GDPR guide for your Hotel - 10 practical steps

GDPR is a game changer for hoteliers, with strict penalties if you don’t comply, so it’s essential to be prepared. In our last article we introduced you to GDPR, outlined its impact on the hotel industry and how it will affect hotel marketing campaigns.

Here, we offer our Top Ten Tips to help you get compliant with the GDPR:

1. Educate your staff

Everyone in your organisation who deals in collecting PII (Personally Identifiable Information) should be aware of GDPR. They must understand how to collect, access, use and disclose personal information as well as how to restrict access to cardholder data. Employees must also be advised on how to manage online security and know how to properly dispose of documents containing payment card data. Hotel Management should be well educated and understand any necessary changes to procedures or systems and the impact that will have on their departments.

2. Understand Guest Rights and Access

Here is an outline of European guest rights under GDPR:

• The right to access his/her data
• The right to rectification
• The right to erase
• The right to restrict processing
• The right to transfer his data to another party
• The right to object
• The right not to be included in automated marketing initiatives or profiling

As a hotelier, you will need to be prepared for when a guest makes a request. You must reply within one month, free of charge. If you refuse a request, you must inform the guests about your reasons, provide any details about the Privacy Commission, and the name and contact details of your DPO (Data Protection Officer, more on this in point 8) so that the guest understands how to file a complaint.

3. Communicate

Under GDPR you must clearly state what data you are capturing (the nature of the data), explain to the customer why you are capturing that data (the purpose of the data) and explain who is requesting that data (the identity of the Data Controller) and who else will have access to this data. You must also state how long you will keep that data. The reasoning is that; this will be enough to allow the customer to make an informed decision to opt-in. You can easily do this on the registration card, or when checking-in online. You must remember to adapt all legal statements and customer agreements to the new legislation. Please note that you can only use the data for the agreed reason that the customer gave and not for multiple marketing campaigns.

4. Collect only what you need

Review what information you’re asking a guest for and decide what’s really necessary. For example, a guest departure date is an essential piece of information, but asking for their date of birth may not be.

5. Always ask for consent

Due to the GDPR ‘explicit consent’ rule, it’s essential that you review how you are obtaining and recording guest consent. Guests arrive at a hotel via multiple sources, including travel agents, telephone reservations or even walk-ins. You must consider all and give clear ‘opt-ins’. Pre-ticked boxes aren’t going to work this time.
There is also an additional consideration for children under 16 years of age. Y ou must seek the authorisation of parents or responsible adults to process a minor’s data.
You must also consider what to do if a guest withdraws consent and be clear on GDPR guidelines.

6. Maintain a Data Register

Document the information you are holding, where you’re storing it, where it’s from and who you will be sharing it with. You’ll also have to note that the guest has consented in this data collection. The Data Register is essential to map all your data streams. You may need to review your current policies and procedures to accommodate this.

7. Data Security

Hoteliers are vulnerable to data breaches and theft because, as an industry, they collect so much information from multiple sources. Be ready to detect and remedy any theft of personal data. The data register should be able to provide insight into which pieces of data are concerned. Any incident should be reported within 72hrs to the Privacy Commission, for all cases where there is a risk that guest data may have been compromised. You must also ensure your network and storage systems are up-to-date with the latest intrusion detection programs and should have successfully passed penetration testing.

8. Data Protection

Consider Data Protection principles for any new tool or procedure undertaken, right from the design stage. An Impact Assessment is required when major new technology is introduced, or significant upgrades are taking place on systems which contain personal data.

Nominate a Data Protection Officer (DPO) who is knowledgeable on the importance of personal data processing.
Although this could be an additional task for an existing employee, it is mandatory to have a DPO when you handle large volumes of personal data.
He must be aware of the hotel data flow and have a copy of the Data Register at all times. The DPO must be named on all privacy statements on any media. When filing a complaint, the guest will reference the DPO by name.

9. Know your third parties

It’s likely that you’ll be dealing with third parties or subcontractors on your data collection journey. Make sure you are aware of who they are and what your current contractual obligations are.
Some of them might be:

• Your website design agency
• Your Website Booking Engine
• Your Property Management Software
• Your Channel Manager

Review these contracts to include any GDPR related aspects, ensure that the contractor is aware of his obligations under GDPR, and that services or systems help you meet your GDPR requirements.

10. Considerations for International / Group Hotels

For International and Group Hotels, it’s important to align procedures across the group and nominate a lead (presumably the country or regional office) for the coordinated GDPR efforts. If you are present in multiple EU countries, it is required to identify a "main establishment", and also the country lead supervisory authority.

Conclusion

Preparation, knowledge and good online security systems are key under GDPR. You will need to create a hotel strategy which ensures that all GDPR compliances are met.

If you still feel swamped, get in touch with us and we will help you to devise a plan which works for your organisation. You simply can’t be left behind on this one!