DigiYatra Privacy: What Happens to Your Face Data?

DigiYatra claims your face data is deleted within 24 hours. Here is what the Delhi HC case, the DPDP Act 2023 and independent experts actually say about data

FlightGPT can make mistakes. Confirm flight & fare details before paying.

DigiYatra Privacy: What Really Happens to Your Facial Data at Indian Airports?

By Ishaani Reddy (Ishaani Reddy writes about the consumer-protection side of travel — DGCA passenger rights, OTA refund policies, hidden fees, dynamic-currency-conversion traps and the seven kinds of booking mistakes that quietly drain Indian travel budgets.) · Published · 11 min read

DigiYatra says your face data disappears within 24 hours of your flight. A Delhi HC petition says prove it. Here is the honest picture of what's in dispute, what the DPDP Act 2023 means for your biometric rights at an Indian airport, and whether opting out is actually possible.

TL;DR — The Honest Answer on DigiYatra Privacy

DigiYatra Foundation says facial data is stored only on your device and purged from airport systems within 24 hours of departure. The architecture, as published, is a federated model where the biometric template lives in an encrypted vault on your phone and a temporary, flight-specific token is passed to airport cameras at the gate. The cameras compare your live face to that token — not to a central database of all enrolled passengers.

What's disputed: whether the 24-hour server-side deletion is actually audited by anyone independent, whether temporary tokens are truly ephemeral, and whether the June 2026 international transit mandate (which essentially forces enrollment on passengers) is compatible with the DPDP Act 2023's consent requirements. The Delhi High Court has an open petition on exactly these questions. No ruling as of this writing.

What Data Does DigiYatra Actually Collect?

When you enroll, DigiYatra collects:

At the airport gate, the camera captures a live facial image and compares it locally to the token retrieved from your device, using the airport's recognition system. DigiYatra Foundation's white paper says the live image is not retained — only the match score is logged for operational auditing.

What this means practically: your biometric template should not end up in some central government face database... if the architecture works as described. The sceptical reader will note that 'should not' is doing a lot of work in that sentence, and that India has no independent biometric-audit authority as of 2026.

The Delhi HC Case: What Is Actually Being Argued?

A petition filed in the Delhi High Court in early 2025 (and still active as of June 2026) challenges DigiYatra on three main grounds:

  1. No independent deletion audit: Petitioners argue that DigiYatra Foundation's claim of 24-hour server-side deletion is self-certified. There is no third-party technical auditor, no CERT-In certification of the deletion process, and no mechanism for a passenger to verify their data was actually deleted.
  2. Consent under DPDP Act 2023: The Digital Personal Data Protection Act 2023 requires that processing of personal data — including biometric data — be based on informed, free and unambiguous consent. Petitioners argue that mandatory enrollment for transit passengers under a civil aviation security order circumvents the DPDP consent framework, because passengers have no practical choice.
  3. Purpose limitation: The DPDP Act requires that data be used only for the purpose for which it was collected. Petitioners asked for clarity that DigiYatra biometrics will never be used for immigration watch-list matching, law enforcement access, or any purpose beyond paperless boarding.

DigiYatra Foundation and the Ministry of Civil Aviation have, in their court submissions, reiterated the 24-hour deletion policy and argued the system is a legitimate state function for airport security. The court has asked for a compliance affidavit and a technical architecture report — both were reportedly submitted in May 2026, but the documents have not been made public.

What Does the DPDP Act 2023 Actually Give You?

The Digital Personal Data Protection Act 2023 is India's first comprehensive data protection law, and it does give individuals some rights worth knowing:

The catch: under the international transit mandate, the government is relying on 'legitimate state function' as the legal basis for processing, which the DPDP Act permits as an alternative to consent. This is the crux of the court challenge — whether airport biometric capture is a legitimate state function or a service that still requires consent.

Is There Actually a Way to Opt Out?

For voluntary DigiYatra (domestic flights, non-mandate airports): yes, easily. Just don't sign up. Use the regular manual lane with your boarding pass and ID. No consequences.

For mandatory international transit at DEL/BOM/BLR/HYD: there is a human-lane option at each airport. You can approach a CISF officer at the DigiYatra e-gate lane and request manual document verification. Based on current BCAS (Bureau of Civil Aviation Security) guidance, this right exists and cannot be denied. In practice, reports from the first few weeks of the mandate suggest that some junior staff were confused about this — a few passengers were told they 'had to' use DigiYatra. That is incorrect. Escalate to a senior CISF officer or the airport's customer service desk if you face pushback.

The manual opt-out comes with a time cost — typically 15–30 extra minutes in queue — and the social friction of swimming against a biometric-boarding system. For most passengers, the trade-off isn't worth it. For some, it absolutely is. Both positions are reasonable.

What Should You Do If You're Uncomfortable?

Practically speaking, here is a graduated response based on your level of concern:

If you're also navigating the booking-side rights questions — like what happens if your flight is changed or you need to cancel — our article on the DGCA 48-hour cancellation window and the free name-correction rule are worth reading alongside this one. Consumer rights in Indian aviation are finally moving — slowly, in fits, but moving.

For your flight bookings themselves, FlightGPT's AI search can help you find routes that minimise mandatory-biometric transit points if that's a priority, and you can explore destination pages for onward routing options.

Frequently asked questions

Is DigiYatra's 24-hour data deletion claim independently verified?

As of June 2026, no. DigiYatra Foundation self-certifies the deletion policy. The Delhi HC petition pending before the court has asked for a third-party technical audit report — DigiYatra submitted documents in May 2026 but they are not publicly available. CERT-In has not published a certification of the deletion process. Until independent verification exists, the 24-hour claim is a policy commitment, not a proven fact.

Can I delete my DigiYatra account and biometric data after my trip?

Yes — within the DigiYatra app there is a 'Delete Account' function that is supposed to trigger deletion of your biometric template from the app and a deletion request to airport systems. For voluntary domestic users, this is the standard opt-out. For transit mandate passengers who were enrolled at a kiosk without creating an app account, the process is less clear; contacting DigiYatra Foundation's grievance officer at digiyatra.in is the recommended path.

Does the DPDP Act 2023 protect me against DigiYatra's biometric collection?

Partially. The DPDP Act gives you rights to information, correction, and erasure, and requires a grievance mechanism. However, the government can invoke 'legitimate state function' as a legal basis for processing personal data without consent — that's the exemption the transit mandate arguably relies on. Whether that exemption applies to airport biometrics is exactly what the Delhi HC case is testing. The Data Protection Board of India, which would be the enforcement body, was still being constituted as of mid-2026.

Can I be denied boarding if I refuse DigiYatra at a mandatory airport?

Based on current BCAS policy, no. You have the right to request manual document verification at the transit desk at DEL, BOM, BLR and HYD. Some junior staff have incorrectly told passengers they 'must' use DigiYatra in the mandate's early weeks — this is not the official policy. Escalate to a senior CISF officer or the airport's passenger grievance desk if you're denied manual verification.

Is my DigiYatra face data shared with police or intelligence agencies?

DigiYatra Foundation's official position is that biometrics are used solely for paperless boarding and are not shared with law enforcement or intelligence agencies. The Delhi HC petition explicitly asks for a legally binding commitment on purpose limitation under the DPDP Act. No such binding order has been issued as of June 2026. The question is live and unresolved — which is a fair thing to note when making your personal enrollment decision.

What happens to my DigiYatra data if I never use the app again?

Per DigiYatra Foundation's terms, inactive accounts are scheduled for deletion after a period of inactivity — the exact period has been stated as around 6–12 months in their FAQs, but verify on digiyatra.in as this can change. If you want to ensure deletion rather than waiting for the inactivity policy, use the in-app 'Delete Account' function, which is intended to be the definitive erasure path.