GDPR for hotels: guest data, marketing and suppliers

Editorial review: 8 October 2026. This article originally discussed the transition to GDPR. Its legal explanations have been corrected and updated. The original publication date is retained.

Hotels handle guest contact details, booking information and other personal data across their website, booking engine, PMS and communications. Protecting that information requires coordinated processes as well as suitable technology.

What GDPR means for a hotel

The General Data Protection Regulation is Regulation (EU) 2016/679, not a directive. It has applied since 25 May 2018. In Spain it is complemented by national data protection legislation. EU General Data Protection Regulation (official BOE publication).

For each use of personal data, the hotel needs a defined purpose and an appropriate legal basis. Information needed to manage a reservation is not automatically governed by the same basis as promotional mailing. Consent is one legal basis, rather than a requirement for every processing operation. Collect only what is needed, explain its use and define retention periods that account for applicable legal obligations. EDPB: data protection basics.

Protect guest information throughout the process

Map where data is collected, stored and shared. Review access permissions, staff training, secure transmission, backups and the handling of exports from hotel systems. Security measures should reflect the risks of the actual processing; neither a new website nor a single software product guarantees compliance. EDPB: secure personal data.

Make it easy for guests to exercise their rights

Guests must be able to understand how their data is used and submit requests to exercise their applicable rights. Provide an accessible contact channel, verify identity proportionately and establish a process for answering requests, generally within one month. A dedicated guest portal may be useful, but the GDPR does not universally require one or a dashboard listing individual employees who access data. EDPB: responding to individuals’ rights.

Apply the right rules to email marketing

For hotels subject to Spanish law, promotional email must also comply with the LSSI. Its Article 21 generally requires prior request or express authorisation. A limited exception concerns an existing contractual relationship where contact details were obtained lawfully and the company markets its own similar products or services. A simple, free way to object must be available at collection and in each commercial message. Spanish LSSI, Article 21.

Our practical recommendation is to keep evidence of the applicable permission or exception and separate reservation messages from optional marketing. Purchasing an address list does not, by itself, authorise a hotel to send promotional email.

Check suppliers and international transfers

Identify the role each supplier actually performs. Where it processes data on the hotel’s behalf, the controller–processor relationship requires a contract specifying the processing and responsibilities. Review subprocessors and security commitments as part of supplier selection. EDPB: controllers and processors.

Transfers of personal data outside the European Economic Area need a valid transfer mechanism, where applicable, in addition to the ordinary processing requirements. Depending on the situation, this may involve an adequacy decision or appropriate safeguards such as standard contractual clauses, with the required assessment and supplementary measures. A supplier’s general statement that it is “GDPR compliant” is not a substitute for that review. EDPB: international data transfers.

For hotel marketing teams, the practical priority is to connect these requirements with the real guest journey: forms, reservations, CRM, newsletters and the people who operate them.