Español
Updates

3 Years Retention: What Spanish Hosts Must Report to SES.HOSPEDAJES

Spain-focused GDPR checklist for hosts: which Annex I guest fields to submit to SES.HOSPEDAJES, why not to store ID images, and how to automate reporting...

3 Years Retention: What Spanish Hosts Must Report to SES.HOSPEDAJES

Property owners and managers in Spain must collect the exact traveler fields set out in Royal Decree 933/2021 and send them through SES.HOSPEDAJES within the decree’s deadlines. The lawful basis for this processing is a legal obligation under GDPR Article 6.1.c, yet data minimization still applies, so you should never keep copies of ID documents.

TL;DR:

  • You must collect only the exact traveler fields listed in Annex I, including full name, ID details, nationality, sex, and date of birth, without extra data.
  • Submission to SES.HOSPEDAJES must be done electronically, with property registration completed beforehand, and automated batch uploads are recommended for multiple units.
  • ID copies or photos are prohibited; verification can rely on visual checks, digital IDs, or one-time codes, and data retention is limited to three years after the stay.
  • Most compliance issues stem from late submissions, storing ID images, or inconsistent records, which can lead to fines or enforcement actions.
  • Guest data for reporting cannot be used for marketing unless explicit separate consent is obtained, and proper internal documentation and staff training are essential.

Table of Contents

What Royal Decree 933/2021 requires from your property

Real Decreto 933/2021 sets registration duties for anyone who provides lodging or short-term vehicle rental in Spain. The obligation reaches hotels, hostels, tourist apartments, vacation rentals, and vehicle rental companies that operate without drivers. A purely occasional, non-professional arrangement may fall outside the strictest reporting duties, but if you advertise a property for tourist stays, you are almost always covered.

The decree requires you to keep an electronic registry of every guest and to transmit specified data to the competent authority, currently through SES.HOSPEDAJES.

  • Hotels, hostels, and tourist apartments must register every stay, regardless of length.
  • Vacation rental hosts working through a platform are still the ones responsible for submitting data, unless a written agreement assigns that task to an intermediary.
  • Vehicle rental companies without drivers face the same registry and communication duties as lodging providers.

When several parties sit in the same booking chain (owner, property manager, booking platform), the Ministry of Interior’s guidance treats the accommodation provider as the default responsible party unless another entity has formally taken on the submission role.

Which guest and booking fields you must collect

Annex I of the decree lists the exact fields you need, and nothing more. Collecting extra information, even with good intentions, works against the minimization principle that GDPR expects you to follow.

  • Full name, document type and number, nationality, sex, and date of birth.
  • Signature of the traveler, required for anyone over 14 years old.
  • Address and contact details as declared by the guest.
  • Check-in and check-out dates, along with a payment reference for the stay.
  • Vehicle details, when the booking involves a rental car without a driver.

Minors under 14 do not need to sign the registration form, though their basic identification data still gets collected and reported by the adult making the booking. If a guest refuses to provide a required field, you are within your rights to decline the booking, since the data collection itself is a legal obligation rather than an optional request.

How to submit data through SES.HOSPEDAJES

SES.HOSPEDAJES is the official telematic channel where you register your property and send guest records to the Ministry of Interior. The platform has operated since 2023, and submissions must go through this telematic procedure rather than paper forms or email.

  1. Register your property on SES.HOSPEDAJES and request your access credentials before your first guest checks in.
  2. Submit traveler data at the time of booking or contracting, following the fields in Annex I.
  3. Send an additional communication promptly for specific events the decree flags, such as a change in occupancy or an unscheduled arrival.
  4. Delegate submission to an authorized third party if your operation runs through a property manager or software provider, documenting that delegation in writing.

Pro Tip: Test your submission flow in the SES sandbox environment before your first live booking, so format errors surface before they become missed deadlines.

Batch uploads work well for hosts managing several units, and an automated integration removes the manual re-entry that causes most late or rejected submissions.

GDPR and RD 933/2021: lawful basis, minimization, and retention

The registry obligation itself rests on a legal obligation under GDPR, specifically Article 6.1.c, which means you do not need separate consent to collect the Annex I fields. That legal basis does not give you a free pass to collect more than the decree requires, since purpose limitation and minimization still shape what you keep and for how long.

The AEPD’s note on traveler registration is explicit: do not request or retain copies of identity documents. A compliant intake form with the required fields is enough, and verification can rely on other methods.

  • A visual check of the ID at check-in, without photographing or scanning the full document.
  • Certified digital identity tools or electronic signature platforms that confirm identity without storing an image.
  • Payment confirmation or a one-time code sent to the guest’s phone or email as a secondary check.

Registry data must be kept for three years after the service ends, as set out in the decree’s retention rules, after which it should be deleted unless another law requires longer storage.

A compliance checklist you can put to work this week

Turning the legal text into daily practice comes down to a short sequence of decisions, made once and then automated.

  1. Register your property on SES.HOSPEDAJES and secure your access credentials.
  2. Build a digital intake form limited to the Annex I fields, nothing more.
  3. Pick one verification method (visual check, certified digital ID, or OTP) and apply it consistently.
  4. Automate the submission to SES.HOSPEDAJES so every booking is reported without manual re-entry.
  5. Set a retention and deletion rule for three years, with an automatic trigger to purge records after that window.
  6. Write down the process in a short internal document so staff can follow it the same way every time.

Pro Tip: Keep a simple log of who verified each guest and how, since that record protects you if a regulator ever questions your process, without requiring you to store the ID image itself.

On the technical side, EU-based hosting, encryption in transit and at rest, restricted staff access, and basic audit logging cover the organizational measures GDPR expects. Syncing your booking calendars across platforms avoids duplicate entries, and requiring a signature for guests over 14 closes a common gap auditors flag.

Common mistakes that lead to fines

Most enforcement problems trace back to a handful of repeated errors rather than deliberate violations.

  • Late or missing submissions to SES.HOSPEDAJES, often from manual processes that fall behind during busy weeks.
  • Storing ID copies or guest photos, which the AEPD’s press release specifically warns against when there is no lawful basis for keeping that image.
  • Inconsistent records across properties or platforms, which creates confusion during an inspection.

Administrative infractions under Spanish data protection and tourism rules can range from minor warnings to significant fines depending on severity and recurrence. Documented procedures, periodic internal audits, and a trusted electronic submission system reduce the risk of each of these mistakes.

How to handle a data breach involving guest records

A breach involving guest data, whether a leaked registry file or unauthorized access to your booking system, triggers notification duties under GDPR regardless of how the breach happened. Once you become aware of an incident, you generally have 72 hours to assess whether it poses a risk to guests’ rights and, if so, to notify the AEPD.

Guest data breach response timeline

Start by containing the exposure: revoke compromised credentials, isolate the affected system, and confirm which records were involved. Because guest data under RD 933/2021 includes identity details and travel dates, even a small leak can expose sensitive information about where someone stayed and when.

Document the incident internally before you report it: what data was exposed, how many guests were affected, and what containment steps you already took. If the breach is likely to create a high risk for guests, for instance if document numbers were exposed in a readable file, you must also notify the affected individuals directly, in plain language, explaining what happened and what they should do.

Keeping your intake form limited to Annex I fields and avoiding ID image storage, as the AEPD recommends, shrinks the scope of any future breach. A smaller dataset means a smaller notification burden and less exposure for your guests if something does go wrong.

What rights your guests have over their data

Guests whose data you collect for SES.HOSPEDAJES retain their GDPR rights, even though the underlying processing is mandatory. They can ask you what data you hold about them, correct an error in their record, and request information about how long you retain it.

Because the processing rests on a legal obligation, a guest cannot demand that you delete their registry data before the three-year retention period ends, since you are required by law to keep it. What you can and should do is be transparent from the start: tell guests, in your check-in form or house rules, that their data will be reported to SES.HOSPEDAJES and why.

Guests also have the right to know who else has access to their information, which matters when a property manager, booking platform, and the host all touch the same record. A short privacy notice at check-in, written in plain language, covering what you collect, why, and for how long, satisfies this expectation without turning check-in into a legal seminar.

Coordinating guest data with Airbnb, Booking, and other platforms

Most Spanish hosts collect bookings through more than one channel, and each platform handles guest data differently before it ever reaches you. Airbnb, Booking, and Vrbo pass along a guest’s name and contact details, but the Annex I fields, document number, nationality, signature, often still need to be collected directly from the guest once the booking is confirmed.

This split creates a practical risk: if you assume the platform has already reported the stay to SES.HOSPEDAJES, you may miss your own obligation, since the decree places that duty on the accommodation provider by default. A written clarification with your property manager, if you use one, about who submits the data removes ambiguity before a guest ever arrives.

Guest data flowing from platforms to reporting

Platforms are not a substitute for your own compliant intake form. Even when a booking site collects basic details during reservation, you still need a separate, GDPR-aligned check-in step that gathers the exact fields the decree requires and records how you verified identity, without relying on whatever the platform happened to capture.

Can you use guest data for marketing?

The data you collect for SES.HOSPEDAJES exists for a legal obligation, which means you cannot repurpose it for marketing emails or promotional offers without a separate lawful basis. GDPR’s purpose limitation principle draws a clear line here: data gathered to satisfy a regulatory requirement cannot automatically feed your newsletter list or loyalty program.

If you want to send guests promotional messages after their stay, you need their explicit consent, collected separately from the mandatory registration form, with a clear explanation of what they are opting into. Bundling a marketing consent checkbox into the same form used for SES.HOSPEDAJES reporting blurs that line and creates unnecessary risk.

A simple, separate opt-in at checkout, worded plainly, and an easy way to withdraw consent later, keeps your marketing practices clean and your mandatory reporting process untouched by consent questions it was never designed to answer.

Where compliance efforts should start

Get the registration and the intake form right before anything else: a clean Annex I-only form, properly verified, prevents most of the problems that follow. Automating submissions to SES.HOSPEDAJES then cuts both your workload and your legal exposure.

Document how you verify guests and train anyone on your team who handles check-in, so the process holds up the same way every time, with or without you present.

— Sofía Herrera

EuroCheckin: putting this checklist on autopilot

There are platforms designed around the exact steps outlined above, aiming to reduce host time loss and errors from manual SES.HOSPEDAJES submissions by automating data sending, keeping records on secure EU-based infrastructure, and avoiding unnecessary ID copy storage.

Eurocheckin

  • Automated SES.HOSPEDAJES submissions with no manual re-entry.
  • Multilingual online check-in that collects only the required fields.
  • Calendar sync across Airbnb, Booking, Vrbo, and over a dozen other platforms to avoid overbookings.
  • Digital contracts with electronic signatures, covering the signature requirement for guests over 14.

Plans start from €5 per month per accommodation for EuroCheckin para alojamientos, with a free trial so you can see the workflow before committing. Hotels can review a dedicated setup through EuroCheckin para hoteles, priced from €3 per month per room.

FAQ

Does Spain comply with the GDPR?

Yes, Spain applies GDPR directly as an EU member state, supplemented by its own Organic Law on Data Protection. Spanish authorities, including the AEPD, enforce GDPR alongside sector-specific rules like Royal Decree 933/2021 for tourist accommodation.

What is the new law in Spain for tourists?

Royal Decree 933/2021 requires hotels, vacation rentals, hostels, and vehicle rental companies to collect specific traveler data and report it through SES.HOSPEDAJES. It replaced the older paper-based traveler registration system with a mandatory electronic process.

What is GDPR in Spanish?

GDPR is known in Spanish as the Reglamento General de Protección de Datos, or RGPD. It sets the rules for how personal data, including guest information collected at check-in, must be processed, stored, and protected across the European Union.

What is the Data Protection Authority in Spain?

The Agencia Española de Protección de Datos, or AEPD, is Spain’s data protection authority. It issues guidance for sectors like tourism, including its note on traveler registration advising against keeping copies of identity documents.

Sources

Related articles