GDPR and Short-Term Rentals: Protecting Your Guests
6 min · StayParlo Journal
Why GDPR Applies to Individual Hosts Too
Many hosts assume GDPR only applies to large companies. This is a dangerous misconception. As soon as you collect, store, or process personal data from your guests — name, email address, phone number, copy of an ID document — you are considered a data controller under European regulation. This applies whether you rent out a studio apartment or manage a dozen properties.
In practice, if you send an online check-in form, use a spreadsheet to record your guests' contact details, or keep photos of passports in your inbox, you are processing personal data. The absence of a formal legal structure does not exempt you from these obligations. It is far better to understand the basic rules and apply them simply than to discover the subject following a complaint.
What Data Are You Actually Collecting — and Why Does It Matter?
Take stock: guest first and last name, email address, phone number, check-in and check-out dates, and sometimes a copy of an ID document to comply with police registration requirements. On top of that, you may occasionally collect more sensitive data such as nationality, dietary preferences, or information about minor children. Every piece of data collected must have a specific, documented purpose — this is what GDPR calls the principle of data minimization.
Platforms like Airbnb or Booking collect some of this data on your behalf, but that does not relieve you of responsibility for your own processing activities. Everything you manage outside the platform — a Google Form, an Excel file, WhatsApp conversations — falls under your direct responsibility. List your tools and ask yourself for each one: do I actually need this information, and how long am I going to keep it?
Your Practical Obligations as a Host
GDPR imposes several practical obligations. First, inform your guests: you must explain what data you collect, why you collect it, how long you retain it, and what their rights are (access, correction, deletion). This information can be included in a welcome message or in your guest guidebook. Second, collect only what you need: there is no point requesting an ID document if local law does not require it for your type of rental.
Third, secure the data: do not leave passport photos sitting in your photo gallery or in unprotected emails. Use password-protected folders or encrypted services. Fourth, respect retention periods: in general, data from a stay does not need to be kept beyond a few months after check-out, unless a specific legal obligation such as accounting requires it. Setting a regular deletion date is a simple and effective best practice.
Police Registration and ID Documents: A Special Case
In France, unclassified accommodation providers are subject to specific regulations regarding the guest register. If you host guests of foreign nationality, you may be required to complete an individual police registration form, which involves collecting identity data. This legal obligation constitutes a valid legal basis under GDPR — you are collecting this data because the law requires it, not for your own convenience.
However, this legal justification does not authorize you to use this data for other purposes, such as sending newsletters or building a prospect database. Police registration forms must be handed over to the authorities upon request and then destroyed. Do not keep them indefinitely as a precaution: set yourself a reasonable retention period — for example, three months after the guest's departure — and then securely delete the documents.
Simplifying Day-to-Day Compliance With the Right Tools
GDPR compliance does not have to be a headache. A few good habits are enough to cover the essentials: use online forms with a clear information notice, avoid storing sensitive data in unsecured tools, and establish a routine for deleting outdated data. A digital guest guidebook like StayParlo can automate the delivery of stay information while integrating the necessary legal notices, reducing your administrative burden.
Also take the time to review the terms and conditions of your third-party tools: your property management software, smart lock system, or messaging platform may be processing your guests' personal data. Make sure these service providers are themselves GDPR-compliant — they are considered sub-processors, and you must be able to demonstrate that you have chosen reliable partners. If in doubt, visit the CNIL website, which offers guides written in accessible language for non-legal professionals.
Frequently asked questions
Do I really risk a fine for not complying with GDPR as a private individual?
Yes, GDPR applies to individuals who process data in an organized and regular manner. Penalties can range from a simple warning to significant fines. In practice, the CNIL typically steps in following a complaint from a guest. It is far better to adopt good practices now than to take that risk.
Can I keep copies of my guests' passports indefinitely as a precaution?
No. The principle of storage limitation requires that data be kept only for as long as necessary for the purpose for which it was collected. For a standard stay, a few months after check-out is sufficient. Beyond that, delete the documents securely. Retaining identity documents without a time limit is a violation of GDPR.
Do I need to write a privacy policy if I rent through Airbnb?
Airbnb has its own privacy policy, but it only covers data processed through its platform. For everything you manage yourself outside of it — forms, emails, files — you are responsible for informing your guests. A simple notice in your welcome message or guest guidebook is usually enough to fulfill this information obligation.
Create your welcome guide in 20 minutes
Multilingual, AI concierge, protected codes. 14-day free trial.
Start for free