[{"data":1,"prerenderedAt":337},["ShallowReactive",2],{"blog-article-en-fotocopia-dni-hospedaje":3},{"id":4,"title":5,"body":6,"category":316,"ctaDescription":317,"ctaLabel":318,"ctaTitle":319,"description":320,"extension":321,"image":322,"imageAlt":323,"meta":324,"navigation":325,"path":326,"publishedAt":327,"readingTime":328,"seo":329,"seoDescription":330,"seoTitle":331,"socialImage":332,"status":333,"stem":334,"updatedLabel":335,"__hash__":336},"blog_en\u002Fblog\u002Ffotocopia-dni-hospedaje.md","Can accommodation providers ask guests for a copy of their ID?",{"type":7,"value":8,"toc":294},"minimark",[9,18,21,27,32,61,65,76,82,86,94,120,127,131,136,139,143,146,160,163,167,212,216,220,223,227,230,234,237,241,244,248,251,255,262,266],[10,11,12,13,17],"p",{},"When a booking arrives, it is still common in Spain to ask for a photo of the guest’s ID by WhatsApp or email. It may seem like a quick way to prepare the statutory guest registration, but ",[14,15,16],"strong",{},"the Spanish Data Protection Agency (AEPD) has clarified that accommodation providers may not request or retain a full copy of an ID card or passport merely to meet this obligation",".",[10,19,20],{},"The important distinction is between collecting the details required by Royal Decree 933\u002F2021 and storing a complete image of the document. The former is mandatory; the latter is excessive for that purpose.",[22,23,24],"blockquote",{},[10,25,26],{},"This article summarises the official guidance available on 3 August 2026. It is not a substitute for legal or data protection advice about your particular circumstances.",[28,29,31],"h2",{"id":30},"the-short-answer","The short answer",[33,34,35,42,48,55,58],"ul",{},[36,37,38,41],"li",{},[14,39,40],{},"Do not request a full photocopy, photo or scan"," of an ID card or passport for guest registration.",[36,43,44,47],{},[14,45,46],{},"Do collect the specific details"," required by Royal Decree 933\u002F2021.",[36,49,50,51,54],{},"At an in-person check-in, you may ",[14,52,53],{},"visually compare"," the details with the document shown.",[36,56,57],{},"Online, the AEPD suggests alternatives such as a digital certificate, matching payment-method data or sending codes to the guest’s phone or email.",[36,59,60],{},"Be transparent, restrict access and retain only the necessary data for the applicable period.",[28,62,64],{"id":63},"why-should-you-not-keep-a-complete-copy","Why should you not keep a complete copy?",[10,66,67,68,75],{},"The ",[69,70,74],"a",{"href":71,"rel":72},"https:\u002F\u002Fwww.aepd.es\u002Fprensa-y-comunicacion\u002Fnotas-de-prensa\u002Faepd-informa-de-que-no-esta-permitido-solicitar-copia-dni-o-pasaporte-en-hospedajes",[73],"nofollow","AEPD’s official guidance"," explains that an identity card contains information the guest register does not require, such as the photograph, expiry date, card access number (CAN) and parents’ names. Processing it would breach the data-minimisation principle and increase the risk of identity theft if the copy were lost or leaked.",[10,77,78,79],{},"Furthermore, a photograph sent remotely does not prove that the sender is the document holder, while the identity card does not contain every item required by the accommodation rules. ",[14,80,81],{},"Building up a collection of copies therefore solves neither registration nor identity verification properly.",[28,83,85],{"id":84},"which-details-must-you-collect","Which details must you collect?",[10,87,88,93],{},[69,89,92],{"href":90,"rel":91},"https:\u002F\u002Fwww.boe.es\u002Feli\u002Fes\u002Frd\u002F2021\u002F10\u002F26\u002F933\u002Fcon",[73],"Annex I to Royal Decree 933\u002F2021"," lists the information to be provided for accommodation services. Depending on the activity and transaction, guest information includes:",[33,95,96,99,102,105,108,111,114,117],{},[36,97,98],{},"first name and surnames;",[36,100,101],{},"sex;",[36,103,104],{},"document number, support number and document type;",[36,106,107],{},"nationality and date of birth;",[36,109,110],{},"habitual place of residence;",[36,112,113],{},"telephone number and email address;",[36,115,116],{},"number of guests and family relationship when minors are present;",[36,118,119],{},"booking, stay and payment details required by the rules.",[10,121,122,123,126],{},"The basis for processing these details is compliance with a legal obligation. This ",[14,124,125],{},"does not make a full document copy necessary"," or allow the data to be reused for marketing without a separate legal basis.",[28,128,130],{"id":129},"how-to-verify-identity-without-retaining-the-id","How to verify identity without retaining the ID",[132,133,135],"h3",{"id":134},"in-person-check-in","In-person check-in",[10,137,138],{},"Ask the guest to complete or confirm their details and show the document. Compare the information visually and return it immediately. You do not need to photograph it or attach it to the guest record.",[132,140,142],{"id":141},"online-check-in","Online check-in",[10,144,145],{},"Use a secure form that collects only mandatory fields and apply a proportionate authentication method. The AEPD gives examples including:",[33,147,148,151,154,157],{},[36,149,150],{},"a digital certificate;",[36,152,153],{},"matching information associated with the payment method;",[36,155,156],{},"a one-time code sent to the guest’s phone or email;",[36,158,159],{},"checking the document in person on arrival, where the accommodation model permits.",[10,161,162],{},"There is no single solution for every business. The data controller must assess the process, its risks and the necessary security measures.",[28,164,166],{"id":165},"a-practical-privacy-conscious-workflow","A practical, privacy-conscious workflow",[168,169,170,176,182,188,194,200,206],"ol",{},[36,171,172,175],{},[14,173,174],{},"Provide information before collecting data."," Explain who the controller is, why the data is requested, who receives it, how long it is retained and how guests can exercise their rights.",[36,177,178,181],{},[14,179,180],{},"Request only necessary fields."," Avoid generic “just in case” forms.",[36,183,184,187],{},[14,185,186],{},"Verify proportionately."," Inspect the document in person or use an online mechanism appropriate to the risk.",[36,189,190,193],{},[14,191,192],{},"Do not retain the complete image."," If a tool reads fields from the document, configure it not to store the original photograph where it is unnecessary.",[36,195,196,199],{},[14,197,198],{},"Restrict access."," Only staff who need the data should see it; use individual accounts and audit trails.",[36,201,202,205],{},[14,203,204],{},"Submit to SES.Hospedajes."," Send the data through the official channels and within the official deadlines.",[36,207,208,211],{},[14,209,210],{},"Apply retention periods."," Royal Decree 933\u002F2021 requires professional operators to retain the electronic register for three years; do not confuse that register with a folder of ID copies.",[28,213,215],{"id":214},"common-mistakes","Common mistakes",[132,217,219],{"id":218},"if-the-guest-consents-i-can-keep-it","“If the guest consents, I can keep it”",[10,221,222],{},"Consent does not automatically justify excessive processing. When data is requested to meet a legal obligation, the processing must remain limited to what is necessary.",[132,224,226],{"id":225},"seshospedajes-requires-an-image-of-the-id","“SES.Hospedajes requires an image of the ID”",[10,228,229],{},"It does not. The platform receives structured information about travellers, bookings and stays. The rules do not require a photograph or PDF of the document to be uploaded.",[132,231,233],{"id":232},"i-will-redact-some-fields-and-retain-the-copy","“I will redact some fields and retain the copy”",[10,235,236],{},"Redaction can be useful where a copy is strictly necessary for a different legitimate purpose, but it does not turn the copy into a guest-registration requirement. That other purpose must be justified separately.",[132,238,240],{"id":239},"a-booking-platform-has-already-verified-the-guest","“A booking platform has already verified the guest”",[10,242,243],{},"Verification by Airbnb, Booking.com or another intermediary does not, by itself, replace the accommodation operator’s duties or prove that every mandatory field has been supplied to you.",[28,245,247],{"id":246},"what-can-a-guest-do-if-asked-for-a-copy","What can a guest do if asked for a copy?",[10,249,250],{},"They can ask about the purpose and legal basis, offer to provide only the mandatory details and request an alternative verification method. If they consider the processing inappropriate, they may exercise their rights with the controller and, if the response is unsatisfactory, complain to the AEPD.",[28,252,254],{"id":253},"in-summary","In summary",[10,256,257,258,261],{},"Registering guests and protecting their privacy are not opposing goals. The correct process is to ",[14,259,260],{},"collect the required data, verify it without creating an unnecessary copy and protect the resulting register",". It is safer for travellers and reduces legal and operational risk for the accommodation provider.",[28,263,265],{"id":264},"official-sources","Official sources",[33,267,268,274,280,287],{},[36,269,270],{},[69,271,273],{"href":71,"rel":272},[73],"AEPD guidance on copies of identity cards and passports in accommodation",[36,275,276],{},[69,277,279],{"href":90,"rel":278},[73],"Royal Decree 933\u002F2021 and accommodation-data annex",[36,281,282],{},[69,283,286],{"href":284,"rel":285},"https:\u002F\u002Fwww.interior.gob.es\u002Fopencms\u002Fes\u002Fservicios-al-ciudadano\u002Fhospedajes-y-alquiler-de-vehiculos\u002F",[73],"Spanish Ministry of the Interior information on SES.Hospedajes",[36,288,289],{},[69,290,293],{"href":291,"rel":292},"https:\u002F\u002Fwww.aepd.es\u002Fpreguntas-frecuentes\u002F1-tus-derechos\u002F3-identificacion-con-dni\u002FFAQ-0116-que-puedo-hacer-si-me-solicitan-una-copia-del-dni",[73],"AEPD FAQ about requests for an ID copy",{"title":295,"searchDepth":296,"depth":296,"links":297},"",2,[298,299,300,301,306,307,313,314,315],{"id":30,"depth":296,"text":31},{"id":63,"depth":296,"text":64},{"id":84,"depth":296,"text":85},{"id":129,"depth":296,"text":130,"children":302},[303,305],{"id":134,"depth":304,"text":135},3,{"id":141,"depth":304,"text":142},{"id":165,"depth":296,"text":166},{"id":214,"depth":296,"text":215,"children":308},[309,310,311,312],{"id":218,"depth":304,"text":219},{"id":225,"depth":304,"text":226},{"id":232,"depth":304,"text":233},{"id":239,"depth":304,"text":240},{"id":246,"depth":296,"text":247},{"id":253,"depth":296,"text":254},{"id":264,"depth":296,"text":265},"Data protection","Check-in Easy helps you collect the necessary guest details and automate their submission to SES.Hospedajes.","Digitise guest registration","A simpler, privacy-conscious check-in","Spain’s data protection authority says accommodation providers may not request or retain a full copy of an ID card or passport. Learn which details you must collect and how to verify them.","md","\u002Fblog\u002Ffotocopia-dni-hospedajes-og.png","Guest registration form containing the necessary data beside a rejected full copy of an identity document",{},true,"\u002Fblog\u002Ffotocopia-dni-hospedaje","2026-08-03T09:00:00+02:00","8 min read",{"title":5,"description":320},"Is it legal to ask guests for a photo or copy of their ID in Spain? Data required by Royal Decree 933\u002F2021 and ways to verify identity without retaining it.","Guest ID copies in Spain: what the AEPD says","\u002Fblog\u002Ffotocopia-dni-hospedajes-square.jpg","published","blog\u002Ffotocopia-dni-hospedaje","Updated on 3 August 2026","dRTj6z0gUKfvDEBhk29Jzx6Bvy477gPFVV01xXjfSNU",1786043376938]