Español
Updates

Avoid 24 Hour Penalties: SES Hospedajes User Roles Under RD 933/2021

Map RD 933/2021 to clear SES.HOSPEDAJES user roles so your team meets reservation and 24 hour reporting deadlines. Includes EuroCheckin automation tips.

Avoid 24 Hour Penalties: SES Hospedajes User Roles Under RD 933/2021

Spanish law obliges every accommodation provider, hotels, tourist apartments, rural houses, and campsites, to communicate guest data to SES.HOSPEDAJES within strict deadlines. The practical response is simple: register your establishment, assign an administrator user with digital certificate or Cl@ve access, and follow data-minimization rules so every required field reaches the platform on time.

TL;DR:

  • Smaller or non-professional hosts who rent regularly may still be required to report guest data and must use the telematic system unless they qualify for exemptions.
  • Accurate registration involves verifying identity with a digital certificate or Cl@ve and maintaining updated internal records to prevent compliance gaps.
  • Submission deadlines are immediate or within 24 hours of guest check-in, and failures to report on time risk penalties or rejection of data.
  • Only specific guest data fields are required, including full identification, contact, and transaction details; collecting unnecessary documents like ID copies is prohibited.
  • Automating data submission through compliant platforms reduces errors and keeps data synchronized across channels, but operators remain responsible for data accuracy and timely reporting.

Table of Contents

1. Who is obliged and what SES.HOSPEDAJES actually does

Real Decreto 933/2021 sets the scope: any business that offers lodging to the public, hotels, hostels, tourist apartments, rural tourism houses, campsites, and vacation rental platforms operating in Spain, falls under this duty. SES.HOSPEDAJES is the telematic system run by the Ministerio del Interior that centralizes these communications and keeps custody of the data on behalf of the Secretaría de Estado de Seguridad.

A few distinctions matter before you set anything up:

  • Professional operators must report through the telematic system, with no paper alternative accepted.
  • Occasional or non-professional hosts may have reduced duties, but renting out a property regularly to travelers almost always counts as a professional activity under the decree.
  • The platform exists to replace the old paper guest book entirely, not to add a parallel process.

2. How to register your establishment and get SES access

Getting access is an administrative task, not a technical one, but it takes a few correct steps in order.

  1. Register the establishment with the Ministerio del Interior and request an entity account on SES.HOSPEDAJES.
  2. Verify the account using a certificado digital or Cl@ve, the two accepted identification methods for telematic submissions.
  3. Enable cl@ve-Firma or autofirm@ when the platform requires an electronic signature for certain actions.
  4. Document who legally represents the business, an owner, a manager, or an authorized employee, since SES ties submissions to that identity.
  5. Keep a current list of admin contacts so access does not break when staff change.

Pro Tip: Assign a backup admin from day one. Losing the only person with certificate access during a busy season creates a compliance gap you cannot close quickly.

3. When you need to report: events and deadlines

The duty to communicate is tied to specific events, not to a fixed daily schedule. Real Decreto 933/2021 lists them clearly:

  • Contract or reservation: report as soon as the booking is confirmed, before the guest arrives.
  • Cancellation: report immediately once the booking falls through.
  • Start of service: report when the guest actually checks in, immediately or within 24 hours at the latest.

Reporting the arrival does not replace the earlier reservation notification; both are separate obligations with their own windows. Professional operators must use the telematic channel for all of this; non-professional hosts with reduced duties may have alternative, non-telematic routes, though these are the exception rather than the rule.

4. What guest data SES requires under Anexo I

Anexo I of the decree spells out exactly which fields you need to collect and submit, and skipping any of them is a common source of rejected or incomplete parts.

  • Guest identity: full name, surnames, document type and number or support number, nationality, date of birth, sex, and habitual residence address.
  • Contact information: phone number and, where applicable, email.
  • Transaction details: contract reference, check-in and check-out date and time, the property address, and payment method with transaction identifier when one applies.
  • Minors: anyone over 14 must sign the entry report personally, while for guests under 14 the accompanying adult provides the data and the operator records the relationship between the minor and that adult.

Missing a field, especially the document support number or the relationship record for a minor, is one of the most frequent reasons parts get flagged.

5. Data protection: AEPD guidance and practical minimization

Collecting the right fields does not mean collecting everything you can. The AEPD has stated explicitly that requesting or storing a copy of a guest’s DNI or passport is not permitted, since it conflicts with the GDPR’s data-minimization principle. You need the document number, not an image of the document itself.

  • Verify identity visually at check-in, or through a digital certificate when the process is remote.
  • Cross-check payment data as a secondary verification method.
  • Use an SMS or email code for online check-in where identity confirmation is needed before arrival.
  • Keep registry data for three years after the service ends, matching the retention period set out in the decree, and understand that SES itself holds the data under restricted access, limited to security forces and judicial authorities for investigation purposes.

Pro Tip: Build your check-in form around the exact Anexo I field list. Anything beyond that list is a liability, not a safeguard.

6. Operator responsibilities and common recordkeeping mistakes

The legal responsibility for accurate, timely reporting sits with you, the holder of the activity, even when a third-party tool or employee handles the actual submission. Automating the process does not transfer that accountability.

  • Keep a single authoritative guest record per booking to avoid duplicate or conflicting submissions.
  • Maintain an internal log of who submitted what and when, useful during any inspection.
  • Watch for the most common pitfalls: late reporting past the 24-hour window, storing more personal data than Anexo I requires, and forgetting to update the establishment’s registered details after a change of manager or address.

7. Setting up SES Hospedajes user roles and permissions in practice

Once registration is sorted, the real compliance work is defining who can do what inside your operation. A clear role structure limits mistakes and narrows who can see sensitive guest data.

  1. Admin: configures the establishment, manages the SES account, and assigns or removes other users.
  2. Operator or data-entry user: submits the actual parts for each booking, with no access to account-level settings.
  3. Auditor or read-only user: reviews submission logs and historic records without the ability to edit them.
  4. Separate the power to export or alter historic data from the power to submit new entries; the same person should rarely hold both.
  5. Require two-factor authentication for every admin account, since that login controls your entire SES access.

A short onboarding checklist keeps this consistent as your team grows: verify each new user’s identity before granting access, assign the minimum role that matches their job, walk them through the AEPD’s minimization rules, and document in writing who is authorized to submit on behalf of the business.

Pro Tip: Review user roles every time staff change. An ex-employee with live SES access is a compliance risk you can close in minutes.

Illustration of staff access review workflow

8. How automation maps to these roles: EuroCheckin as an example

A platform built around the same role structure removes most of the manual risk. A platform can assign an admin dashboard for user management, route guest data into automated SES submissions, and sync calendars across Airbnb, Booking, and other channels to catch bookings that might otherwise get missed.

  • Automatic sending to SES.HOSPEDAJES removes the manual step where fields get mistyped or deadlines get missed.
  • Guest data is stored on infrastructure located in the European Union, aligned with GDPR expectations.
  • Multilingual online check-in collects the exact Anexo I fields from the guest before arrival.
  • Calendar sync across more than a dozen platforms keeps bookings, and the reporting triggers tied to them, from slipping through.

None of this removes your own duty to verify that the data submitted on your behalf is accurate. Any vendor integration is a tool, not a substitute for checking the result.

9. Compliance-first operations for Spanish accommodation managers

Clear roles reduce legal risk because they remove ambiguity about who submits what, and automation removes the manual errors that cause late or incomplete parts. Neither replaces your own accountability as the operator. When a case gets complicated, a minor traveling without both parents, a long-term corporate booking, a cancellation after check-in, talk to a lawyer rather than guess.

— Sofía Herrera

EuroCheckin: automate SES submissions and manage user roles

Running SES compliance by hand means someone on your team re-entering the same guest data for every booking, every night. EuroCheckin removes that step: guest data collected through multilingual online check-in is sent automatically to SES.HOSPEDAJES, with an admin dashboard that mirrors the role structure described above, admin, operator, and read-only access, so you decide who touches what.

Eurocheckin

Calendar sync across Airbnb, Booking, Vrbo, and other channels keeps every booking visible in one place, and digital contracts with electronic signatures handle the paperwork guests expect before arrival. Plans start from 5 EUR per month per accommodation for EuroCheckin para alojamientos, with a free trial available, or 3 EUR per month per room for hotels through EuroCheckin para hoteles. If you only need help with SES registration itself, that service starts from 79 EUR one-off per accommodation through the SES registration service.

Sources

FAQ

How do I register my guests in Spain?

You collect the Anexo I fields, full name, document number, nationality, and the rest, then submit them through SES.HOSPEDAJES using a certificado digital or Cl@ve. Professional operators must do this telematically, with reservation data sent at booking and arrival data sent immediately or within 24 hours of check-in.

Is a holiday home in Spain a good investment?

This depends on location, financing, and how the property is managed, and it falls outside the legal reporting duties this guide covers. Any owner renting one out regularly still needs to meet the same SES.HOSPEDAJES obligations as a professional accommodation provider.

Do they have social housing in Spain?

Spain has public and subsidized housing programs (vivienda de protección oficial) managed at the regional and municipal level, separate from the tourist accommodation rules discussed here. These programs do not affect the SES.HOSPEDAJES reporting duties that apply to vacation rentals and hotels.

What percentage of Spain’s economy is tourism?

Tourism is a major contributor to Spain’s economy, though the exact current share varies by year and by the data source consulted. What stays constant is the legal duty: any business offering paid lodging must comply with RD 933/2021 and report guest data to SES.HOSPEDAJES.

Related articles