Skip to content
vesia.io
Book a demo

Vesia

Must a hotel in Spain keep a copy of the guest's ID?

For Spain's guest registration it is enough to keep the fields of the form set by Royal Decree 933/2021. The photo of the document is read to extract those fields and then discarded: what the hotel keeps is the registration. That is what the data minimisation principle of the GDPR asks for, supervised in Spain by the Spanish Data Protection Agency (AEPD).

We are asked this in almost every conversation, usually by someone who has already had a long answer. The short one: we keep only the registration fields; the photo of the document is read to extract them and is discarded.

What we do exactly

The guest photographs their document and the photo is read to extract the fields: the check digits of the machine-readable zone are verified, the registration fields are filled in and the image is discarded.

What remains are the fields of the guest registration. Those are kept, because they are the ones the law requires you to have, just as when they were written by hand at the front desk.

Why it goes beyond privacy

The image of an identity document is one of the most sensitive things that passes through a hotel. Keeping it makes you its custodian, and the day there is a problem, the problem belongs to whoever holds it.

The GDPR asks you to keep only what you need for what you are doing. Here the verified field is enough: it does all the work of the registration.

To prove the document was checked, the record shows that the check digits matched. That keeps the proof apart from the risk.

This is what we do and why, and we are a technical team: what your hotel must keep, and for how long, is a question for your legal adviser.

And if the hotel wants to keep it anyway

That is the hotel's decision and its responsibility. Our position is to keep only the fields, and it is a choice rather than a technical limit. A hotel that needs to archive images of documents needs another tool and a contract that says who answers for them.

What to ask whoever sells you online check-in

Five questions. The answers are worth more written into the contract than said on a call:

  • Do you keep the image of the document?
  • If you do, where is it hosted, and in which country?
  • How long is it kept, and what deletes it?
  • Who in your company can see it?
  • Will you put this in the contract?

If you are a guest and came here looking for this

From your document we keep only the registration fields. We process that data on behalf of the hotel, which is the controller: to access it or have it deleted, ask the hotel.

Frequently asked questions

Does a hotel in Spain need to keep a copy of the guest's ID? For the guest register, the fields of the form set by Royal Decree 933/2021 are enough.

How do you prove the document was checked? The record shows that the check digits on the document's machine-readable zone matched.

Who does a guest ask to access or erase their data? The hotel, which is the controller: Vesia processes that data on the hotel's behalf.

Sources