Data protection for
travel agencies

Yes. When the agency transmits a traveller's data to airlines, hotels or tour operators outside the European Economic Area (EEA), an international transfer of data takes place. This transfer must be communicated to the customer in the privacy policy or information clause, stating the applicable mechanism: for US providers that have joined the Data Privacy Framework (DPF), that is the currently applicable mechanism; for other destinations, Standard Contractual Clauses or other mechanisms under art. 46 GDPR are required, whose validity should be verified periodically.

A passport number is an identity data item that enables the unambiguous identification of the traveller. It is not a special category under art. 9 GDPR, but its sensitivity is high: improper use can facilitate identity fraud or theft. The agency must apply appropriate security measures, restrict internal access and not retain it for longer than necessary.

The management of minor children's data in family bookings has specific implications regarding consent and legal representation. The agency must adequately inform parties about the processing of minors' data in the information clause of the contract and ensure that the corresponding legal representation is in place.

Yes. Information about medically required diets (diabetes, severe food allergies, coeliac disease) or requests for special assistance at the airport (wheelchair, medical assistance) are health data (special category, art. 9 GDPR). Their processing requires the traveller's explicit consent for that specific purpose.

The travel documentation must be retained for the period during which consumer claims may be brought (3 years for contractual liability under the Civil Code) and for the fiscal period (4 years). Passport data and identity documentation must be deleted once they are no longer needed for travel formalities.

GDS and airline and hotel reservation systems manage travellers' data under their own terms. Depending on the contractual model, they may act as processors for the agency or as independent controllers. The agency must review its contractual terms and reflect these relationships appropriately in its RoPA (Record of Processing Activities).