Hospitality & catering · GDPR

Hospitality & catering — GDPR: guests, Wi-Fi and police record

The establishment processes a customer file, manages Wi-Fi, video surveillance and, for hotels, the individual police registration form. GDPR requires controlled legal bases, information notices, security and retention periods. This guide details these processing activities and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Hotels, restaurants, and cafés are data controllers, with no threshold.
  • Frame the customer file.
  • Govern Wi-Fi.
  • Proportioning video surveillance.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

GDPR applies to customer files, loyalty schemes, Wi-Fi, video surveillance, and police registration forms. Wi-Fi requires an information notice and controlled retention of logs. The police registration form responds to a legal obligation, with defined purpose, access rights, and retention period.

Payment data security is a cross-cutting imperative.

Is the 'Hospitality & Catering' sector affected?

Hotels, restaurants and cafés are data controllers, with no threshold. Service providers (reservations, Wi-Fi, payment, loyalty) are processors.

Hotels accommodating foreign guests are subject to the individual police registration form.

Detailed obligations

Frame the customer file

Legal bases, information and retention periods for bookings and loyalty.

Governing Wi-Fi

Inform users and retain logs within the required limit.

Scaling video surveillance proportionately

Information, proportionality, limited areas and short durations.

Governing the registration form

Restrict access and limit retention periods.

Secure the payment

Use compliant service providers and secure data.

Sanctions & risks

Fines of up to €20 M or 4% of global turnover. Disproportionate video surveillance and failure to provide information on Wi-Fi are recurring grounds.

Common mistakes in the sector

  • 1Wifi not disclosed. Provide access without information or log oversight.
  • 2Excessive video surveillance. Continuously filming employees.
  • 3Poorly managed policy record. Leave broad access and unlimited retention in place.
  • 4Poorly secured payment. Processing payments without a compliant provider.

Practical case

A hotel was retaining police registration forms and Wi-Fi logs indefinitely and filming its premises extensively. Remediation restricts access to police registration forms, defines retention periods, provides information on Wi-Fi use, and proportions video surveillance accordingly.

Compliance roadmap

  1. 1

    Map. Inventorying customers, Wi-Fi, video surveillance, and police records.

  2. 2

    Frame. Legal bases and retention periods.

  3. 3

    WiFi. Inform and govern logs.

  4. 4

    Video surveillance. Proportionate and inform.

  5. 5

    Secure. Payment and access to the police record.

Frequently asked questions

A limited retention period aligned with the purpose, with restricted access.

Back to the Hospitality & catering guideHospitality & catering & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to hospitality & catering.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the hospitality & catering sector secured their compliance with DCO.

See testimonials