GDPR Compliance Checklist for Boutique Hotels (2026)

A 34-room hotel in Munich received a guest Subject Access Request on a Tuesday morning. The email included the phrase “under Article 15.” The GM had no idea which of their nine systems held guest data, no documented retention policy, and no signed DPA with their channel manager. They had 30 days to respond. It cost roughly €3,400 in legal fees and weeks of panic to answer a request that a 90-minute compliance audit would have made routine.

GDPR compliance for small hotels isn’t about building a legal department. It’s about understanding five concrete obligations, mapping where your data actually lives, and having documented responses ready before a guest asks. This guide covers exactly that, for a 20-80 room property, without the €5,000 consultant invoice.

Disclaimer: This article provides operational guidance only. It is not legal advice. Every property’s situation differs, and you should consult a qualified data protection attorney or certified DPO for advice specific to your circumstances.

The regulation sounds intimidating. In practice, it comes down to five obligations for a small hotel:

1. Lawful basis for every processing activity. You need a documented legal reason for each category of guest data you collect. Most operational data (name, booking details, payment info) is covered by contract performance under Article 6(1)(b). Marketing emails require explicit consent under Article 6(1)(a). The obligation is to know which basis you’re relying on for each purpose, not to invent new ones.

2. Data inventory and mapping. You must be able to say: what data you hold, where it lives, who has access, how long you keep it, and who you share it with. This is your Record of Processing Activities (RoPA), required under Article 30. It doesn’t have to be elaborate, a spreadsheet works.

3. Data Processing Agreements (DPAs) with every processor. Under Article 28 of the GDPR, any third party processing personal data on your behalf needs a signed DPA. That covers your PMS vendor, channel manager, email platform, Wi-Fi provider, booking engine, and payment processor. Most large vendors have their DPA ready; the problem is most hotels never sign them.

4. Breach notification within 72 hours. If personal data is compromised and the breach is “likely to result in a risk to the rights and freedoms of natural persons,” you must notify your national supervisory authority within 72 hours under Article 33 of the GDPR. Missing this deadline is itself a violation, even if the underlying breach was minor.

5. Respond to data subject requests within 30 days. Guests can request access to their data (Article 15), ask for correction (Article 16), demand erasure (Article 17), or request portability (Article 20). You have one calendar month to respond from the date of receipt.

These five obligations cover 90% of what GDPR enforcement in the hotel sector actually targets. According to the GDPR Enforcement Tracker, data protection authorities from 15 countries have imposed 83 fines in the accommodation and hospitality sector totaling approximately EUR 22.6 million, with improper data collection and video surveillance being the most common violations.

Your Guest Data Inventory: Where It Actually Lives

Most boutique hotels process guest data in more systems than their GM realizes. A typical 40-room property has data in at least eight places:

System	Data stored	DPA required?
Property Management System (PMS)	Names, dates, room preferences, payment tokens, notes	Yes
Channel manager	Reservation data from OTAs (Booking.com, Expedia)	Yes
Booking engine	Direct booking data, credit card details	Yes
Email marketing tool	Email addresses, consent records, open rates	Yes
Payment processor	Card data (tokenized), transaction history	Yes
Wi-Fi captive portal	Email address, device ID, session logs	Yes
CCTV / security cameras	Video footage of guests in common areas	Yes
Review platform (TripAdvisor, etc.)	Public reviews, management responses	Shared controller

For most boutique hotels, the PMS is the master repository, which is why the security and compliance of your PMS choice matters enormously. For a full view of how your PMS connects to the rest of your stack, see the boutique hotel technology guide.

CCTV deserves separate attention. According to the GDPR Enforcement Tracker report on accommodation and hospitality, video surveillance accounts for roughly two-thirds of all fines in the hotel sector. Common violations: cameras covering staff areas without notice, footage retained longer than necessary, no posted signage informing guests of recording.

How Do You Handle a Guest’s “Right to Be Forgotten” Request in Practice?

The short answer: you have one month, and you need to erase from every system while retaining what the law requires you to keep.

The practical steps, in order:

Step 1: Verify identity. Before doing anything, confirm the request comes from the actual guest, not a third party. Ask for confirmation of the reservation reference or the email address on file. You don’t need to ask for a copy of their ID for a basic erasure request.

Step 2: Scope the request. Does the guest want everything deleted, or only marketing data? Most erasure requests are triggered by continued marketing emails after a stay. Clarify before acting.

Step 3: Check for retention obligations. Some data cannot be deleted even if the guest asks. Tax records must be retained for the legally required period (typically 6-10 years in EU jurisdictions). Police registration records (required in Poland, Spain, Germany, and several other EU countries) have their own statutory retention periods. Payment dispute records may need to be held for a defined period. Erasure applies only where no other legal obligation overrides it.

Step 4: Erase from all systems. This is the hard part. Go through every system in your data inventory: PMS, email tool, Wi-Fi logs, review platform correspondence. “Erasure” can mean actual deletion or anonymization (replacing identifying fields with a pseudonym).

Step 5: Document the response. Under Article 17 of the GDPR, you must respond within one month and confirm what you deleted and what you retained (and why). Keep this record for at least three years.

The realistic timeline for a 40-room hotel that has mapped its data properly: about three hours of work. For a property that hasn’t done its homework: three days of frantic system access.

The 72-Hour Breach Notification Rule: What Counts as a Breach

This is where small hotels most often get the logic wrong.

The naive approach is to decide internally that a small incident “probably doesn’t matter” and skip notification. This fails under Article 33 of the GDPR, which sets the notification threshold at “likely to result in a risk to the rights and freedoms of natural persons”, a much lower bar than “we think it’s serious.”

The working pattern is a documented breach-triage playbook with a 24-hour internal decision deadline, not a 72-hour one. You need the first 24 hours to assess severity, then the remaining 48 hours to draft and submit the notification if required.

Practical scenarios where the 72-hour clock starts:

Scenario 1: A laptop with guest emails is stolen from the front office. Even if the laptop was password-protected, an unencrypted guest email list on a lost device meets the threshold. Notification required.

Scenario 2: A staff member clicks a phishing link, and the attacker accesses the email account for 20 minutes. If the email account contained guest booking confirmations (which contain names, arrival dates, and reservation numbers), this is a personal data breach. Notification required.

Scenario 3: A payment terminal is discovered to have a skimming device attached. If cardholder data was potentially captured, this triggers both GDPR notification (to the supervisory authority) and PCI DSS incident procedures (notify your acquiring bank).

Scenario 4: An internal staff member emails a guest list to their personal account. Intentional or accidental, this is a breach of confidentiality and must be triaged.

What you need ready before anything goes wrong: a written breach-response playbook that names who makes the notification decision, which supervisory authority to contact (each EU country has its own), and what information to include in the notification. The cybersecurity guide covers the technical aspects of breach response in detail, see the hotel cybersecurity and data protection guide for the step-by-step incident response sequence.

Retention Policies: How Long You Must (and Must Not) Keep Guest Data

GDPR doesn’t set fixed retention periods. It requires that you set them yourself, document them, and actually enforce them. The constraint is that you can’t keep data longer than necessary for the purpose it was collected.

In practice, hotels operate under multiple overlapping retention obligations:

Tax and accounting records: In most EU countries, financial records including guest invoices must be kept for 6-10 years. Germany requires 10 years under the Handelsgesetzbuch (HGB). Poland requires 5 years under tax law. Spain requires 6 years. These records can be retained even if a guest requests erasure, the legal obligation overrides.

Police registration (Meldepflicht): Germany, Poland, Spain, and several other EU countries require hotels to register guests with local authorities or maintain a guest registration book. Retention periods vary by country: Germany typically 12 months for the registration form, Poland longer in some regions. These are legal obligations, not your choice.

Marketing consent records: If you collected consent for a newsletter, keep the consent record (timestamp, IP, what was agreed to) for the duration of the marketing relationship plus a reasonable period after (typically 3 years). The actual marketing emails don’t need to be retained.

CCTV footage: Most DPAs recommend 72 hours to 30 days maximum for general surveillance footage in hotel common areas, unless footage is needed for an active investigation.

A practical retention schedule for a 40-room property:

Data type	Retention period	Legal basis	Deletion method
Guest invoices/folios	7 years	Tax obligation	Scheduled archive
Guest profiles (post-stay)	2 years (then anonymize)	Legitimate interest	PMS auto-delete or manual
Marketing email list	Active + 3 years post-opt-out	Consent	ESP deletion tool
CCTV footage	14 days	Legitimate interest	Auto-overwrite
Police registration	Per local law	Legal obligation	As specified
Breach records	3 years minimum	Documentation obligation	Secure delete

DPAs With Your Tech Vendors: The 30-Minute Task You’ve Been Avoiding

A Data Processing Agreement is a legally binding contract that specifies how a vendor processes personal data on your behalf, what security measures they maintain, and what happens to data when the relationship ends. GDPR Article 28 requires you to have one with every vendor who handles guest data.

Most boutique hotels have zero signed DPAs. The vendors almost certainly have them, the hotel just never signed.

Where to find them and what to expect:

PMS vendors. Cloudbeds includes a DPA in their standard terms, accessible from the account settings. Mews provides a DPA on request through their legal/compliance team. Little Hotelier includes data processing terms in their service agreement. RoomRaccoon has a DPA available from their trust center.

Guest communication platforms. If you’re using Duve, Akia, Canary Technologies, Guestivo, or similar tools, check their website for a DPA link or request one from their support team. These platforms handle pre-arrival guest data and digital check-in information, so a DPA is non-negotiable.

Email marketing. Mailchimp, Brevo (formerly Sendinblue), and Klaviyo all provide self-service DPAs in their account settings.

Cookie consent tools. Termly and OneTrust provide DPA templates as part of their compliance platform subscriptions. Termly starts at around $10/month; OneTrust has enterprise pricing.

The process: locate the vendor’s DPA or Data Processing Addendum, review the key clauses (data deletion on termination, sub-processor disclosure, breach notification to you), and execute. For most SaaS vendors this is a click-to-sign digital process. Budget 30 minutes to sweep all your vendors in one session.

Note that during a PMS migration, your DPA obligations transfer to the new vendor. The hotel PMS migration guide covers the practical steps of data handover, including what happens to guest data that existed in the old system.

Post-TCF 2.2, “implied consent” through continued browsing is not valid under GDPR. A compliant cookie banner must:

Appear before any non-essential cookies are set
Offer equally prominent Accept and Reject options (the “reject” button cannot be hidden, smaller, or gray)
Provide granular opt-in by purpose (analytics vs. advertising vs. personalization)
Allow users to withdraw consent as easily as they granted it (usually a persistent link in the footer)
Not use pre-ticked boxes

What this means for a typical hotel website: Google Analytics runs on legitimate interest in some interpretations, but if you’re using Google Ads remarketing pixels, Meta Pixel, or similar advertising trackers, these require explicit consent. A Croatian hotel was fined €45,000 by the Croatian DPA specifically for unlawful processing via cookies without valid consent.

Practical tools: CookieYes (from ~$10/month) and Cookiebot (from ~$10/month) auto-scan your site for cookies, generate a compliant banner, and produce a cookie policy. Both integrate with WordPress and most website builders. Termly covers both cookie consent and DPA management if you want a single platform.

If you’re starting from scratch, this sequence gets the critical work done without overwhelming your team:

Day	Task	Estimated time
Day 1	Data inventory, list every system, what data it holds, who has access	2-3 hours
Day 2	DPA sweep, locate, review, and sign DPAs with all data processors	2-4 hours
Day 3	Write retention policy, set periods for each data category, document in a policy template	1-2 hours
Day 4	Breach playbook, one-page document naming the decision-maker, the DPA contact, notification template	1 hour
Day 5	DSR workflow + cookie banner, create a template response for access/erasure requests; install a compliant cookie consent tool	2-3 hours

Total: roughly 8-13 hours of work for one person. The ongoing burden is low: reviewing consent records quarterly, checking that deletion routines are running, and updating the DPA list when you add new vendors.

Frequently Asked Questions

How long do I have to respond to a Subject Access Request? One calendar month from the date you receive the request, under Article 12 of the GDPR. You can extend by two additional months if the request is complex, but you must inform the guest of the extension within the first month and explain why. The clock starts when you receive the request, not when you decide to act on it.

Does GDPR apply to our hotel if we’re located outside the EU? Yes, if you process personal data of EU residents. GDPR has extraterritorial scope under Article 3. If your hotel markets to EU travelers, appears on EU-accessible OTAs (Booking.com, Expedia), or accepts bookings from EU residents, GDPR applies. Non-compliance penalties can reach 4% of annual global turnover or €20 million, whichever is higher.

What fines do small hotels actually face? According to CMS Law’s GDPR Enforcement Tracker report on accommodation and hospitality, most fines in the hotel sector are in the €5,000-50,000 range for small properties. In 2024, a German hotel was fined €16,000 for storing guest ID copies without legal basis; a Croatian hotel was fined €45,000 for improper cookie consent. Large hotel groups (Marriott, British Airways) have faced much larger fines, but the enforcement pattern for small properties reflects proportionality. Most small hotels will never be fined, the practical reason to comply is that when a guest escalates, you want the answer in 48 hours, not a panic spiral.

Are we joint controllers with OTAs like Booking.com? It’s complicated. The European Data Protection Board has issued guidance indicating that hotels and OTAs can be joint controllers in certain processing activities (particularly when data is shared for the purpose of managing a reservation). In practice, Booking.com has its own DPA/data processing terms for hotels. Review them carefully: you share responsibility for data collected through the OTA platform, but Booking.com typically handles its own processing obligations separately.

Does GDPR cover employee data too? Yes. Employee personal data is subject to GDPR just like guest data. Employment contracts, payroll records, performance reviews, sick leave records, CCTV footage of staff areas, staff email accounts, all are personal data subject to the same principles. In practice, employment law in each EU country adds additional requirements (works council involvement in some countries, specific retention periods for personnel files). If you have EU-based staff, include employee data in your RoPA.

What if a guest makes an erasure request for data I’m legally required to keep? You can refuse the erasure for that specific data category, citing the legal obligation. You must inform the guest in writing of the specific legal basis for retention and which authority mandates it. Erase everything you’re not legally required to keep, and retain only what you must.

What GDPR Actually Requires from a 30-Room Hotel