, and the two-person agency that still does most of its work on WhatsApp.

Travel is a data business that happens to sell holidays

Strip away the beach photographs and an online travel agency is a matching engine. It matches a person's dates, budget and preferences against millions of seats and rooms, earns a commission or service fee on the match, and then tries to sell the same person insurance, a cab, a visa, a forex card and next year's holiday.

Every one of those steps runs on personal data, and much of it is data that no other kind of online business needs. A shoe retailer never asks for your passport. A food delivery app never needs your child's date of birth. A travel platform needs both before it can issue a single ticket.

Business model	How it makes money	Personal data it cannot avoid
Flights	Commission or service fee per ticket, ancillaries like seats and meals	Name as on ID, date of birth, passport for international trips, contact details
Hotels, merchant model	Platform collects payment, pays the hotel later, keeps the margin	Guest names, payment data, arrival details, special requests
Hotels, agency model	Commission from the hotel, guest pays at the property	Guest names and contacts passed to the hotel for check-in
Holiday packages	Bundled margin across flights, stays, transfers and activities	Everything above, plus documents for visas and tour vouchers
Add-ons	Insurance, visas, forex, cabs, activities, often via partners	Nominee details, bank statements, pick-up addresses, ID copies
Loyalty, wallets, co-brand cards	Repeat bookings and partner revenue	Transaction history, spend patterns, KYC through the card partner

Conversion is everything in this industry, so the analytics layer is thick. Search history, abandoned carts, price alerts, device fingerprints and retargeting pixels are how a platform turns a Tuesday lunchtime browse into a Friday night booking. That layer is also where most of the uncomfortable DPDP questions live.

What a traveller hands over when they click “Book”

Data item	Why the platform asks	Sensitivity	Who else usually receives it
Name exactly as on ID	Airlines and hotels match it at check-in	Medium	Airline, hotel, GDS, insurer
Passport number and expiry	International ticketing and border rules	High	Airline, and through it border authorities
Date of birth	Fare type, infant and child rules, insurance	Medium, high for minors	Airline, insurer
Mobile and email	Confirmations, changes, OTPs	Medium	SMS, WhatsApp and email gateways, airline, hotel
Card token or UPI ID	Payment	High	Payment gateway, bank, fraud screening
GST number and company name	Business travel invoices	Low to medium	Tax systems, employer's travel desk
Meal and assistance requests	Service on the day	Reveals religion or health	Airline, hotel
Search and browsing history	Recommendations and retargeting	Medium	Analytics, ad and attribution tools
Co-traveller details	Everyone on the booking must be named	High	Everyone above
Visa documents	Tour and visa packages	High	Visa facilitation partner, consulate processes

The quiet problem of what preferences reveal

The DPDP Act does not create a special list of “sensitive” data the way some foreign laws do. That does not make every field equally harmless. A Jain meal request says something about religion. A wheelchair request says something about health. A package to a pilgrimage circuit, a stay near a cancer hospital, or a room tagged “honeymoon” each says something the traveller may never have intended to tell a marketing system.

The sensible approach is to treat these fields as operational only. They go to the airline or the hotel so the service happens on the day, and they never feed segmentation, lookalike audiences or retargeting. Picture a family laptop that suddenly fills with adverts for fertility clinics abroad because someone searched once. That is the kind of harm the law is designed to prevent, even where no rule names it explicitly.

Fourteen hands on one booking

Go back to Priya's eleven minutes. Here is where her family's data actually went.

The legal question for every line on that diagram is the same: is this partner acting on the platform's instructions, or deciding its own purposes? The first is a Data Processor, and the platform remains accountable for what it does. The second is an independent Data Fiduciary with its own obligations, and the platform's job is to tell the traveller that the hand-off happens.

Partner	What it receives	Usual role	What must be in place
Airline	Names, DOB, passport, contacts, meal and assistance requests	Independent fiduciary	Traveller told that data goes to the carrier. The airline shares passenger data with border authorities under its own obligations.
Hotel	Guest names, arrival time, requests, sometimes payment	Independent fiduciary	Notice covers the hand-off. The hotel runs its own guest register and ID checks.
GDS or bed bank	Booking records and passenger details	Grey zone	A contract that states the role for each data flow, in writing.
Payment gateway	Card token, UPI, billing details	Independent fiduciary for payment regulation	PCI-grade integration, no raw card storage on your side.
Fraud screening	Device, IP, behaviour, payment signals	Grey zone	Clarity on whether signals are reused across the vendor's other clients.
SMS, WhatsApp, email	Names, numbers, booking references	Processor	Data protection terms, sub-processor list, retention limit on message logs.
Call centre	Full booking view, call recordings	Processor	Screen masking, recording retention, no personal phones on the floor.
Analytics and ad tools	Behaviour, device IDs, conversion events	Processor	Consent where required, no sensitive preferences passed, tag inventory.
Travel insurer	Traveller identity, trip dates, nominee	Independent fiduciary	Separate, clear consent at the point insurance is offered.
Cloud hosting	Everything	Processor	Region clarity, encryption, access logs, breach notification terms.

THE PART MOST TEAMS MISS Calling a partner an “independent fiduciary” does not make the problem go away. It changes what you owe. You still chose to send them the data, so the traveller must be told it happens, and you still need to be able to show why each field travelled. Accountability for the choice to share never leaves the platform.

Why travel sits at the heavy end of DPDP

Every business that processes personal data is inside the law. Travel is inside it more deeply than most, for six very specific reasons.

• Government identity documents are routine, not exceptional. A passport number is worth far more to a fraudster than a delivery address.
• The data crosses borders by design. An international booking cannot happen without it.
• The partner chain is long, and many partners are abroad.
• Children sit inside ordinary bookings. Every family holiday involves a minor's data.
• Preferences reveal religion, health and life events, as described above.
• Travel data is a favourite tool of scammers, because a message that quotes your real hotel and real dates is very easy to believe.

The life of a booking, and where the law bites

Stage	What data moves	The DPDP obligation that bites
Search	Destination, dates, device, location, cookies	Tracking and profiling need a proper basis before they start, not after the first page view
Shortlist	Viewed properties, price alerts, wishlists	Price-drop and retargeting messages are marketing and need separate consent
Traveller details	Names, DOB, passports, co-travellers	A clear notice at the moment of collection, covering every recipient
Payment	Card token, UPI, billing, GST	Reasonable security safeguards, tokenisation, no raw card storage
Ticketing and confirmation	Data sent to airline, hotel, GDS	Documented roles, processor contracts, purpose limits
Pre-trip	Reminders, web check-in, insurance, visa	Messages stay within the stated purpose. No quiet upsell lists.
Travel and stay	Check-in ID, room, support calls	Breach readiness and call-centre access controls
After the trip	Reviews, refunds, dormant account	Retention limits, erasure, and advance notice where the Rules require it

How the DPDP Act binds a travel business

Now to the heart of it. Here is what the law actually asks of a travel company, one obligation at a time, with the travel-specific twist for each.

It reaches you even if your headquarters are abroad

The Act applies to personal data processed in India. It also applies to processing outside India when it is connected to offering goods or services to people in India. A global hotel booking site with servers in Europe and a rupee checkout for Indian users is in scope for those users. “We are not an Indian company” is not an answer the Data Protection Board is obliged to accept.

Notice comes before the form, not in the footer

At the point where traveller details are collected, the platform must tell people, in plain language, what it is collecting, why, who it will be shared with, how to withdraw consent and how to complain. On a mobile checkout, that means a short, layered notice right beside the passenger form, with the full version one tap away. It must be available in English and the languages listed in the Constitution, which matters in a market where a large share of new travellers book in Hindi and regional languages.

The booking is not the brochure

Data a traveller gives to complete a booking can be used to complete that booking. Using the same data for price-drop campaigns, retargeting across the internet, sharing with a co-brand credit card partner, or building a “likely honeymoon couple” segment is a different purpose, and it needs its own clear, specific and freely given consent. A single “I agree to the terms” checkbox at payment does not stretch that far.

Withdrawal must work as easily as sign-up. If a traveller turns off marketing, the suppression has to reach the email tool, the WhatsApp tool and the ad audiences, not just a flag in the main database.

The co-traveller problem

This is the issue travel companies raise most often, and it has no neat answer in the text of the law. One person books. Four people's data enters the system. Only the booker ever sees the notice.

Practical measure	Why it helps
A short notice sent to each adult traveller with a contact	Gives the people who never touched the app a real chance to know what happens to their data
A booker declaration at checkout	Records that the booker confirmed they were authorised to share the others' details
Minimal co-traveller fields	If the airline only needs name, date of birth and passport, do not ask for their email and phone as well
No marketing to co-travellers	They never chose a relationship with you. Do not create one on their behalf.
Saved traveller lists with an expiry	Profiles of relatives saved for “faster checkout” should not live forever

Children and infants are not a checkbox

Anyone under 18 is a child under the Act. Processing a child's data requires verifiable consent from a parent or lawful guardian, and platforms may not carry out tracking, behavioural monitoring or targeted advertising directed at children. Some healthcare, education and childcare providers get narrow, conditional relief for specific purposes. Travel platforms are not on that list.

In most family bookings a parent is the one booking, which helps. It does not remove the need to show how you established that, to keep the child's data out of every marketing pipeline, and to stop teenage users who create their own accounts from being profiled like adults. A school trip booked through a platform brings the same obligation in bulk: thirty children's passports and birth dates in a single transaction.

Rights: when Ananya's ticket says Anaya

A traveller notices that her daughter's name is misspelled on an international ticket. Under the DPDP Act she has a right to have inaccurate personal data corrected, and the platform must make that request easy to raise and act on it. The airline's own name-change rules still apply to the ticket itself, but the platform's records, and the correction it passes on, are its responsibility.

The same applies to access and erasure. A traveller can ask what you hold about them and ask for it to be erased once the purpose is over, subject to any law that requires you to keep it. Grievances must be resolved within a reasonable period and no later than ninety days. For a large platform, that means a ticketed rights workflow, not a shared inbox.

Keep it, delete it, or never store it at all

Retention is where travel companies most often discover that different laws pull in different directions. The honest answer is that it depends on the record.

Record	Rule that applies	How it interacts with DPDP
Full card numbers	RBI card-on-file tokenisation	Merchants may not store full card numbers. Tokens only, so this data should never be in your systems at all.
Processing logs and traffic data	DPDP Rules	Keep for at least one year from processing, then erase unless another law needs them longer.
System logs for security	CERT-In directions	Maintain ICT logs for a rolling 180 days within India. The DPDP one-year floor effectively covers this.
Tax invoices and GST records	GST law	Kept for 72 months from the due date of the annual return. Keep the invoice, not the entire traveller profile.
Inactive accounts on large platforms	DPDP Rules, Third Schedule	E-commerce entities with two crore or more registered users in India must erase after three years of inactivity, with 48 hours' notice first.
Passport and ID data after the trip	DPDP purpose limitation	Once the travel and any legal retention need is over, it should go. “Faster checkout next time” is a choice the traveller makes, not you.
Foreign guest records at hotels	Registration of foreigners rules	Hotels report foreign guests' arrival within 24 hours. That duty sits with the hotel, not the booking platform.

Security and breach: the fake hotel message

Here is a scam that travel teams everywhere will recognise. A guest receives a WhatsApp message two days before check-in. It quotes the correct hotel, the correct dates and the correct booking reference. It says the reservation will be cancelled unless the card is “re-verified” through a link. The guest, reasonably, believes it.

The details came from somewhere real: a compromised partner login, an exposed storage bucket, an insider, or a phishing attack on hotel staff. Under the DPDP Act, a personal data breach must be intimated to affected individuals without delay and to the Data Protection Board, followed by a detailed report to the Board within 72 hours. The largest penalty band in the Act, up to 250 crore rupees, attaches to failing to take reasonable security safeguards.

For a travel business, breach readiness therefore has two halves. The first is the usual one: detect, contain, report. The second is specific to this industry: warn customers proactively, in the app and on every confirmation, that you will never ask them to re-enter card details over WhatsApp. That single line on a confirmation email prevents more harm than most security tools.

The trip is international, so is the data

The DPDP Act allows personal data to be transferred outside India except to countries the government restricts by notification. That is a lighter model than many expected, but it has a precondition: you have to know where your data actually goes. The hotel's property system in Bangkok, the GDS data centre, the cloud region, the call-centre vendor's backup site and the analytics tool's servers all count. Sectoral rules can add stricter requirements, and a platform that also serves European travellers will meet GDPR's separate transfer rules for their data.

The likely Significant Data Fiduciaries

The government can designate a business as a Significant Data Fiduciary based on the volume and sensitivity of the data it processes and the risk to individuals. Large online travel agencies tick almost every box: crores of users, identity documents, children's data and constant cross-border transfers.

Designation brings a Data Protection Officer based in India, an independent data auditor, an annual Data Protection Impact Assessment and audit, and due diligence to verify that technical measures, including algorithmic software, do not put travellers' rights at risk. That last point deserves attention in travel, where ranking algorithms and dynamic pricing decide what each person sees and pays.

The whole law, on one page

DPDP obligation	What it means for travel	Everyday example
Territorial reach	Foreign platforms selling to Indians are covered	A global hotel site with a rupee checkout
Notice	Short, layered, at the passenger form, in Indian languages	A one-screen summary beside the traveller details
Consent	Booking and marketing kept apart	Price-alert opt-in separate from payment
Children	Verifiable parental consent, no child-directed tracking or ads	Infant on a family booking kept out of all segments
Rights	Access, correction, erasure, grievance within 90 days	Fixing a misspelled name on a record
Retention	Delete when the purpose ends, subject to other laws	Passport data erased after the trip
Security	Encryption, masking, access control, logs for a year	Call-centre screens mask passport numbers
Breach	Tell individuals and the Board, detailed report in 72 hours	Leaked booking references used for scams
Processors	Accountability stays with the platform	Contract with the SMS gateway covering deletion
Cross-border	Allowed except to restricted countries	Knowing where the GDS stores data
SDF duties	DPO, audit, DPIA, algorithmic due diligence	Reviewing dynamic pricing for fairness risk

Five travel businesses, five different loads

Every travel business is inside the law. Not every one carries the same weight.

1. The large online travel agency

Flights, hotels, buses, holidays, visas, insurance and a loyalty programme, serving crores of Indian users on app and web, with a large call centre and a heavy performance marketing engine. This is the full picture described throughout this article: passports, children, cross-border flows, dozens of partners, dynamic pricing and a realistic prospect of designation as a Significant Data Fiduciary. At this scale the three-year inactivity erasure rule for large e-commerce entities is also likely to apply.

Compliance load: the heaviest in the sector. Needs automated discovery, per-purpose consent records, a rights workflow, scheduled erasure, a partner register with roles, and SDF-grade governance.

2. The global booking platform selling into India

Headquartered abroad, with an Indian-language app, rupee pricing and Indian payment options. Its systems, support teams and partner hotels may be spread across several countries. Because it offers services to people in India, the DPDP Act applies to its processing of their data, alongside whatever regimes apply at home. The distinctive challenge is making a global privacy programme speak India's specifics: Indian-language notices, Indian grievance timelines, children's rules that differ from other markets, and a clear map of where Indian travellers' data flows.

Compliance load: very heavy. The law is familiar in spirit, but the local details are where global templates fail.

3. The hotel chain with its own booking engine

Thirty properties, a direct booking website, a loyalty programme, and a steady flow of guests arriving through online travel agencies. The chain is a Data Fiduciary for direct bookings and loyalty members, and an independent fiduciary for guests who booked elsewhere once they arrive. At the property it also holds ID copies at the front desk, foreign guest reports, CCTV footage, Wi-Fi login data, spa and restaurant records, and staff data.

The weak spot is usually physical: photocopies of ID cards in a front-desk drawer, or scanned into a shared folder, long after the guest has checked out.

Compliance load: substantial. The digital side resembles e-commerce. The property side adds ID handling, CCTV and a large, rotating workforce.

4. The visa and international tour operator

Group tours to Europe and Southeast Asia, with visa assistance included. To build a visa file it collects passports, photographs, bank statements, salary slips, income tax returns, employer letters and sometimes previous visa refusals. Much of it arrives as photos on WhatsApp and PDFs by email, then sits in a shared drive indefinitely.

For its size, this is one of the most sensitive data sets in the entire sector. A single leaked visa folder is enough to open a bank account or take a loan in someone's name.

Compliance load: heavy, regardless of company size. Priority is secure document collection, strict access, and deletion of visa files once the application is decided.

5. The corporate travel management company

A B2B business that manages travel for employers. It holds employee names, passport details, travel patterns, hotel stays and expense data, on behalf of client companies. For that data the employer is usually the Data Fiduciary and the travel management company is its processor, which means the obligations arrive through client contracts rather than directly from travellers. It is still a fiduciary for its own staff, prospects and website visitors.

Compliance load: moderate to heavy, driven by client contracts, audit rights, and the sensitivity of knowing where executives are at any given moment.

AND THE SMALL AGENT ON WHATSAPP A two-person agency with a WhatsApp Business number and a phone gallery full of passport photos is a Data Fiduciary too. The practical minimum is not expensive: a separate work phone, screen lock and backup encryption, a monthly habit of deleting documents for completed trips, a one-paragraph notice sent to clients, and a written note of which partners receive what. That alone puts a small agent ahead of many larger competitors.

Business type	Distinctive data	Biggest pressure point	Load
Large OTA	Passports, children, payments, behaviour at scale	SDF duties, consent at scale, partner chain	Heaviest
Global platform selling into India	Indian users' data processed abroad	Localising notice, rights, children's rules	Very heavy
Hotel chain	Guest IDs, loyalty, CCTV, Wi-Fi	Front-desk ID handling, OTA and direct split	Substantial
Visa and tour operator	Bank statements, ITRs, visa files	Document collection and deletion	Heavy
Corporate travel manager	Employee travel patterns	Client contracts and audits	Moderate to heavy
Small travel agent	Passports on phones and chats	Device security and deletion habits	Light, never zero

Partner contracts that actually protect you

In travel, the partner list is the risk list. Most platforms have dozens of integrations signed years ago on commercial terms, with privacy as an afterthought. These are the clauses worth checking first.

Clause	Why it matters in travel	Red flag
Role of each data flow	GDS, bed banks and fraud tools can be processors for one flow and fiduciaries for another	The contract never says
Purpose limitation	Stops partners reusing traveller data for their own marketing	“To improve our services” with no limit
Breach notice to you, in hours	Your 72-hour clock depends on theirs	No timeline, or one measured in weeks
Sub-processors and locations	Travel partners often subcontract abroad	Blanket permission, no list
Deletion on exit	Old partners holding old passports is live exposure	No exit obligation
Security baseline	Hotels and small partners are frequent phishing targets	“Industry standard” and nothing else
Cooperation on rights requests	A correction or erasure must reach the partner too	No duty to assist

Twelve moves to a travel-ready DPDP programme

#	What it looks like in a travel business	Evidence it leaves behind
1	A named privacy owner, and a DPO in India if designation is likely	Appointment note, published grievance contact
2	Every field mapped from first search to dormant account	Data inventory and record of processing
3	A role written down for every partner and every data flow	Partner register with roles
4	Booking and marketing consent separated, withdrawal wired to every tool	Consent logs with timestamps and versions
5	Co-traveller notice and booker declaration in the checkout	Notice templates, delivery logs
6	Children's data handled on its own track, out of all marketing	Age logic, guardian consent records, exclusion rules
7	Passport and ID data masked on screens and expired after travel	Masking configuration, deletion logs
8	Tokenised payments, no card data anywhere in your systems	Payment integration review
9	Retention period per record type, reconciled with other laws	Retention schedule
10	Data protection terms signed with priority partners	Signed agreements, due-diligence notes
11	Breach drill including a customer scam-alert message	Tabletop report, incident plan
12	All of the above kept dated and in one place	The evidence file itself

Six things travel teams say that the law does not accept

The first myth is the most expensive. Airlines and hotels certainly have obligations of their own, but the platform decided to collect the data, decided what to ask for, and decided whom to send it to. That makes it a Data Fiduciary for everything that happened on its own app and website, whatever the airline does next.

The first ninety days

Period	Large platform	Hotel or tour operator	Small agent
Days 1 to 30	Appoint an owner, inventory every data field and partner, label roles	Appoint an owner, list booking engine, front desk, CCTV and document stores	Separate work phone, list where passports and IDs are kept
Days 31 to 60	Split consents, fix the passenger notice, co-traveller notice, children's track	Fix direct-booking notice, stop ID photocopies lingering, loyalty consent	Send a short notice to clients, delete completed-trip documents
Days 61 to 90	Retention schedule, partner contracts, breach and scam-alert drill, evidence file	Partner contracts with OTAs and vendors, breach plan, staff briefing	Write down which partners get what, set a monthly deletion reminder

A ten-question check for travel businesses

Answer yes or no. Each “no” is a task, not a crisis.

#	Question	If no, start at
1	Do we know every partner that receives traveller data, and the role of each?	Moves 2 and 3
2	Does our passenger form show a clear notice before the traveller types anything?	Move 4
3	Is marketing consent separate from booking, and does withdrawal reach every tool?	Move 4
4	Do co-travellers receive any notice at all?	Move 5
5	Are children's records excluded from every segment and ad audience?	Move 6
6	Are passport numbers masked for call-centre and support staff?	Move 7
7	Could we prove no full card number sits anywhere in our systems?	Move 8
8	Do we delete passport and visa documents once they are no longer needed?	Move 9
9	Could we report a breach to the Board within 72 hours, starting tonight?	Move 11
10	Do our confirmations warn guests we will never ask for card details on WhatsApp?	Move 11

Trust is the product

People hand a travel company their passport, their children's details and their card, and then trust strangers in another country to be expecting them when they land. That trust is the entire business. The DPDP Act simply writes down what travellers already assume: that the company they booked with knows where their data went, why it went there, and how long it will stay.

The platforms that treat this as a product question rather than a legal chore will find it becomes a selling point. “We delete your passport after your trip” is a sentence very few travel companies in India can say today. The first ones that can will not have to say much else.

ABOUT VAULTDEF VaultDef is a DPDP compliance platform built for Indian organisations. For travel and hospitality businesses it maps every booking data field across partners, manages layered notices and per-purpose consent, runs rights requests and scheduled erasure, tracks processor and cross-border flows, supports DPIAs, and keeps a tamper-evident evidence trail for customers, auditors and the Data Protection Board. Request a travel-sector walkthrough at vaultdef.com

Frequently asked questions

Does the DPDP Act apply to online travel agencies in India?

Yes. Any business that processes the digital personal data of travellers, such as names, passport details, contact information or payment data, is a Data Fiduciary under the Act, whatever its size.

We are a foreign hotel booking platform. Are we covered?

If you offer goods or services to people in India, your processing of their personal data is covered even if it happens outside India.

Who is responsible for traveller data: the platform, the airline or the hotel?

Each is responsible for its own processing. The platform is accountable for what it collects and for the partners it shares data with, and for any processors acting on its behalf. Airlines and hotels are usually independent fiduciaries for their own purposes.

Is a GDS a data processor?

It depends on the data flow and the contract. For some flows it acts on the booking platform's or airline's instructions, for others it may process for its own purposes. The role should be stated in writing.

How should travel companies handle co-travellers' data?

Collect only what the airline or hotel needs, send a short notice to each adult traveller where a contact exists, record the booker's confirmation that they may share others' details, and never add co-travellers to marketing.

Can we store passport details for faster checkout next time?

Only if the traveller chooses that, clearly and separately, and can remove it easily. Otherwise passport data should be erased once the trip and any legal retention requirement are complete.

How quickly must a travel company report a data breach?

Affected individuals and the Data Protection Board must be informed without delay, and a detailed report must reach the Board within 72 hours.

Can travel data be transferred outside India?

Yes, except to countries the government restricts by notification. Sector-specific rules may be stricter, and you must know where each partner stores data.

Will large OTAs be Significant Data Fiduciaries?

Designation is decided by the government, but high volume, identity documents, children's data and cross-border flows are exactly the factors it considers. Large platforms should prepare in advance.