GDPR for hotels and B&Bs: keeping guest data compliant

Hotels and B&Bs process personal data every day, from check-in records to booking messages. Lawful handling depends on purposes, legal bases, retention, security and the people involved. This guide introduces practical questions to discuss with your privacy adviser; using software is not a guarantee of GDPR compliance.

What data you process (often without realising it)

An accommodation business collects more data than you might imagine. Some of it is required by law, some is needed to deliver the service, and some you ask for simply to work better.

• ID documents and personal details (name, date of birth, nationality) for guest registration
• Contacts: email and phone number to confirm the booking and assist the guest
• Payment and billing data, largely handled by the banking network
• Stay preferences and notes (high floor, allergies, arrival time)
• Any vehicle plates for restricted traffic zones (ZTL) or parking

The legal bases: why you're allowed to process it

Every piece of data must have a legal reason. This isn't abstract bureaucracy: it's what protects you if someone ever asks you to account for it. In practice, for an accommodation business there are three bases.

• Legal obligation: reporting guests to the public security authorities is mandated by law; here consent isn't needed — in fact you can't opt out of it
• Performance of a contract: to manage the booking, the stay and the payment, the necessary data is enough, with no authorisation required
• Consent: needed only for anything beyond the service itself, typically marketing — newsletters, offers, review requests. It must be freely given, specific and revocable

The distinction is very practical: you cannot automatically sign someone up to the newsletter just because they booked a room.

How long to keep it

Keeping everything forever is as much a mistake as deleting too soon. The rule is to retain each piece of data only for as long as it serves its purpose.

• Guest registration data: transmission to the public security authorities follows statutory terms — it's not a marketing archive to reuse
• Tax documents and invoices: civil and tax retention in Italy is typically ten years
• Marketing contacts: for as long as the guest hasn't withdrawn consent; after that, they must be removed
• Stay preferences and notes: useful for the guest's return, but to be reviewed and cleaned up periodically

A good principle: if a piece of data no longer serves any of its purposes, it gets deleted.

Guest rights

The guest remains the owner of their own data and can exercise certain rights. You need to be able to respond within reasonable timeframes, even if only through a clear procedure on who handles it.

• Access: knowing what data you process and obtaining a copy of it
• Rectification: correcting wrong or incomplete information
• Erasure: being forgotten, when no retention obligation takes precedence
• Objecting to marketing and withdrawing consent at any time

Practical measures to apply right away

Data security doesn't require an IT department: it requires habits. In small businesses most problems come from sheets of paper left lying around and informal messages, not from sophisticated attacks.

• Limited access: each staff member sees only what they need, with personal, non-shared accounts
• No sensitive data on paper sheets, front-desk notebooks or WhatsApp groups
• Data and documents on encrypted systems, with strong passwords and, where possible, two-factor authentication
• Copies of documents deleted as soon as they're no longer needed
• An internal contact person able to respond to a guest request

In summary

Start by documenting what data you process, why you process it and how long you keep it. These are useful starting points, not a complete compliance assessment. With HotelOnlineAI, the pilot discussion can cover data-organisation needs and relevant settings; roles, access, retention and processing documents should be agreed for your case with your privacy adviser.