Hotel booking engines, GDPR and payment security

Editorial review: 8 October 2026. This article originally discussed preparations for GDPR. The explanations of booking security, penalties and children’s data have been revised. The original publication date is retained.

A hotel’s booking engine is part of a wider system that handles guest data. The website, payment provider, PMS, staff access and day-to-day procedures all need consideration. Selecting a supplier is therefore a security and operational decision as well as a commercial one.

Why technology and staff practices must work together

Review who can access guest records, how credentials are managed and how data moves between systems. Shared accounts, unnecessary exports and uncontrolled copies make oversight harder. Staff need clear procedures for using approved systems and reporting incidents. Technical and organisational safeguards must be proportionate to the risks. EDPB: secure personal data.

For a booking-engine comparison, we recommend checking access controls, integration permissions, data-export options, support responsibilities and how the supplier provides evidence of its security arrangements.

What PCI DSS does—and does not—demonstrate

PCI DSS addresses protection of payment account data. Its scope and validation requirements depend on the payment environment and the responsibilities of the parties involved. A booking engine’s payment-security arrangements should be reviewed together with those of the hotel and its payment provider. PCI SSC: PCI Data Security Standard.

Do not rely on an informal “PCI certificate”. PCI SSC recognises its official validation documents, such as the applicable Report on Compliance, Attestation of Compliance or Self-Assessment Questionnaire. Request evidence appropriate to the service and its scope. PCI SSC: documentation recognised for validation.

Payment security and GDPR address different requirements. Evidence of PCI DSS compliance does not, by itself, establish lawful processing, adequate privacy information or the handling of guests’ rights under GDPR. EDPB: data protection basics.

GDPR responsibilities extend beyond the booking engine

The GDPR has applied since 25 May 2018. When a supplier processes guest information on the hotel’s behalf, document the respective responsibilities in the required processing contract. The actual role of each organisation matters; outsourcing does not remove the hotel’s responsibilities. EDPB: controllers and processors.

Hotels also need a process for assessing personal data breaches. A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to pose a risk to people’s rights and freedoms. A high-risk breach may also require communication to affected individuals. Processors must notify their controller without undue delay. EDPB: data breaches.

How GDPR penalties work

Article 83 provides different maximum tiers. Certain infringements can attract up to €10 million or, for an undertaking, 2% of the preceding financial year’s worldwide annual turnover, whichever is higher. Others can attract up to €20 million or 4%, whichever is higher. These are ceilings, not automatic fines: the authority assesses the circumstances of the case. EDPB Guidelines 04/2022 on administrative fines.

What to consider when children’s data is involved

GDPR Article 8 concerns processing based on consent when an information society service is offered directly to a child. It does not impose a universal parental-consent rule on every hotel reservation involving someone under 16. The applicable age threshold and lawful basis must be assessed in context. EDPB Guidelines 05/2020 on consent.

In Spain, Article 7 of the LOPDGDD sets the general threshold for a child’s own data-processing consent at 14, with exceptions where the underlying legal transaction requires parental or guardian assistance. That data-protection threshold does not itself establish the capacity to enter into a hotel contract. Spanish LOPDGDD, Article 7.

Our recommendation is to include security, privacy and operational responsibilities in the booking-engine evaluation, with the hotel’s privacy adviser involved where the processing requires it.