A practical GDPR checklist for small hotels
You hold passports, card details and dietary requirements. Here is the short version of what that obliges.
Hotels process an unusual amount of sensitive data for their size: identity documents, payment details, health-related dietary notes and, in many countries, a legal obligation to report guest identities to the police. That combination makes a light-touch approach risky.
Know why you hold each thing
Every field you collect needs a lawful basis and a retention period. Identity documents are usually held under a legal obligation, for the period the local law specifies, and then deleted. Marketing consent is separate from the booking and must be genuinely optional.
Delete on a schedule, not on request only
Automatic retention rules are far safer than a manual clear-out. Document scans should expire automatically once the legal period has passed. Old invoices are kept for the tax period and no longer.
Write down who can see what
A receptionist does not need access to historic invoices from three years ago, and a housekeeper does not need guest surnames at all. Role-based permissions and an audit trail are the two controls that most often turn a breach into a non-event.