Hospitality & catering compliance: GDPR & AI Act

Why the 'Hospitality & catering' sector is concerned

The establishment processes a customer file (reservations, stays, preferences, loyalty) and handles payment data. Loyalty programmes and prospecting require appropriate legal bases and information notices, while payment data demands robust security measures.

The physical dimension adds specific processing activities: Wi-Fi made available to customers requires an information notice and controlled retention of connection logs; video surveillance protects the premises but must remain proportionate and must not subject employees to permanent monitoring.

For hotels, the individual police registration form completed by foreign guests constitutes a regulated personal data processing activity (purpose, access, retention). On the AI side, booking chatbots and recommendation engines generally fall under limited risk (transparency).

GDPR — customers, Wi-Fi, video surveillance, police registration form

The establishment acts as data controller for the customer file, loyalty programme, Wi-Fi, video surveillance and, for hotels, the individual police registration form. It must define legal bases, provide information, secure payments, govern video surveillance, and manage retention periods, including Wi-Fi logs.

Key obligations

• Legal bases and information (customer files, loyalty).
• Wi-Fi: information and regulated retention of logs.
• Proportionate and declared video surveillance.
• Individual police record: purpose, access and retention period regulated.

AI Act — chatbots and recommendation

Booking chatbots and offer recommendation features generally fall under limited risk (transparency regarding interaction with an AI). The underlying profiling remains governed by GDPR; manipulative practices are prohibited.

Key obligations

• Qualify use cases (chatbots = limited risk).
• Disclosing interaction with an AI.
• Prohibiting manipulative practices.
• Articulation with GDPR profiling.

Comparative overview of regulations

How these regulations interact

The hospitality and food service sector is primarily driven by GDPR, with processing activities specific to the physical establishment: Wi-Fi, video surveillance, police registration forms. These activities share a common baseline of security and data retention periods that must be properly managed.

AI (chatbots, recommendations) remains, in this context, primarily a GDPR matter (profiling) combined with AI Act transparency obligations. The security of payment data is, in all cases, an absolute requirement.

Application timeline

• 1GDPR. In force; vigilance on Wi-Fi, video surveillance, and payment.
• 2AI Act. Progressive transparency; prohibitions in force since February 2025.

Applicable penalties

GDPR up to €20M or 4%. Disproportionate video surveillance, the absence of information on Wi-Fi use, and poor management of police registration forms are key areas of vigilance; the AI Act is limited here to transparency and non-manipulation.

Compliance roadmap

• 1Frame the customer file. Legal bases, information, fairness and retention periods.
• 2Governing Wi-Fi. Inform individuals and retain logs within the required limits.
• 3Scaling video surveillance proportionately. Information, proportionality, and retention periods.
• 4Governing the registration form. Purpose, restricted access and limited retention.
• 5Secure the payment. Compliant service providers and data security.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with outsourced DPO services, and supports hotels, restaurants, and cafés on customer files, Wi-Fi, video surveillance, and police registration forms.

DCO offers tailored templates (customer and Wi-Fi notices, DPIA for video surveillance, police registration form framework).

Frequently asked questions