Guest ID and KYC for a Goa holiday home

There is no single central law, and that surprises people

For a foreign guest the duty is clear and central: the arrival has to be reported to the immigration authorities. For an Indian guest there is no one national statute that says an accommodation provider must photograph an ID. What exists instead is a stack of three things, and in Goa the one that actually bites is the shortest-lived of them.

The first is the tourism registration rules your homestay is registered under. The second is the District Magistrate's standing order for your district, which is where the words "photo identity" actually appear. The third is the tenant verification law, which probably does not apply to you, and which almost every summary online gets wrong.

What your homestay registration requires: a register

Goa homestays and B&Bs register with the Department of Tourism under the Goa Registration of Tourist Trade Act, 1982, and the checklist that comes with the Rules made under it is where the record-keeping duty sits. Item 38 of the homestay and B&B checklist makes this mandatory for both the Silver and Gold grades:

"Maintenance of register (physical or electronic format) for guest check-in and check-out records including passport details in case of foreign tourists."

Two things are worth reading closely there. An electronic register is expressly allowed, so a spreadsheet or a workspace like ours satisfies it and a paper ledger is not required. And it asks for passport details only for foreign tourists: for an Indian guest, the checklist asks for a check-in and check-out record, not for a copy of an ID document. That register item appears in the homestay and B&B checklist and not in the hotel category checklists.

The prescribed authority can inspect the premises and require any document kept under the Act to be produced, so the register needs to exist and be findable rather than be reconstructed later.

This checklist requirement carries no retention period at all. Nothing in the Goa tourism framework tells you how long to keep a guest record, which is why the advice further down is about purpose rather than a number of months.

The District Magistrate's order: where photo ID actually comes from

The requirement that a guest show photo identification in Goa comes from prohibitory orders issued by the District Magistrates, and it is addressed to house owners, flat proprietors and managers of hotels, lodging and boarding, shacks, private guest houses and paying guest accommodation, which is to say to you.

The order for South Goa dated 4 March 2025 requires the bonafides of a tenant or guest to be verified through an identity document, listing an election card, driving licence, Aadhaar card, passport or smart card as examples, and requires the particulars to be furnished to the officer in charge of the local police station. It states that violation is punishable under section 223 of the Bharatiya Nyaya Sanhita, 2023. The order issued for North Goa on 8 January 2026 requires the same verification and the completion of a verification form to be given to the local police station.

The important operational detail is that these are temporary orders which are reissued periodically, rather than a permanent statute. An earlier North Goa order ran for sixty days. So the answer to "what does the order require this season" changes, and the current one is published by the state's Department of Information and Publicity rather than sent to you.

• Ask for a government photo ID, and accept any of the ones the order lists rather than insisting on one.
• Record the guest's particulars, and give the verification form to your local police station.
• Check the current order for your district each season, because the one you read last year has expired.

The tenant verification Act probably does not apply to you

The Goa (Verification of Tenants) Act, 2024 is quoted at hosts constantly, usually with a fine attached. Read its definitions before you worry about it. Section 2(c) defines the premises it covers and then excludes "a room in a hotel or lodging house or guest house which is registered under the Goa Registration of Tourist Trade Act, 1982".

So a homestay properly registered with the Department of Tourism is carved out of that Act. A flat or villa let to paying guests without that registration is not carved out, and for it the Act requires the owner to verify photo identity before allowing accommodation, to maintain a record, and to submit it as prescribed, with a fine that may extend to ten thousand rupees for failing to maintain or submit it, compoundable by the Sub-Divisional Magistrate.

One correction worth making, because it circulates widely: the Act specifies no retention period. Any "keep it for a year" rule attributed to it is somebody's summary, not the text. We could not confirm from a primary source whether the Act has been brought into force yet, since it commences on a date the Government appoints by notification, so treat registration under the tourism Act as the thing that settles your position.

Never store an Aadhaar number

Aadhaar is the ID an Indian guest is most likely to hand you, and it is the one with real penalties attached to mishandling. Under the Aadhaar Act, 2016, use of an Aadhaar number is voluntary and only with the holder's informed consent, and an entity is required to tell the holder about alternative means of identification rather than deny service for declining.

If you verify identity through any of Aadhaar's offline methods, the Act is blunt about what follows: an offline verification-seeking entity shall not collect, use or store an Aadhaar number or biometric information of any individual for any purpose. Identity information may not be used or disclosed for any purpose other than the one told to the person in writing when they gave it, and an Aadhaar number may not be published or displayed publicly.

The practical shape of that for a host is simple. Take a different ID where you can, because the District Magistrate's order accepts several. Where a guest offers Aadhaar, prefer the masked version or the offline e-KYC file the guest generates themselves, which carries a reference number rather than the Aadhaar number, is digitally signed so you can check it is genuine, and lets the guest choose which fields to share. Do not write the twelve digits into a spreadsheet, and do not keep a clear photocopy in a folder on your phone.

Our own workspace enforces this rather than asking you to remember it: the database refuses to store a full Aadhaar number, and keeps at most the last four digits.

The DPDP Act: not yet, but soon, and worth building for now

The Digital Personal Data Protection Act, 2023 is the law people expect to govern a guest's ID, and the single most useful thing to know in September 2026 is that its substantive obligations are not in force yet. The commencement notification of 13 November 2025 switched on the Data Protection Board and the machinery sections immediately, set a one-year clock for the consent manager provisions, and set an eighteen-month clock for everything a host would recognise as a duty.

That eighteen-month group is the whole of the operative law: notice, consent, the legitimate uses, the security safeguards, breach notification, erasure, the rights a guest can exercise against you, and the penalties section itself. It commences in mid-May 2027. Until then a homestay has no enforceable DPDP obligation and cannot be penalised under its schedule, whatever a compliance vendor tells you this season.

When it does arrive, the footing for collecting a guest's ID is not consent but the legitimate use for fulfilling an obligation under law to disclose information to the State, which is exactly what the District Magistrate's order is. Marketing to the same guest afterwards is not covered by that and needs their consent, kept separate. The retention position becomes a floor and a ceiling: processing records and logs must be kept for at least a year, while the personal data itself must be erased once it is reasonable to assume the purpose is no longer being served, unless another law requires it to be kept.

The much-quoted three-year erasure rule does not apply to you. It is written for e-commerce entities, online gaming intermediaries and social media intermediaries above very large user thresholds, and a holiday home is none of those.

So how long should you keep a copy?

There is no legal answer in Goa, and anyone who gives you a number is stating a policy rather than a rule. What there is, once the DPDP obligations commence, is a test: keep it while the purpose is live, and stop when it is not. The purpose here is verification at check-in and availability if the police ask, which is a short-lived purpose.

A defensible position is to keep the check-in and check-out register indefinitely, since it is the thing your registration requires and it holds no document images, and to delete the ID images themselves on a fixed clock that you can describe to a guest who asks. Write the period down, apply it automatically rather than by memory, and tell guests what it is.

• Keep the register: dates, names, and passport details for foreign guests.
• Keep ID images only as long as your stated purpose lasts, on an automatic clock.
• Never keep an Aadhaar number, in the register or anywhere else.
• Write the period into whatever a guest can read, so the answer is the same whoever they ask.