Skip to content

Free tool

GDPR readiness checker for independent hotels

Twelve operational questions covering the GDPR posture EU hotels actually need. Inputs stay client-side; nothing is sent or stored.

Interactive checker

GDPR readiness for independent hotels

Twelve operational questions covering the GDPR posture independent EU hotels actually need. Inputs stay client-side; no data is sent anywhere. Not legal advice; treat as a structured self-assessment.

  1. Do you maintain a current data inventory listing every personal data category, the system it lives in, and the lawful basis for processing?

  2. Are guest data retention periods defined and automatically enforced (deletion or anonymisation after N years)?

  3. Do all third-party vendors processing guest data have a signed Data Processing Agreement (DPA) in force?

  4. For non-EU vendors (US, UK, others), are Standard Contractual Clauses (SCCs) in place per the 2021 EU framework?

  5. Have you documented a data breach response procedure with a 72-hour supervisory authority notification path?

  6. Can guests exercise their data subject rights (access, deletion, portability) through a documented process within the 30-day GDPR window?

  7. Is consent for marketing communications captured separately from the booking transaction (opt-in, not bundled)?

  8. Are website cookies categorised and gated behind a compliant consent banner (per ePrivacy and 2023 EU enforcement)?

  9. Is the privacy policy specific to your property (not a generic template) and dated within the last 12 months?

  10. Are CCTV and recorded calls disclosed with legal-basis documentation and signage where required?

  11. Have key staff received GDPR training in the past 12 months covering breach response and subject-rights requests?

  12. Does your property meet the DPO appointment threshold (large-scale special-category processing or systematic monitoring), and is one appointed if so?

Readiness score

0 / 90

Answer the questions above to see your band.

Score bands

  • 75-90: mature GDPR posture, periodic review only
  • 55-74: baseline coverage with gaps; prioritise the unanswered items
  • 30-54: meaningful exposure; expert review recommended
  • 0-29: material risk; treat as a remediation priority

This tool is a structured self-assessment, not legal advice. EU GDPR fines reach up to 4% of annual global turnover or EUR 20 million whichever is higher per the official European Commission framework.

What this is and is not

This is a structured self-assessment based on the operational questions independent EU hotels typically need to answer. It is not legal advice. For specific legal positions on data transfers, breach notification timing, or DPO appointment, an EU privacy counsel or designated DPO is the right next step.

Fines under the EU framework reach 4% of annual global turnover or EUR 20 million whichever is higher (see European Commission). Hospitality is one of the more breach-prone B2C sectors per the Verizon Data Breach Investigations Report; the posture matters operationally as well as legally.

Related references