Español
Updates

Avoid the Three Year Trap on Hotel Data Retention in Spain

Practical data retention rules for hotels in Spain: what to keep or delete, plus a retention schedule aligning RD 933/2021 with GDPR.

Avoid the Three Year Trap on Hotel Data Retention in Spain

In Spain, hotels must keep the official guest register records required by Real Decreto 933/2021 for three years, while applying the GDPR’s storage limitation principle to every other category of guest data. The two main authorities you answer to are the Agencia Española de Protección de Datos and SES.Hospedajes. The single most practical rule: keep your security register separate from marketing files, and never store photocopies or photos of a guest’s ID.

TL;DR:

  • Hotels must keep the official guest register for three years, separate from marketing files, and never store copies of IDs or passports.
  • Each adult guest and each stay must be recorded individually with specific data fields, and entries should be submitted promptly to SES.Hospedajes.
  • Data outside the official register, such as invoices or CCTV footage, should be retained only as long as necessary under separate periods, typically four years or one month.
  • GDPR prohibits requesting or keeping copies of IDs; verification can be done through visual checks, digital certificates, or one-time codes, with strict safeguards for biometric methods.
  • Implementing a simple, clear retention schedule and using compliant software like EuroCheckin can help automate and simplify legal adherence.

Table of Contents

What guest data you must record for SES.Hospedajes

SES.Hospedajes requires a defined set of fields for every guest, drawn from Annex I of Real Decreto 933/2021. Your front desk form should capture exactly these fields and nothing more.

  • Document type and number (DNI, NIE, or passport).
  • Full name, nationality, sex, and date of birth.
  • Check-in and check-out dates, plus a signature where the booking requires one.
  • Additional fields for vehicle rentals, when applicable.

Every adult guest staying at the property must be recorded individually, including each member of a group booking. Minors generally need to be listed but do not sign the register themselves. For repeated stays from the same guest within a short window, you still submit a new entry each time, since SES.Hospedajes tracks each stay as a separate event.

Reporting happens either through a direct system-to-system connection or manual entry on the SES.Hospedajes portal, and data must reach the system promptly, typically soon after check-in. Keep this register data in its own file structure. Mixing it with your CRM or loyalty database creates confusion about which retention rule applies to which record, increasing compliance risks, and that confusion is where most compliance gaps start.

How long to keep each type of guest data

The three-year rule only covers the official traveler register, the one that Real Decreto 933/2021 says must stay available to Spanish security forces for inspection purposes. Everything else in your hotel runs on a different clock.

  • Official traveler register (SES.Hospedajes entries): three years from the end of the stay, under RD 933/2021.
  • Invoices and accounting records: commonly four years, aligned with Spanish tax inspection windows referenced by the Interior Ministry.
  • Short-term rental registration data under EU-level rules: up to 18 months in some contexts, though hotels fall under the separate RD 933/2021 regime rather than this framework.

Treating the three-year window as a blanket rule for all guest data is a common mistake. GDPR’s storage limitation principle requires you to delete anything outside the official register as soon as its original purpose is served, which for most operational data is far sooner than three years.

Collecting and verifying ID without overstepping GDPR

The AEPD has been direct on this point: hotels are not permitted to request or keep copies of a DNI or passport for guest registration, since doing so collects more data than the register actually needs. A simple form with the required fields, verified visually at check-in, is enough.

For online or remote check-ins, the AEPD’s guidance on lodging registrations points to several acceptable verification paths:

  1. Digital certificate verification, when the guest already holds one.
  2. Payment verification tied to the booking, confirming the cardholder matches the guest.
  3. A one-time code sent to the guest’s phone or email before arrival.

Biometric verification methods like facial recognition entail stricter GDPR protections, so should be used only if a clear and documented legal basis exists. If you use a third-party check-in tool, confirm it operates as your data processor under a signed data processing agreement, and ask for written assurance on where the data is hosted and how it is secured.

Pro Tip: Train front-desk staff to say “I just need to see it, not copy it” when a guest instinctively hands over their passport for scanning.

CCTV, Wi-Fi, and smart-lock logs need their own rules

Security cameras, guest Wi-Fi, and smart-lock systems all generate personal data, and each needs a retention period separate from the guest register.

  • CCTV footage: the AEPD’s practical guidance on video surveillance sets a typical maximum of one month, with incident segments isolated and preserved only when genuinely needed for an investigation.
  • Wi-Fi logs: keep connection logs minimal, avoid capturing browsing history, and set a short automatic deletion period once the guest checks out.
  • Smart-lock and access logs: pseudonymize entries where possible, restrict viewing access to management, and retain only what an audit genuinely requires.

Building a retention schedule you can use this week

A workable retention policy does not need to be complicated. It needs four things: a clear data category, a legal basis, a retention period, and someone accountable for deleting it on time.

  • Map every place guest data lives: your property management system, accounting software, Wi-Fi router, CCTV system, and any check-in app.
  • Assign a legal basis to each category (legal obligation for the register, contract for billing, consent for marketing).
  • Set the retention period and a deletion trigger date for each category.
  • Name one person responsible for running deletions and confirming they happened.
  • Log every deletion with a date and a short note, so you have proof ready if an inspector ever asks.

A sample schedule looks like this: official traveler register, three years from checkout; tax invoices, four years from issue; CCTV footage, one month, with incident segments saved separately; marketing consents, retained until the guest withdraws consent, with a record kept of when consent was given. Review the whole schedule twice a year, since rules and your own operations both shift over time. Deletion proof does not need to be elaborate: a spreadsheet row with a timestamp is often sufficient to show an inspector that your process works as described.

What to demand from any check-in or reporting platform

If you run guest data through software, the platform itself becomes part of your compliance picture. Before adopting one, check for these capabilities.

  • Automated reporting to SES.Hospedajes, so submissions happen on time without manual re-entry.
  • Hosting within the European Union, with role-based access control limiting who can view guest records.
  • Scheduled, automatic deletion once a retention period ends, paired with an audit log that cannot be edited after the fact.
  • Secure authentication methods for both staff and guests, rather than plain photo uploads of ID documents.

Some guest check-in and reporting platforms operationalize several of these points directly: sending guest data to SES.Hospedajes automatically under Real Decreto 933/2021 and GDPR, hosting information on infrastructure inside the EU, and connecting with smart locks for self check-in flows that avoid manual ID handling. Whatever platform you choose, ask for a signed data processing agreement, a list of subprocessors, a breach notification timeline, and written guarantees on data export and deletion. On-site or remote audit rights are worth negotiating too, since they give you leverage if something goes wrong later.

Pro Tip: Ask any vendor to show you, in writing, exactly when and how guest data gets deleted after the retention period ends, not just that it “complies.”

A pragmatic starting point for small teams

Start with the register and deletion controls, since that is where the legal obligation is clearest and the risk of getting it wrong is highest. Keep marketing lists on their own separate schedule from day one. Retrain front-desk staff to stop photocopying IDs and to rely on visual checks or digital verification instead. A single afternoon spent mapping where guest data actually sits, your PMS, your Wi-Fi router, your accounting folder, is usually enough to start a quarterly purge habit that keeps you out of trouble.

— Sofía Herrera

Let EuroCheckin handle the reporting and retention logic for you

Running a hotel means your attention belongs at the front desk, not inside a spreadsheet tracking deletion dates. EuroCheckin automates the parts of this process that cause the most errors: guest data goes to SES.Hospedajes automatically, records are stored on EU-based infrastructure, and the platform logs activity for when you need to show an inspector your process works.

Eurocheckin

The online check-in is multilingual and unlimited, with smart links for Airbnb, Booking, and Vrbo, and it syncs calendars across more than a dozen platforms to prevent overbooking. For hotels specifically, EuroCheckin para hoteles is priced from 3 EUR per month per room, while properties can also use Registro en SES Hospedajes as a standalone service from 79 EUR one-off per accommodation. If you manage a wider portfolio, EuroCheckin para alojamientos starts from 5 EUR per month per property, with a free trial available. Book a demo to see your own retention schedule run on autopilot.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Let EuroCheckin handle the reporting and retention logic for you — overview diagram

FAQ

Can hotels see my browsing history when I use hotel Wi-Fi?

Hotels should not be collecting or storing your detailed browsing history as a matter of good practice and data minimization under GDPR. Legitimate Wi-Fi logging is generally limited to connection records, not the content of the sites you visit, and those logs should be kept only briefly.

Does GDPR cover Spain?

Yes, the GDPR applies directly in Spain as an EU member state, alongside Spain’s own data protection law and sector rules like Real Decreto 933/2021 for lodging. Hotels in Spain must satisfy both the EU-wide principles and the national registration requirements at the same time.

What are the specific GDPR requirements for hotels?

Hotels must apply GDPR’s core principles, including data minimization and storage limitation, to every category of guest data outside the official security register. In practice, this means collecting only what each system genuinely needs, documenting a legal basis for each use, and deleting data once its purpose has been served, as outlined by the AEPD’s guidance on lodging registrations.

Does Spain house migrants in hotels?

This question falls outside hotel data retention obligations and is a matter of Spanish immigration and social policy rather than data protection law. Hotels that do participate in any government-contracted housing arrangement would still need to follow the same guest registration and data protection rules described in this guide.

Sources

Related articles