Rural & holiday tourism
Data protection for
rural cottages and tourist apartments
Rural cottages and holiday apartments are required to register travellers and comply with the GDPR. Booking platforms such as Airbnb or Booking manage data under their own policies, but the property owner has their own obligations.
RD 933/2021
Travellers' Report
3 years
traveller data retention
4 years
invoicing data retention
24 h
personalised proposal
Sector challenges
General obligations for rural cottages and tourist apartments
Travellers' Report
RD 933/2021 requires the registration of specific guest identity data and their communication to the authorities. Important: it is strictly prohibited to photocopy or scan the guest's national ID card or passport; only the data strictly required by the regulation must be recorded (data minimisation principle and AEPD enforcement criterion).
Booking platforms
Airbnb and Booking manage guest data under their own policies. The property owner must understand what data they receive from the platforms and what their obligations are regarding that data.
Communications with guests
Using WhatsApp, email or SMS to coordinate arrivals, access instructions and reviews involves the processing of personal data with its own obligations.
Payment data
If payment is managed directly by the property owner (bank transfer, Bizum), payment data are processed and must be retained for the applicable fiscal periods.
Own website with contact form
If the rural cottage has a website with a contact or booking form, it requires a privacy policy and an information clause alongside each form.
Marketing to past guests
Using contact data from previous guests to offer them future stays requires their prior consent and a simple unsubscribe mechanism.
The service
What the service for your rural or holiday accommodation includes
RoPA (Record of Processing Activities)
Tailored Record of Processing Activities: guests, communications, traveller registration and invoicing.
Information clauses
Texts for the direct booking process and communications prior to the stay.
Privacy policy and legal notice
Documentation for the accommodation website.
Data Processing Agreements (DPA)
DPA for reservation management software and communication tools.
Data breach protocol
Response procedure with notification within 72 hours.
Data subject rights management
Documented procedure for handling guest requests.
Document management platform
Access to a private platform with documents and electronic signature.
Ongoing support
Unlimited queries. Updates in response to regulatory changes.
External DPO (if applicable)
As a general rule, rural cottages and holiday accommodation providers are not listed in the exhaustive provisions of art. 34 LOPDGDD or art. 37 GDPR. The final requirement will depend on the scale, volume and exact nature of each entity's processing activities. Each case requires individual analysis. Separate contract.
Do you need a proposal for your accommodation?
Tell us the type of accommodation. Proposal in under 24 hours.
FAQ
Frequently asked questions about data protection in rural cottages
Is a rural cottage with only a few guests per year required to comply with the GDPR?
Yes. The GDPR applies to any natural or legal person that processes personal data, with no minimum activity threshold. Even a private owner who lets a rural property through digital platforms and manages reservation data (name, email, telephone) is subject to the basic obligations: information, legal basis and data protection.
Does the Travellers' Report requirement also apply to rural cottages?
Yes. Royal Decree 933/2021 obliges all accommodation establishments, including rural cottages and tourist apartments, to register guests' identity data and communicate them to the Security Forces and Corps. This legal obligation applies regardless of the size of the establishment.
Do Airbnb or Booking act as data processors for the rural cottage?
Not necessarily. Major holiday rental platforms generally act as independent data controllers: they manage guest data under their own privacy policies. The property owner receives the data the platform transmits in order to manage the stay. Reading the contractual terms of each platform is essential.
How long must guests' data be retained?
Travellers' Report data must be retained for 3 years under RD 933/2021. Invoicing data must be retained for 4 years due to fiscal obligations. Contact data used for communication prior to the stay (arrival coordination, instructions) may be deleted shortly after the stay.
Can guests be contacted via WhatsApp to coordinate their arrival?
It is possible, but it involves an international transfer of contact data to Meta (USA), which requires informing the guest and verifying the applicable enabling mechanism (Data Privacy Framework if the provider has joined it, or standard contractual clauses). The most appropriate approach is to inform the guest at the time of booking that this channel will be used to coordinate the stay. Under no circumstances may those data be used for subsequent commercial communications without consent.
Does a rural cottage need a privacy policy on its website?
Yes, if it has a website with a contact or booking form. Any form that collects a name, email or telephone number requires a privacy policy and a clearly visible information clause alongside the form. If the rural cottage operates solely through third-party platforms, those platforms' privacy policies cover data collection during the booking process, but not the owner's subsequent processing activities.
Sector resources
Learn more
Rural houses
Data protection in a rural guest house: where to start
Minimum data protection documentation for rural guest houses: traveller register, RoPA, information notices, processor contracts and communication to law enforcement authorities.
7 min·Read article
Rural houses
Daily good practices of the rural guest house owner to protect data
Concrete routines to manage guest data in a small tourist accommodation: recording the ID without photocopying it, custody of registers, personal mobiles, destruction of contracts.
7 min·Read article
Rural houses
Booking platforms (Booking, Airbnb) in a rural guest house: what to bear in mind under the GDPR
Booking, Airbnb and other portals: when they act as independent controllers and when as processors. What to require from the channel, what data you can keep and how to coordinate with the platform.
8 min·Read article
Free tool
Data protection self-check
Check in 5 minutes your overall adaptation level in personal data protection.
No email · Anonymous · No commitment
Rural & holiday tourism
GDPR compliance
for your accommodation.
An expert analyses your activity and proposes the right solution. No intermediaries.
Proposal within 24 h · info@certix.es
Legal notice: This content is for informational and educational purposes only; it does not constitute specialist legal advice. The application of the regulations to each specific case requires individual analysis.