Data Protection and Information Security in Hotels: What Hospitality Businesses Need to Consider Now

What Data Hotels Collect

A single stay generates a surprisingly long data trail:

• Master data from bookings and contracts: name, address, contact details, travel period;
• ID data for the statutory guest registration;
• Payment and billing data;
• Health-related information such as allergies or dietary requirements - special categories under Art. 9 GDPR;
• Access data from digital locking systems and self-check-in;
• Video recordings from communal areas and usage data from the guest Wi-Fi.

Each of these categories requires a legal basis, a clearly defined purpose and a retention period. Important: Health and ID data require particular protection - due diligence here is not optional, but mandatory.

The Legal Obligations That Apply to Every Hotel

In Italy, several accommodation-specific obligations apply in addition to the general GDPR requirements:

• Guest registration with the Questura via the Alloggiati Web portal (Art. 109 TULPS) - within 24 hours of arrival;
• Statistical reporting of tourist numbers to ASTAT or ISTAT;
• Collection and reporting of the tourist tax to the municipality;
• Electronic invoicing via the SdI system and tax-related retention for generally ten years.

These processing activities are required by law - guests cannot object to them. Precisely for this reason, the business must provide transparent information about them: The information obligation under Art. 13 GDPR requires clear and comprehensible privacy information, both on the website and for guests on the premises.

A common misconception: For registration purposes, the ID document only needs to be inspected, not copied. Permanently storing copies of ID documents is generally not necessary - and therefore violates data protection law.

Where Data Protection Ends and Information Security Begins

Legal bases alone do not protect data. This is precisely where information security comes in - expressly required by Art. 32 GDPR in the form of “technical and organisational measures”.

In day-to-day hotel operations, this means specifically: Who has access to the property management system, and is that access limited to what is necessary? Are digital door locks and self-check-in systems secure? Is the guest Wi-Fi separated from the internal network? Are backups available - and has their restoration ever been tested?

Hotels are a popular target for phishing and ransomware: Booking platforms, payment flows and high staff turnover make them vulnerable. An outage of the booking system during peak season is therefore not merely an IT problem, but an immediate business risk.

The Most Common Vulnerabilities in Day-to-Day Hotel Operations

Several issues recur in practice:

• No privacy information, or outdated privacy information, for guests and on the website;
• Stockpiled copies of ID documents without a legal basis;
• Video surveillance footage that is stored for too long - and which, as soon as employees are also recorded, requires a basis under employment law pursuant to Art. 4 of the Statuto dei Lavoratori;
• Missing data processing agreements with PMS, booking or IT service providers;
• Overly broad access rights and a lack of two-factor authentication;
• No data deletion policy - data is retained “just in case”.

None of these issues is difficult to remedy. They simply tend to go unnoticed... until a guest complaint, an inspection or a security incident brings them to light.

What Hoteliers Should Do Now

• Fulfil information obligations: Provide clear and comprehensible privacy information for guests, in addition to the website’s privacy policy.
• Set up proper reporting processes: Ensure Alloggiati, statistical and tourist tax reports are documented and submitted on time.
• Minimise data collection: Inspect ID documents instead of copying them, and keep video retention periods short (guideline: 24-72 hours).
• Review contracts: conclude a data processing agreement with every service provider that processes guest data.
• Secure access: limit roles and permissions in the PMS, enable multi-factor authentication, and separate Wi-Fi networks.
• Introduce a data deletion policy: set a fixed retention period for each data category - and enforce it.
• Train your team: Employees are the first line of defense against phishing and user error.

Conclusion

In hotels, data protection and information security are not bureaucratic add-ons, but part of hospitality: guests entrust the hotel with their data just as they do with their room key. Those who consider both together not only protect themselves against penalties, but also safeguard their business and reputation. The effort required is manageable if you take a structured approach and start early. And it pays off: in the form of trust that money cannot buy.