Can I ask guests for a copy of their ID or passport? What data to keep, for how long and how to comply with data protection

Short answer: do not ask for a copy or photo of the ID card or passport. The Spanish Data Protection Agency (AEPD) said it clearly in June 2025: requesting it «breaches the principle of data minimisation» because the document contains more data than the law requires you to collect (the photo, the expiry date, the parents' names…). And it is not theory: in 2025 it issued a formal warning to a tourist home in Almería for requesting ID images on WhatsApp and ordered it to delete them and stop asking. What you do have to do is check the document, record the data the Interior Ministry requires, send it to SES.Hospedajes within 24 hours, inform the guest of what you do with their data and keep it securely for the required time.

What data do I have to ask for?

Those in annex I of Royal Decree 933/2021, and nothing more. For each traveller:

• Name and surnames, sex and date of birth.
• Type of document (Spanish ID, passport, residence card), number and document support number.
• Nationality and usual place of residence (full address, town, country).
• Phone and email.
• Number of travellers and family relationship if any of them is a minor.

And for the booking: contract reference and date, check-in and check-out dates and times, address of the home, number of rooms, whether it has internet, and the payment details. Each person over 14 signs the report; the details of minors are given by the adult accompanying them (art. 4.2).

How do I check the data is genuine without asking for a copy?

The decree makes you responsible for the data matching the document, which the guest has to «show or provide» (art. 4.3). Showing is not handing over a copy. The AEPD itself suggests how:

• In person: the guest fills in the form (on paper or on their phone) and you look at the document and check it matches. That is enough.
• Remotely: an online form with only the annex I data, and verification by another route: a digital certificate, cross-checking with the payment details or a code sent to their phone or email.

The Interior Ministry accepts this expressly: the data can be collected «by any system that allows the accuracy of the data to be verified, even without their physical presence», as long as it respects data protection.

What you should not do: ask guests to send a photo of their ID on WhatsApp, keep those photos on your phone or in a folder, or photocopy the passport when handing over the keys. Besides being excessive, says the AEPD, a copy «does not allow the person's identity to be verified with certainty».

What about apps that read the document with the camera?

Many online registration systems read the document with the phone and fill in the data automatically. In 2024 the AEPD closed a complaint against a hotel with an ID reader because it was not proven that the system kept the full image. So the line is this: read the data and do not keep the image. If you hire a registration app, ask in writing whether it stores the photo of the document and for how long. If it does, you are in the same situation as with WhatsApp.

When must it be sent and how long is it kept?

• Report to the Interior Ministry via SES.Hospedajes: «immediately, and in any case within no more than 24 hours» of the booking (or its cancellation) and of check-in (art. 6.3). That is two reports. We explain it in Guest registration.
• Retention: whoever provides accommodation professionally keeps a computer register for three years after check-out (art. 5.3). The Interior Ministry considers professional anyone registered in the Tax Agency's business census. Whoever provides it non-professionally only has to report, not keep the register (art. 5.4). If you have a management company, it keeps the register.
• Separately, the «contract-like» document the guest signs on arrival is kept for one year for the Junta (art. 7.3 of Decree 28/2016). It is a different paper, not the guest register (Mandatory paperwork in the flat).

Once the period is over, it is deleted. Keeping data «just in case» is exactly what the European regulation forbids (art. 5.1.e: «for no longer than is necessary»).

What do I have to tell the guest?

When collecting the data you must inform them (art. 13 of the European regulation). It can be done in layers (art. 11 of the Spanish law): a short paragraph in the form and a link to the full information. The short paragraph must include at least who you are, what the data is for and how to exercise their rights. Something like:

Controller: [your name or the management company's]. Purpose: compliance with the legal obligation to register travellers (Royal Decree 933/2021); the data is sent to the Spanish Ministry of the Interior. Providing it is mandatory in order to stay. You can exercise your rights of access, rectification and erasure at [email]. More information: [link].

The full information adds the legal basis (legal obligation), the retention period (three years) and the right to complain to the AEPD.

Can I use their email to offer them another stay?

With conditions. The law allows you to write to a previous customer without asking first to offer similar services of your own to the ones they booked (art. 21.2 of Law 34/2002), provided you gave them the option to refuse when collecting the email and give them a simple, free way to unsubscribe in every message. Two caveats: the data you collect for the Police is for that purpose and should not be reused for advertising; and if the booking came through Booking or Airbnb, the email you see is usually a platform alias, which is not for marketing.

How do I store it to stay out of trouble?

The European regulation asks for security measures «appropriate to the risk» (art. 32). For a tourist flat, in practice:

• A password-protected app or online form, not a notebook in the drawer or a shared folder.
• No guest documents in the WhatsApp of your personal phone.
• Access only for those who need it (you, your manager).
• Deletion when the period ends.

Can I put a camera at the entrance?

Inside the home, never: the AEPD points out that cameras inside short-term rental apartments are not allowed. At the door or landing, only with the owners' association's agreement recorded in the minutes, recording only what is essential, with an information sign and deleting within one month at most (art. 22 of Organic Law 3/2018). In 2023 the AEPD fined an Andalusian tourist apartment company €1,000 for a camera that captured the landing without the association's agreement: emails to the neighbours were not enough. If what worries you is parties, there are alternatives without images (Parties and noise).

What happens if I don't comply?

Two separate fronts:

• Guest registration (Organic Law 4/2015 on public security): not keeping the register or not reporting is serious, with a fine of €601 to €30,000 (arts. 36.20 and 39); reporting late or with errors is minor, from €100 to €600 (art. 37.9). A first offence, unless there are aggravating factors, is fined in its lowest band.
• Data protection: asking for and keeping ID copies, not informing or not deleting. In the tourist home cases we know of, the AEPD has issued a warning (the WhatsApp ID case) or fined €1,000 (the landing camera). The authorities set the amount case by case.

Summary