Your hotel's privacy notice and copies of guests' ID: what the authorities say in 2026

Updated: 9 November 2026

A property collects personal data on its website, its booking form and the guest register. This year the data protection authorities of Spain, Italy and Greece have focused on two things: that guests know what is done with their data, and that copies of their identity documents are not kept. This is what their own sources say (listed at the end). This is not legal advice: for a specific question, ask your adviser.

What your privacy information must say

Article 13 GDPR requires you to inform people when the data is collected, not afterwards:

Who the controller is (company or owner name) and how to contact them.
What the data is used for (managing the booking, the guest register, sending offers if the guest agrees…) and the legal basis.
Who receives it (for example the police for the guest register, your booking software or your accountant) and whether it leaves the European Economic Area.
How long it is kept, or the criteria used: 'as long as necessary' is not enough.
The guest's rights (access, rectification, erasure, objection, restriction and portability), how to withdraw consent and the right to complain to the data protection authority.
Whether providing the data is required and what happens if it is not (no data, no booking or registration).

Layered: the basics next to the button

Spain's AEPD and the European Data Protection Board recommend two levels. The first, next to the book or send button, is a short summary: controller, purpose, legal basis, recipients, rights and a 'more information' link. The second is the full text. Also keep a link to the privacy policy visible on every page.

Copies of ID cards or passports: do not keep them

Spain: on 17 June 2025 the AEPD said the guest register under Royal Decree 933/2021 'does not authorise requesting a copy of the identity document': record the data the decree asks for, checking the document in person or by other means remotely. In 2023 it fined a hotel-apartment €2,000 for keeping scanned ID cards.
Italy: on 29 April 2026 the Garante asked hotels to delete or destroy copies immediately after sending the data through Alloggiati Web; only the portal's receipt is kept, for five years. No photographing documents or asking for them over WhatsApp.
Portugal: according to SIBA's official notice, the property does not keep the data it enters in the system; the authorities keep it for one year.
Greece: on 24 June 2026 the Hellenic DPA asked properties not to take or keep photos or photocopies of identity documents, nor copies of cards for future disputes.

How long Spain's guest register is kept

Royal Decree 933/2021 requires the electronic register to be kept for three years and the data to be reported within 24 hours. You can explain exactly that in your privacy information.

Do I need a data protection officer?

Usually not. The GDPR only requires one for public bodies and for large-scale processing or systematic monitoring, and Spain's list (article 34 LOPDGDD) does not include hotels. If you do not have one, do not mention one.

10-minute check

Open your booking form: is there a privacy summary next to the button and a link to the full text?
Read your policy: does it give concrete retention periods and say who receives the data?
Ask reception whether documents are scanned or photographed, or requested by WhatsApp or email, and stop it.
Check that your booking software and accountant have a data processing agreement with you.

How iQuota helps

The official booking page iQuota creates for your property does not ask for identity documents or card details: payment is made at the property. Your website and reception remain yours and should follow these rules.

Want an official booking page AI can read and a connector with your real prices, commission-free? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Can I ask for the passport over WhatsApp before arrival?

Better not: Spain's AEPD considers it excessive and Italy's Garante expressly advises against it. Ask only for the register data and check the document on arrival.

Can I copy a privacy policy from another website?

Only if you adapt it: it must say who you are, what you use the data for, who receives it and how long you keep it.

What about the cookie policy?

That is a separate obligation; see our cookie banner guide.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά