In brief
- Regulations concerned: GDPR, AI Act.
- Tourism collects booking and stay data, often shared with partners (accommodation providers, carriers, platforms) located outside the Union.
- GDPR up to €20 M or 4%.
- Tourism is primarily a GDPR matter, with two specificities: international transfers (non-EU partners) and, for certain activities, data relating to minors.
Regulatory deadlines
The key dates of the regulations applicable to your sector.
May 2018
RGPDEntry into application
In forceAugust 2024
AI ActEntry into force
In forceFebruary 2025
AI ActBan on prohibited practices
In forceAugust 2025
AI ActGeneral-purpose AI models (GPAI) & governance
In forceAugust 2026
AI ActHigh-risk system obligations (Annex III)
In forceAugust 2027
AI ActHigh-risk embedded in products (Annex I)
UpcomingWhy the 'Tourism & Leisure' sector is concerned
The tourism sector collects booking and stay data, often shared with partners (accommodation providers, carriers, platforms) located outside the EU. International transfers are therefore a central issue and must be governed by appropriate safeguards.
Certain activities (children's clubs, stays, holiday camps) involve the processing of minors' data, which raises the GDPR standard: age-appropriate information, consent where applicable, data minimisation.
On the AI side, stay recommendations and customer support chatbots generally fall under limited risk, with a transparency obligation. Marketing and customer review management remain governed by the GDPR.
GDPR — bookings and international transfers
Tourism operators act as data controllers for bookings, stay-related data, and marketing activities. International partnerships involve cross-border transfers outside the EU that must be properly governed. Activities involving minors require heightened vigilance.
Key obligations
- Legal bases by purpose (booking, marketing).
- Governance of international transfers.
- Vigilance regarding minors' data.
- Security and retention periods.
AI Act — recommendation systems and chatbots
Stay recommendations and customer service chatbots generally fall under limited risk (transparency). The underlying profiling remains governed by GDPR, and manipulative practices are prohibited.
Key obligations
- Qualify uses (recommendation = limited risk).
- Disclosing interaction with a chatbot.
- Prohibiting manipulative practices.
- Articulation with GDPR profiling.
Comparative overview of regulations
| Regulation | Role | Flagship obligation | Max. Penalty |
|---|---|---|---|
| GDPR | Accountable | Bookings + transfers + minors | 20 M€ / 4 % |
| AI Act | Deployer | Transparency (limited risk) | €35 M / 7 %* |
How these regulations interact
Tourism is primarily governed by the GDPR, with two specificities: international transfers (partners outside the EU) and, for certain activities, children's data. Recommendation AI connects to this through profiling (GDPR) and transparency (AI Act).
Managing customer reviews and e-reputation adds GDPR considerations (review data, responses) that must be handled fairly.
Application timeline
- 1GDPR. In force; vigilance on transfers and minors.
- 2AI Act. Progressive transparency; prohibitions in force since February 2025.
Applicable penalties
GDPR fines of up to €20M or 4%. Unframed international transfers and the processing of minors' data are key watch points; the AI Act focuses primarily, in this context, on transparency and non-manipulation.
Compliance roadmap
- 1Frame reservations. Legal bases and retention periods by purpose.
- 2Frame transfers. Appropriate safeguards for non-EU partners.
- 3Protecting minors. Tailored information and data minimisation for clubs and stays.
- 4Governing marketing and reviews. Compliant prospecting and review management.
- 5Steer. Register, security and periodic review.
How Data Comply One supports the sector
Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports tour operators, travel agencies and theme parks on international transfers, minors' data and chatbots.
DCO offers tailored templates (transfer frameworks, minor data subject information, booking notices).
Frequently asked questions
By framing transfers outside the EU with appropriate safeguards.
Detailed guides by regulation
Where does your compliance stand?
Take stock in a few minutes or talk to an expert dedicated to your sector.
They already trust us
See how organisations in the tourism & leisure sector secured their compliance with DCO.