Tracking group travellers' location safely, and what DPDP asks of you

Why do tour operators want travellers' location?

Three reasons, all about safety and time:

• Emergencies. When a traveller needs help, knowing where they are is the difference between a call and a search.
• Drift. In a market, a fort or a crowded beach, people wander. A captain who can see that one traveller is far from the group can call before departure time, not after.
• Headcounts. Before a vehicle leaves, location helps the captain judge whether the missing person is two minutes away or two kilometres away.

Why do travellers resist location tracking?

Because most of them have seen apps that never stop tracking. Common worries are reasonable ones:

• Tracking that continues after the trip.
• Location visible to other travellers, who are often strangers.
• A permanent record of where they went.
• Battery drain.
• Not being able to switch it off for an hour.

If your approach does not answer these, travellers will turn location off, and you lose the safety benefit entirely.

What principles make group location tracking acceptable?

Five rules, which are also how Rahi works:

1. Consent first. Ask before sharing starts, explain why, and make it a separate choice from joining the trip.
2. Trip window only. Location is shared only during the trip dates, and switches off automatically when the trip ends.
3. A pause button. Travellers can pause sharing at any time from the app.
4. Prompt deletion. Rahi deletes location history within 7 days of trip end. Location is not a permanent record.
5. Need-to-know visibility. Only authorised operator staff see the live map. Other travellers never see each other's location.

For trips with minors, Rahi adds two more: guardian consent is captured, and precise location is visible only during itinerary hours.

What does India's DPDP Act ask of travel companies?

The Digital Personal Data Protection Act, 2023 governs how organisations handle digital personal data in India. The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 with an eighteen-month phased compliance period. In summary, as the government's explainer describes them:

• Notice. A clear, separate notice explaining what personal data is collected and the specific purpose.
• Consent and withdrawal. Consent should be clear and informed, and people can withdraw it at any time.
• Purpose limitation and storage limitation. Use data only for the purpose it was collected for, and do not keep it longer than needed.
• Security safeguards to protect personal data, and breach notification to affected people and the Data Protection Board.
• Rights of individuals to access, correct, update and erase their data, and a contact point for queries. The Rules require responses within ninety days.
• Children. Anyone under 18 is a child. Section 9 requires verifiable parental consent and bars tracking or behavioural monitoring of children, except for classes of Data Fiduciaries or purposes the Rules exempt.

In a typical setup, the operator decides why traveller data is collected and is the Data Fiduciary; a software provider that processes data on the operator's behalf is a Data Processor. Confirm how this applies to your own arrangement with your lawyer.

Sources: The Digital Personal Data Protection Act, 2023 (Gazette of India) · DPDP Rules, 2025 notified, PIB explainer, 17 November 2025

How should an SOS feature avoid false alarms?

An SOS that fires from a pocket is worse than none: staff learn to ignore it. Good SOS design:

• Two taps and a confirm. Rahi's SOS needs two taps and a confirmation, so it cannot be triggered by accident.
• Location attached. The alert carries the traveller's location so your team does not have to ask.
• Reach beyond the app. The traveller's emergency contact receives the location by SMS, without needing the app.
• A clear owner. The trip captain and your ops dashboard both receive it, and you decide in advance who responds.
• Not a replacement for emergency services. An SOS supports your process. In a medical or police emergency, travellers and staff should still call local emergency numbers.

Live tracking and SOS explains how this works in Rahi, and traveller documents covers how ID copies are kept private.

Operator checklist

• Write down why you collect location, and say it in your consent notice.
• Ask for consent separately from booking.
• Share location only during the trip window, and switch it off automatically after.
• Let travellers pause sharing.
• Delete location history soon after the trip.
• Limit the live map to authorised staff.
• Take legal advice before tracking anyone under 18.
• Publish a contact for data requests and answer them.
• Use a two-step SOS and agree who responds.

If you want to see privacy-respecting location and SOS in a real operator workflow, book a demo.