Español
Updates

Hotel GDPR in Spain: Six Legal Bases, but Registration Is Not Consent

Learn how Spanish hotels can choose and document a GDPR lawful basis for guest registration, bookings, CCTV, and marketing, using a clear compliance...

Hotel GDPR in Spain: Six Legal Bases, but Registration Is Not Consent

Hotels typically rely on four lawful bases under GDPR: contract (booking and payment), legal obligation (guest registration for authorities), legitimate interest (CCTV, security analytics), and consent (marketing emails, optional upsells). The first task for any property is simple: map every single processing purpose to one of these bases and write that mapping down. Guest registration itself almost always falls under legal obligation, not consent.

TL;DR:

  • When neither contract nor law requires processing, document a legitimate interest assessment; reserve consent for optional activities guests can refuse without affecting their stay.
  • Retain registration records for the legally mandated period after the last entry, separately from booking data; do not routinely store full identity document copies.
  • Record separate, dated consent for each marketing channel, make withdrawal as easy as sign up, and keep consent out of booking terms.
  • Record each purpose, lawful basis, retention period, and recipient; assess legitimate interest, and conduct impact assessments for new CCTV coverage or biometric check in.

Table of Contents

The six lawful bases under GDPR, explained for hotel operations

Article 6 of GDPR lists six lawful bases, but hotels will use mainly four of them day to day. We outline each one here with the hotel scenario it typically covers, following the EDPB’s guidance for small businesses.

  • Contract: processing necessary to perform the booking, such as collecting a name, dates, and payment details to confirm a reservation.
  • Legal obligation: data collection required by law, such as the guest registration fields mandated for accommodation providers.
  • Legitimate interest: processing that serves a real business need balanced against guest rights, such as CCTV for property security or fraud prevention analytics.
  • Consent: freely given, specific permission, needed mainly for marketing emails or optional services like a late checkout add-on.
  • Vital interests: rare in hotels, limited to emergencies where someone’s life is at risk.
  • Public interest: applies mostly to public authorities, rarely relevant to private hotel operations.

Here is where hotels get tripped up: payment processing is a contract matter, not a consent matter, and guest lists shared with local authorities are a legal obligation, not something a guest can opt out of. Consent should be reserved for genuinely optional activities. If a guest’s refusal would stop you from delivering the booked service or would put you in breach of a registration law, consent is the wrong basis, because consent that cannot realistically be refused is not valid consent under EDPB standards.

Guest registration requirements, as set out in Real Decreto 933/2021, create a legal-obligation basis for a defined set of fields: identity data, nationality, document number, and dates of stay among them. This basis exists independently of guest preference. A guest cannot decline to provide the legally required fields and still check in.

  • Required fields are set by law and justified strictly for registration purposes, not for marketing or profiling.
  • Registration records must be retained and transmitted through the official telematic procedures described in the regulation.
  • Extra fields beyond what the law requires fall outside the legal-obligation basis and need their own justification.

Registration records must be kept for the legally mandated retention period from the date of the last entry, a schedule confirmed in guidance covering Real Decreto 933/2021. This retention applies specifically to the registration record, separate from any other booking or payment data retention.

The AEPD has clarified that hotels are not permitted to routinely request and store full copies of a passport or national ID card. The legal obligation covers specific data fields, not a photographic copy of the document, and storing scans you don’t need expands your risk without legal cover.

Hotel receptionist checks and returns guest passport

A short decision sequence settles most lawful-basis questions a front desk team will face:

  1. Ask if the processing is necessary to deliver the booked service. If yes, use contract. Payment details, room assignment, and stay dates fall here.
  2. Ask if a specific law requires the data. If yes, use legal obligation. Guest registration fields are the clearest example.
  3. If neither applies, run a legitimate-interest assessment that documents your interest, shows the processing is necessary, and weighs it against the guest’s rights, following the EDPB’s three-part test. CCTV for property security commonly lands here, provided it’s documented.
  4. Only turn to consent when none of the above fits, and the processing is genuinely optional, such as marketing emails or an upsell the guest can decline without affecting their stay.

For marketing, consent needs to be granular (separate toggles for email marketing versus SMS, for instance), recorded with a timestamp, and just as easy to withdraw as it was to give, per the EDPB’s consent requirements.

A frequent error is bundling marketing consent into the general booking terms, which invalidates the consent because it isn’t specific or freely given. Another common mistake is leaning on legitimate interest for something that’s actually a legal obligation. Fix both by separating consent checkboxes from booking confirmation and by checking registration requirements before assuming legitimate interest applies.

Pro Tip: Keep a one-page internal reference mapping each data field you collect to its lawful basis, so front desk staff never have to guess mid-check-in.

Practical GDPR checklist for check-in, ID handling, CCTV, marketing and supplier sharing

Daily operations generate the most GDPR risk, since front desk staff make lawful-basis decisions in real time without always realizing it. A written checklist removes the guesswork.

  • Check-in fields: collect only what registration law requires plus what the booking itself needs; avoid open text fields that invite over-collection.
  • ID handling: record the identity fields required by law, but avoid storing passport or DNI photos as a default practice, consistent with AEPD guidance; online identity verification tools can confirm a guest’s details without retaining a document scan, an approach covered in our guide to collecting guest ID online.
  • CCTV: post visible signage, set a defined retention window, and trigger a legitimate-interest assessment or a DPIA when cameras cover sensitive areas.
  • Marketing: keep a dated record of every consent given, including the exact wording shown to the guest at the time.
  • Supplier sharing: confirm that any third party handling guest data (payment processors, cleaning platforms, channel managers) is bound by a data processing agreement with clear security and deletion clauses.

Pro Tip: Review your check-in form once a year and remove any field nobody on your team can justify by law or by contract necessity.

How to document lawful-basis choices: ROP entries, LIAs/DPIAs and privacy notices

Documentation is what turns a correct lawful-basis decision into a defensible one during an audit. Keep records tight and specific.

  1. Record of processing (ROP): for each processing purpose, note the lawful basis, retention period, categories of recipients, and the specific Article 6 ground you’re citing.
  2. Legitimate Interest Assessment (LIA): for anything resting on legitimate interest, write down the interest itself, confirm the processing is necessary to achieve it, and document the balancing test against guest rights, following the EDPB’s framework.
  3. DPIA triggers: run a Data Protection Impact Assessment when introducing new CCTV coverage, biometric check-in tools, or any large-scale monitoring of guests.
  4. Privacy notice: publish the lawful basis for each purpose in guest-facing language; keep the detailed LIA and ROP internally for inspection.

When a processing activity touches sensitive categories of data or large-scale monitoring, bring in a data protection officer or outside counsel before finalizing the assessment.

Practical example: how a regulation-focused digital guest register reduces compliance risk

Manual check-in invites two recurring problems: collecting fields the law doesn’t require, and losing track of which basis justified which piece of data. A digital guest register built around the registration rules addresses both by enforcing field limits at the point of entry rather than relying on staff memory.

  • Automated forms request legally required fields by default and only request optional fields when the guest actively consents.
  • Every entry carries a timestamp, creating an auditable log of what was collected, when, and under what basis.
  • EU-based storage and direct transmission to the relevant authority support the retention and reporting duties described in guest registration rules.
  • Multilingual forms and e-signatures for optional extras keep consent clear for international guests, rather than buried in a language they don’t read fluently.

Author perspective: where hotel managers should focus to stay compliant and practical next steps

We’d rather see hotel managers spend an afternoon mapping processing purposes to lawful bases than spend a week later explaining to a regulator why a passport scan sat on a hard drive for two years. Strip unnecessary fields from check-in first. Automate the registration process where it’s practical, because a system is far less likely to drift from compliance than a tired front desk at midnight. Keep marketing opt-ins separate and genuinely optional. Set a recurring date, once a year, to review every processing purpose and confirm the basis still holds.

— Sofía Herrera

EuroCheckin: automating guest registration while keeping your lawful basis on record

We built EuroCheckin around the same principle this guide covers: collect only what the law requires, document everything else. Our platform sends guest data straight to SES Hospedajes, stores records on EU-based infrastructure, and skips unnecessary ID document scans in favor of structured data fields.

Eurocheckin

  • Automated reporting to SES Hospedajes removes manual entry and the errors that come with it.
  • Multilingual online check-in and e-signature for optional contracts keep consent clear and recorded.
  • Calendar sync across major platforms helps avoid overbooking issues that can accompany manual processes.

See how it works on our hotel registration page, with hotel plans from €3 per month per room.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is a lawful basis under GDPR?

A lawful basis is the specific legal ground, one of six listed in Article 6, that justifies collecting and using someone’s personal data. Hotels most often rely on contract, legal obligation, legitimate interest, and consent, and must document which basis applies to each processing purpose, per EDPB guidance.

What is the 15-5 rule in hotels?

This isn’t a recognized data protection standard, and we don’t find it referenced in GDPR, EDPB, or Spanish guest-registration guidance. If you’ve encountered this term in a hospitality context unrelated to data protection, it falls outside the scope of lawful-basis compliance covered here.

What is the 80/20 rule in hotels?

Like certain informal rules sometimes mentioned, this is not a GDPR or guest-registration concept found in official guidance. Definitions of this phrase vary by context in hospitality management, but none tie to lawful-basis requirements under GDPR or Real Decreto 933/2021.

Lawful consent must be freely given, specific, informed, and unambiguous, meaning the guest takes a clear affirmative action rather than having a box pre-ticked for them. Consent also needs to be as easy to withdraw as it was to give, and it should never be bundled with the general terms needed to complete a booking, per the EDPB’s consent standards.

Sources

Related articles