Travellers passing through Trivandrum International Airport were surprised this weekend to find that accessing the airport’s free Wi-Fi now requires scanning their passports and boarding passes at dedicated kiosks. Operated by the Adani Group, which manages the airport under a public-private partnership, the system collects full passport details, citizenship data and flight information before issuing a login code.
Cyber-security experts say the practice exceeds the basic Know-Your-Customer (KYC) norm followed at many global airports, where an e-mail or phone-number verification suffices. Civil-liberties group Internet Freedom Foundation notes that India lacks a comprehensive data-protection law with enforceable penalties, making it unclear how long the information is stored or with whom it is shared.
For corporate-travel managers, the development poses both compliance and reputational risks—especially for multinational firms subject to GDPR or California’s CCPA, which restrict transfer of employee personal data. Several IT majors with delivery centres in Technopark have advised staff to use personal hotspots instead of airport Wi-Fi until clarity emerges.
![Passport Scan for Free Wi-Fi? Trivandrum Airport’s New Policy Raises Data-Privacy Concerns]()
Adani Airports Holding Ltd. defended the policy, stating that enhanced identity verification helps deter “cyber-enabled crime and misuse of public networks.” However, the company has not published a detailed privacy notice or offered an opt-out.
What companies should do:
1. Update India travel briefings to highlight the new requirement at Trivandrum and instruct employees to connect through VPNs if they must use the service.
2. Engage procurement teams to seek contractual assurances from airport authorities when negotiating corporate-lounge access or fast-track packages that bundle connectivity.
3. Monitor whether other Adani-run airports—Lucknow, Jaipur, Guwahati—plan similar roll-outs.
The episode underscores how rapidly evolving airport-tech solutions can collide with global privacy obligations, requiring mobility teams to stay vigilant beyond traditional immigration rules.
Cyber-security experts say the practice exceeds the basic Know-Your-Customer (KYC) norm followed at many global airports, where an e-mail or phone-number verification suffices. Civil-liberties group Internet Freedom Foundation notes that India lacks a comprehensive data-protection law with enforceable penalties, making it unclear how long the information is stored or with whom it is shared.
For corporate-travel managers, the development poses both compliance and reputational risks—especially for multinational firms subject to GDPR or California’s CCPA, which restrict transfer of employee personal data. Several IT majors with delivery centres in Technopark have advised staff to use personal hotspots instead of airport Wi-Fi until clarity emerges.
Adani Airports Holding Ltd. defended the policy, stating that enhanced identity verification helps deter “cyber-enabled crime and misuse of public networks.” However, the company has not published a detailed privacy notice or offered an opt-out.
What companies should do:
1. Update India travel briefings to highlight the new requirement at Trivandrum and instruct employees to connect through VPNs if they must use the service.
2. Engage procurement teams to seek contractual assurances from airport authorities when negotiating corporate-lounge access or fast-track packages that bundle connectivity.
3. Monitor whether other Adani-run airports—Lucknow, Jaipur, Guwahati—plan similar roll-outs.
The episode underscores how rapidly evolving airport-tech solutions can collide with global privacy obligations, requiring mobility teams to stay vigilant beyond traditional immigration rules.
