India: passenger data record

Data protection law and the Board

The Digital Personal Data Protection Act, 2023 is Act No. 22 of 2023 and received the assent of the President on 11 August 2023 ¹. Section 18 sets up the Data Protection Board of India on a date the Central Government notifies ¹.

Section 17(2)(a) lets the Central Government exempt a notified instrumentality of the State from the Act. The listed grounds include the sovereignty and integrity of India, security of the State and public order ¹. Section 16 lets the Central Government restrict transfers of personal data to notified countries outside India ¹.

The Press Information Bureau said on 17 November 2025 that the DPDP Rules, 2025 were notified on 14 November 2025 ². It said the Board has four members, works fully online and that its decisions can be appealed to the Telecom Disputes Settlement and Appellate Tribunal ². The Rules give an 18-month period for phased compliance ².

• Up to ₹250 crore for failing to keep reasonable security safeguards ².
• Up to ₹200 crore for failing to notify the Board or affected people of a personal data breach ².
• Up to ₹50 crore for any other breach of the Act or Rules ².

PNR to customs under the 2022 regulations

The Central Board of Indirect Taxes and Customs (CBIC) issued the Passenger Name Record Information Regulations, 2022 by Notification No. 67/2022-Customs (N.T.) on 8 August 2022 ³. Every aircraft operator on an international flight to, from or through India must send PNR to NCTC-Pax ³.

Data goes by push method in PNRGOV EDIFACT format ³. Regulation 5(4) says it must be sent not later than 24 hours before the departure time, or at the departure time (wheels off) ³.

• Retention: a maximum of five years from receipt, with an exception for data needed in an investigation, prosecution or court case ³.
• After five years, data is depersonalised by masking details that identify the passenger, and can be unmasked for an identified case, threat or risk ³.
• Access: only duly authorised officers ³.
• Sharing: where the data relates to an offence, NCTC-Pax may share it case by case with Indian or foreign law enforcement agencies or departments, which must keep the same safeguards and state their purpose ³.
• Penalty: ₹25,000 to ₹50,000 for each act of non-compliance ³.

API and PNR under the Immigration and Foreigners Act, 2025

The Immigration and Foreigners Act, 2025 is Act No. 13 of 2025 and was published in the Gazette of India on 4 April 2025 ⁴. Section 17(1) says a carrier landing or embarking in India must give a civil authority or Immigration Officer the advance passenger information of passengers and crew, and passenger name record information ⁴.

Section 18 says a carrier that breaks section 17 is liable to a penalty of up to ₹50,000 ⁴. Section 17(3) says no penalty may be imposed without giving the carrier a hearing ⁴. Section 7 lets the Central Government require foreigners to allow their photograph and biometric information to be taken ⁴.

The Bureau of Immigration was set up in 1971 and is headed by a Commissioner of Immigration ⁵. Its site says it runs 37 of India's 86 Immigration Check Posts ⁵.

e-Arrival card

A notice on a Government of India mission website says foreign nationals visiting for tourism, study or business may submit a digital arrival card online 72 hours before arrival ⁶. It names boi.gov.in, indianvisaonline.gov.in and the Indian Visa Su-Swagatam mobile app ⁶. The notice says paper Disembarkation Cards stay in use until the digital system stabilises or for up to six months, whichever comes first ⁶. The notice carries no date.

Digi Yatra

Slides hosted by ICAO and dated 17 July 2024 describe Digi Yatra as an initiative of the Ministry of Civil Aviation ⁷. They say the Digi Yatra Foundation is a not-for-profit joint venture of the Airports Authority of India (AAI) and private airport operators, with AAI holding 26% ⁷.

The slides say the passenger controls the travel and identity data held on their smartphone, and can opt in or out at any point ⁷. They list 16 AAI airports, from Varanasi on 1 December 2022 to 12 airports added on 7 June 2024, and around 6 million passengers ⁷. The slide footer reads AAI Digiyatra and SITA 2024 ⁷. The slides do not state contract terms or how long data is kept.

Chronology