Data protection for hotels and accommodation

Yes. The registration of guests' identity data is a legal obligation imposed by Royal Decree 933/2021. This legal obligation constitutes the legal basis for the processing (art. 6.1.c GDPR) and takes precedence over the right of erasure during the retention period (3 years). Nevertheless, compliance with RD 933/2021 requires recording the data from the document, not retaining a photocopy or scan of it.

No. The AEPD has established, through repeated enforcement decisions, that it is strictly prohibited to photocopy, scan or retain images of guests' national ID card or passport. RD 933/2021 requires the registration of identity data, not the retention of a reproduction of the document. This practice infringes the data minimisation principle under art. 5.1.c GDPR and has led to numerous enforcement proceedings by the AEPD. The check-in process must be adapted to collect the data without copying the physical document.

Not necessarily. Major OTAs (Booking.com, Expedia) generally act as independent data controllers: they manage the customer's data under their own policies. The hotel receives the data the OTA transmits to it for the purpose of managing the reservation. The contractual relationship with each OTA determines the roles, and the agency must review the contracts in force.

Travellers' Report data must be retained for 3 years under RD 933/2021. Invoicing data must be retained for 4 years due to fiscal obligations. Data held in the property management system (PMS) must be limited to the period necessary for the relationship with the guest. If the hotel has a loyalty programme, it may retain data for the duration of the programme with consent.

The admissibility of video surveillance in a hotel depends on the specific area, the purpose pursued and the proportionality assessment. As a general rule, it is prohibited in spaces where people have a reasonable expectation of privacy. Each installation must be documented in the RoPA (Record of Processing Activities), include an information sign and comply with the applicable retention periods. We recommend analysing each case individually before installing any camera system.

Only with the guest's informed consent. If wi-fi access requires registration with a name or email address, the hotel is collecting personal data and must inform the user of the purpose of the processing. Those data may not be used for marketing without additional and specific consent for that purpose.

As a general rule, yes. The PMS software provider that stores guest, reservation and invoicing data for the hotel may act as a data processor. The exact legal relationship depends on each provider's terms; it is advisable to review them and, where the provider acts as a processor, to formalise the data processing agreement (DPA) and verify where the data are hosted, particularly if the PMS is cloud-based.