Hotels, hospitality and booking systems

• Regulation (EU) 2016/679 — GDPR, Article 27
• Directive 2002/58/EC for guest wifi
• National guest registration laws
• Directive (EU) 2015/2302 on package travel

Who has to appoint one

Booking platforms and property management systems established outside the Union serving EU hotels and guests. Guest registration with police or municipal authorities is a national legal obligation in many member states, which shapes retention.

Thresholds and exemptions

No threshold. Package travel rules apply where accommodation is combined with other travel services.

What must appear on the label

Not physical. The representative in the privacy notice, transparent information about guest data sharing with authorities, and clear price presentation including mandatory taxes and fees.

Marketplace fields

Hotels require processing terms and, increasingly, EU data residency. Consumer authorities have acted on drip pricing and misleading availability claims on booking platforms.

Documentation you must hold

Article 30 records covering guest, payment and stay data, Article 28 terms with properties, the Article 27 designation, retention rules reconciling police registration duties with minimisation, the transfer mechanism, and guest wifi consent documentation.

Standards and testing

Not applicable, though price presentation and countdown mechanics are examined directly by consumer authorities.

Language requirements

Guest information and booking terms in the language of the markets served.

When it applies

The representative before processing begins. Guest registration duties apply from check-in per national law.

How long records are kept

Guest registration data for the period the national law requires, which varies widely, and marketing data separately with its own basis and shorter retention.

What happens if you do not comply

GDPR fines up to 4% of turnover, and consumer law penalties up to 4% of turnover in the member states concerned for widespread pricing infringements.

Who enforces it

Data protection authorities, consumer protection authorities, and police or municipal authorities for guest registration.

Where the boundary lies

Guest registration obligations are a legal basis for specific data and specific retention, and they do not justify retaining everything else. Loyalty profiling and marketing require their own basis, which the registration duty does not supply.

Questions we are asked

How long can we keep guest data?

Registration data for the period national law requires; everything else only as long as necessary for the stay, the contract and any claim period.

Is guest wifi regulated?

Yes. Terminal equipment access requires consent for non-essential cookies, and traffic data retention is restricted by ePrivacy and national law.