GDPR guide for your Hotel in 10 practical steps
GDPR is a game changer for hoteliers, with strict penalties if you don’t comply, so it’s essential to be prepared. In our last article we introduced you to GDPR, outlined its impact on the hotel industry and how it will affect hotel marketing campaigns.
Here, we offer our Top Ten Tips to help you get compliant with the GDPR:
Table of contents for this article:
1. Educate your staff
Everyone in your organisation who deals in collecting PII (Personally Identifiable Information) should be aware of GDPR. They must understand how to collect, access, use and disclose personal information as well as how to restrict access to cardholder data. Employees must also be advised on how to manage online security and know how to properly dispose of documents containing payment card data. Hotel Management should be well educated and understand any necessary changes to procedures or systems and the impact that will have on their departments.
2. Understand Guest Rights and Access

Here is an outline of European guest rights under GDPR:
- The right to access his/her data
- The right to rectification
- The right to erase
- The right to restrict processing
- The right to transfer his data to another party
- The right to object
- The right not to be included in automated marketing initiatives or profiling
As a hotelier, you will need to be prepared for when a guest makes a request. You must reply within one month, free of charge. If you refuse a request, you must inform the guests about your reasons, provide any details about the Privacy Commission, and the name and contact details of your DPO (Data Protection Officer, more on this in point 8) so that the guest understands how to file a complaint.
3. Communicate
Under GDPR you must clearly state what data you are capturing (the nature of the data), explain to the customer why you are capturing that data (the purpose of the data) and explain who is requesting that data (the identity of the Data Controller) and who else will have access to this data. You must also state how long you will keep that data. The reasoning is that; this will be enough to allow the customer to make an informed decision to opt-in. You can easily do this on the registration card, or when checking-in online. You must remember to adapt all legal statements and customer agreements to the new legislation. Please note that you can only use the data for the agreed reason that the customer gave and not for multiple marketing campaigns.
Do you have useful and safe processes in place to manage guest data?
Meet HotelMinder - We empower ambitious hoteliers maximize performance, guests satisfaction & coworkers engagement with modern technology and expert know-how.
Learn More4. Collect only what you need
Review what information you’re asking a guest for and decide what’s really necessary. For example, a guest departure date is an essential piece of information, but asking for their date of birth may not be.
5. Always ask for consent

Due to the GDPR ‘explicit consent’ rule, it’s essential that you review how you are obtaining and recording guest consent.
Guests arrive at a hotel via multiple sources, including travel agents, telephone reservations or even walk-ins.
You must consider all and give clear ‘opt-ins’.
Pre-ticked boxes aren’t going to work this time.
There is also an additional consideration for children under 16 years of age. Y
ou must seek the authorisation of parents or responsible adults to process a minor’s data.
You must also consider what to do if a guest withdraws consent and be clear on GDPR guidelines.
6. Maintain a Data Register
Document the information you are holding, where you’re storing it, where it’s from and who you will be sharing it with. You’ll also have to note that the guest has consented in this data collection. The Data Register is essential to map all your data streams. You may need to review your current policies and procedures to accommodate this.
7. Data Security
Hoteliers are vulnerable to data breaches and theft because, as an industry, they collect so much information from multiple sources. Be ready to detect and remedy any theft of personal data. The data register should be able to provide insight into which pieces of data are concerned. Any incident should be reported within 72hrs to the Privacy Commission, for all cases where there is a risk that guest data may have been compromised. You must also ensure your network and storage systems are up-to-date with the latest intrusion detection programs and should have successfully passed penetration testing.
Do you have useful and safe processes in place to manage guest data?
8. Data Protection

Consider Data Protection principles for any new tool or procedure undertaken, right from the design stage. An Impact Assessment is required when major new technology is introduced, or significant upgrades are taking place on systems which contain personal data.
Nominate a Data Protection Officer (DPO) who is knowledgeable on the importance of personal data processing.
Although this could be an additional task for an existing employee, it is mandatory to have a DPO when you handle large volumes of personal data.
He must be aware of the hotel data flow and have a copy of the Data Register at all times.
The DPO must be named on all privacy statements on any media. When filing a complaint, the guest will reference the DPO by name.
9. Know your third parties
It’s likely that you’ll be dealing with third parties or subcontractors on your data collection journey.
Make sure you are aware of who they are and what your current contractual obligations are.
Some of them might be:
- Your website design agency
- Your Website Booking Engine
- Your Property Management Software
- Your Channel Manager
Review these contracts to include any GDPR related aspects, ensure that the contractor is aware of his obligations under GDPR, and that services or systems help you meet your GDPR requirements.
10. Considerations for International / Group Hotels
For International and Group Hotels, it’s important to align procedures across the group and nominate a lead (presumably the country or regional office) for the coordinated GDPR efforts. If you are present in multiple EU countries, it is required to identify a "main establishment", and also the country lead supervisory authority.
Conclusion

Preparation, knowledge and good online security systems are key under GDPR. You will need to create a hotel strategy which ensures that all GDPR compliances are met.
If you still feel swamped, get in touch with us and we will help you to devise a plan which works for your organisation. You simply can’t be left behind on this one!

Benjamin Verot
HotelMinder Co-FounderBenjamin is originally from France, but has been living abroad and travelling extensively for over 15 years. He currently lives in Dublin, Ireland, with his Polish wife and young daughter. With years of experience in assisting hoteliers manage operations or opening up innovative hotels across the world, Benjamin has been a trusted name in the hospitality industry, and is well known for his knowledge and expertise in European markets. Currently, Benjamin works across the globe, helping hotels use modern technology to improve operations & revenue. He understands the challenges independent hoteliers face, and believes that running a hotel should be simple. Benjamin's life goal is to open a chain of eco-friendly hotels, promoting sustainable tourism and local community development.
Most Popular
Health Audit
A complete review of your hotel strategy, marketing and operations, done by industry experts with years of experience.
Learn MoreNewsletter
Sign up for our newsletter to receive more articles like this one directly in your Inbox!
SubscribeCategories
Read our latest news & Articles
In depth articles, guides, tips and recommendations about Hotel Technology, Digital Marketing, Revenue Management & Hotel Operations.