Is it mandatory to present an ID or passport at a hotel?

Many times, guests are reluctant to present their ID at a hotel, and this is completely normal because we’re handing over our personal data for third-party use.

Currently, with the application of Royal Decree 933/2021, individuals or legal entities providing accommodation services are required to documentally register the people staying at the property.

With this in mind, tourist establishments are obligated to provide the guest’s ID number when submitting the traveler report to the Ministry of the Interior, as indicated in Annex I of the mentioned Royal Decree.

When doing Check-in at a hotel or tourist accommodation, it’s normal for the receptionist to ask for your ID to make a photocopy or scan of it, but… is it legal for the hotel to require our ID or passport to photocopy it?

Is it legal to request or photocopy guests’ ID at a hotel?

Making a scan or photocopy of the ID using a scanner or physical printer can lead to GDPR non-compliance, since in this case, a complete image of the guest’s identity document is being stored.

Tourist accommodations must extract data from the identity document or passport without retaining a copy of the document afterward, whether physical or digital.

On the other hand, it is legal to use scanning tools that, as mentioned, only extract the necessary data to complete the traveler report and do not store any copy of the document image.

At Check-in Scan, we scan the traveler’s identity document without archiving any digital copy of it.

To automatically fill out the traveler report, it is essential to scan the MRZ code of the document, extracting from it the set of data needed to complete the traveler report without making a digital copy and being able to communicate the data to the corresponding authority in compliance with the law.

Request more information and try 14 days FREE

Automate the online check-in process and make guest registration quick and easy.

Register now for free

Identity document data should not be read aloud either

In this context, the guest could be recorded to later impersonate their identity when setting up a service or bank account, providing their identity document through their own voice.

Why shouldn’t you photocopy IDs as a tourist accommodation or hotel manager?

If a hotel decides to scan an identity document or passport and store the copies digitally or physically, it could face fines for GDPR non-compliance.

There have been cases where the Spanish Data Protection Agency has imposed fines and penalties on tourist housing and vacation rentals for GDPR violations.

Best practices for legal Check-in at any tourist accommodation

1. Identify the guest with a valid document
   The guest must present an official identity document: ID, passport, or equivalent if foreign.This step is mandatory by law (Royal Decree 933/2021), as guest data must be communicated to the Ministry of the Interior.
2. Do not keep photocopies or scans of the document
   No physical or digital image from a photocopy or scan of the document should be retained. This violates GDPR and can result in significant fines.Bad practices:
   
   • Photocopying the ID and keeping it.
   • Scanning the document with an app or device that saves the full image.
3. Use legal scanning tools
   Tools that extract only the necessary data (name, document number, nationality, date of birth, etc.) without saving any document image are permitted.Good practices:
   
   • Tools like Check-in Scan, which extract data from the MRZ code without storing a document copy.
4. Communicate data to the Ministry of the Interior
   The traveler report must be sent electronically using the official Ministry of the Interior platform, SES HOSPEDAJES, Ertzaintza lodging, or Mossos d’Esquadra depending on the municipality where the accommodation is located.Ensure the check-in tool you use is certified and complies with required security and privacy protocols.
5. Avoid reading or mentioning data aloud
   Personal data (full name, document number, etc.) should not be discussed aloud, as it could be recorded and misused.
6. Inform guests about data processing
   You must have a privacy notice available informing guests about:
   • What data is collected.
   • For what purpose.
   • What security measures are applied.
   • Which authority the data is communicated to.
   • Guest rights regarding their data (access, rectification, deletion, etc.).