Complete Guide to Guest Registration in Spain: Regulations, SES Hospedajes and Automation for Hosts

Introduction to traveller registration regulations in Spain

The holiday rental sector in Spain has experienced unprecedented growth over the last decade. This boom has transformed how tourists enjoy their trips, but it has also brought far stricter regulation from the authorities. For Airbnb hosts, property managers and owners of tourist accommodation (VUTs), complying with the law is no longer optional, but a top-tier operational priority.

One of the fundamental pillars of this regulation is the obligation to identify and register everyone staying in tourist accommodation. This process, traditionally known as the traveller entry report (parte de viajeros), has evolved drastically. Today, it is not enough to have guests sign a piece of paper upon arrival; digitisation and national security controls require this data to be sent electronically to the State Security Forces within very strict timeframes.

In this practical and comprehensive guide, we will analyse in detail everything you need to know to comply with current regulations in Spain, from the requirements of the controversial Royal Decree 933/2021 and the SES.HOSPEDAJES platform, to the implications of data protection and how technology can help you simplify this tedious daily process.

The legal framework: From the traditional registry book to Royal Decree 933/2021

To understand the current situation, it is essential to review where we started. The obligation to register travellers in Spain is not new. Its modern origin dates back to the Organic Law 4/2015, of 30 March, on the Protection of Citizen Security. This law establishes that natural or legal persons carrying out activities relevant to citizen security (such as accommodation) must maintain a documentary record and transmit the information contained therein.

What is Royal Decree 933/2021?

The major regulatory shift came with the publication of Royal Decree 933/2021, of 26 October. This decree aims to update and unify data registration for accommodation and motor vehicle rental activities across Spanish territory. The main development of this law is that it exponentially increases the amount of information that owners and managers must collect and transmit to the Ministry of the Interior.

Unlike the previous regulations, which only required basic identity data, the new decree requests details about the financial transaction, the payment method, the number of rooms booked, and the relationship between guests (in the case of minors). This expansion of data generated intense debate in the tourism sector due to the operational complexity it poses for small hosts.

Extensions and current status of the SES.HOSPEDAJES platform

The implementation of Royal Decree 933/2021 has been marked by controversy and successive extensions. The main hotel and holiday rental associations argued that the Ministry of the Interior's technological platform, known as SES.HOSPEDAJES, was not prepared to absorb such a volume of data, and that the requirements for collecting payment data violated European privacy directives.

Following several transition periods and moratoria granted by the Government to avoid the collapse of the tourism sector, the unified SES Hospedajes system is now in its mandatory phase. Owners must familiarise themselves with this platform immediately, as the grace period for administrative penalties has come to an end. Failing to be registered in the system or not sending the data on time can lead to very severe financial penalties.

Who is required to register guests?

One of the most frequent questions among first-time owners is whether these regulations affect them directly. The short answer is yes: virtually anyone offering accommodation in exchange for financial consideration in Spain is required by law to register travellers.

Holiday rentals and tourist accommodation (VUT)

If you are an individual host renting out an apartment on Airbnb, a cottage on EscapadaRural or a villa on Booking.com, you are legally classified as an accommodation operator. It does not matter whether you manage a single property or a portfolio of fifty; the law obliges you to identify every person over 14 years of age who stays overnight in your accommodation and to communicate their details to the relevant authorities.

Hotels, hostels and guesthouses

For traditional hotel establishments, this process has been part of their daily operations for decades. However, with the entry into force of the new Royal Decree, these establishments have had to adapt their property management systems (PMS) to connect via API gateways to the Ministry of the Interior's database and transmit the new mandatory information fields.

Intermediary platforms

It is important to clarify that platforms such as Airbnb, Booking.com or Vrbo act solely as booking intermediaries. Although these platforms collect certain data from the user making the booking, the legal responsibility to physically identify the guest, verify their identity and send the traveller report rests exclusively with the property owner or manager. Airbnb will not send your guests' data to the police for you.

Mandatory data you must collect from each guest

Royal Decree 933/2021 significantly expanded the list of required data. To avoid errors and potential penalties, it is essential to know exactly what information you must request from your guests before or during their arrival.

Establishment and contract details

• Landlord details: Full name or company name, NIF/CIF (tax ID), and registration code assigned by the Security Forces.
• Transaction details: Booking reference number, check-in date and time, and scheduled check-out date and time.
• Property details: Full address of the tourist accommodation and number of rooms booked.
• Payment details: Although this point has been subject to relaxation and legal appeals, the regulations contemplate the collection of the payment method (card, bank transfer, cash) and the transaction number where applicable.

Personal data of travellers

You must collect information for all guests over 14 years of age. Minors under that age do not need to sign the report, but their details must be associated with the responsible adult they are travelling with. The mandatory details are:

• Full name and surname.
• Sex (gender).
• Date of birth.
• Nationality.
• Type of identity document (ID card, Passport, NIE, etc.).
• Identity document number and country of issue.
• Date of issue of the identity document.
• Handwritten or digital signature of the guest (mandatory for the entry report).

How to carry out guest registration step by step

Depending on the geographical location of your holiday home in Spain, the police body to which you must report the data may vary. Although the ultimate goal is unification under SES.HOSPEDAJES, several systems currently coexist depending on the autonomous community.

Registration with the National Police (Webpol)

If your accommodation is located in a municipality under the jurisdiction of the National Police, you will need to register on their web application known as Webpol. To do this, you must physically go to the nearest police station to your accommodation with the responsible declaration of start of activity of your tourist property and your identity documents to be assigned a username and password.

Registration with the Civil Guard (Hospedajes)

In municipalities that do not have a National Police station, jurisdiction falls to the Civil Guard. The system used in this case is called Hospedajes Guardia Civil. The registration process is similar: you must present yourself at the local Civil Guard station to register your activity and obtain your access credentials for the web portal.

Mossos d'Esquadra and Ertzaintza (Catalonia and the Basque Country)

• Catalonia: Hosts must register their travellers through the Mossos d'Esquadra portal (SIP-RESTRAC system).
• Basque Country: Registration is done through the Ertzaintza application.

The new unified system: SES.HOSPEDAJES

The Ministry of the Interior has developed the unified platform SES.HOSPEDAJES to centralise all these databases. To access it, owners must have a valid digital certificate or access via the Cl@ve system. Once inside the platform, you must register the establishment to obtain the activity code and start sending traveller reports directly, either by filling in the web form manually or by uploading XML files generated by your management software.

Legal deadlines and data retention

Spanish regulations are extremely strict regarding communication times and retention periods for traveller information. Ignorance of these deadlines does not exempt you from legal responsibility.

The 24-hour deadline

Once the guest physically checks in to the accommodation, the owner or manager has a maximum period of 24 hours to transmit the registration data to the State Security Forces. This deadline cannot be extended. If the submission is made outside of these 24 hours, the system will log the delay, and the host will be exposed to an automatic administrative penalty for late communication.

Retention of the registry book for 3 years

In addition to the electronic submission of data, the law requires the owner to compile a physical or digital document called the Traveller Registry Book. This book is made up of the collection of all entry reports signed by the guests, organised chronologically.

This registry book must be kept by the accommodation owner for a minimum period of 3 years starting from the date of the last registration sheet that comprises it. During this time, the book must be available to police authorities and tourism inspectors should they require it for a control inspection.

Data Protection (GDPR) applied to traveller registration

The collection of identity documents, signatures and personal contact details places hosts under the umbrella of the European Union's General Data Protection Regulation (GDPR) and the Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights in Spain.

Consent and the duty to inform

Many hosts make the mistake of thinking they need the guest's explicit consent to collect their identity data. This is incorrect: the legal basis that legitimises the processing of this personal data is compliance with a legal obligation (Royal Decree 933/2021). Therefore, the guest cannot refuse to provide their details if they wish to stay at the property.

However, the owner does have a strict obligation to provide clear information on how this data is processed. You must include an information clause in the holiday rental contract or on the traveller entry report itself, specifying who is responsible for processing, the purpose for which the data is collected (legal compliance with citizen security), who the recipients will be (Security Forces), and how guests can exercise their rights of access, rectification or erasure.

Security measures for storing data

Photocopying or photographing guests' passports and saving them in the gallery of a personal mobile phone or in unlocked physical folders is a serious breach of the GDPR. Identity data is highly sensitive and susceptible to identity theft.

To comply with the GDPR, the following security measures must be implemented:

• Do not store images of identity documents (ID cards or Passports) unless strictly necessary. The optimal approach is to extract the text data and delete the images.
• If physical entry reports are kept on paper, they must be stored in a locked filing cabinet.
• If stored digitally, files must be encrypted or protected with secure, restricted-access passwords.
• Use professional software tools that guarantee information security on servers hosted within the European Union.

How to automate the process and avoid heavy penalties

Registering guests manually can become an operational nightmare. Imagine having to welcome guests late at night, check their passports in low light, manually transcribe each detail without making typos on the police portal, and ensure they sign the physical document. If you manage multiple properties, this process consumes hours of daily work that you could spend improving the guest experience.

Advantages of check-in automation

The solution to this operational headache lies in implementing an automated check-in system. These technologies allow guests to register autonomously before arriving at the accommodation, using their own mobile phone.

The automated process works as follows:

1. The guest receives an automatic link a few days prior to arrival.
2. They access a secure portal where they scan their identity document or passport using OCR (optical character recognition) technology.
3. The system automatically extracts all mandatory data with complete accuracy.
4. The guest digitally signs the registration sheet on their mobile device screen.
5. The software generates the traveller report, automatically sends it to the SES.HOSPEDAJES platform (or the corresponding police force) within the legal 24-hour window, and securely stores the digitally signed document in the cloud in compliance with the GDPR.

This system not only eliminates administrative work for the host but also drastically improves the guest experience, as they no longer have to queue or deal with tedious bureaucracy upon arrival.

Quality control and accommodation cleaning

Efficient management of tourist accommodation goes beyond registering travellers. To ensure the property is in perfect condition before each new guest arrives (and avoid negative reviews), it is vital to closely coordinate cleaning and maintenance tasks. The use of digital control forms allows cleaning teams to document the actual state of the property using real-time photographic checklists, ensuring everything is ready to welcome the next traveller, who will have already completed their prior digital registration.

Penalties for non-compliance with regulations

The penalty regime applicable to traveller registration is highly rigorous. Infringements are categorised in the Organic Law 4/2015 on the Protection of Citizen Security and can seriously jeopardise the economic viability of your holiday rental business.

Minor offences

Minor offences include delays in sending information to the authorities (exceeding the 24-hour deadline) or omitting non-essential data in the traveller report. Financial penalties for these types of offences range between 100 and 600 euros for each recorded infraction.

Serious and very serious offences

Serious offences include failing to keep a traveller control register, not retaining the traveller registry books for the mandatory 3-year period, or refusing to cooperate with inspections by the State Security Forces. Fines for serious offences are extremely high, ranging from 601 to 30,000 euros. In addition to the financial fine, regional tourism authorities can temporarily or permanently suspend the property's tourist activity licence.

Frequently Asked Questions (FAQ) on guest registration

Is it mandatory to register children in the traveller report?

Yes, the regulations of Royal Decree 933/2021 require the identification of all guests, regardless of their age. However, signing the entry report is only mandatory for those over 14 years of age. For children under that age, the accompanying adult must sign on their behalf, linking the minor's details to those of the legal guardian.

What happens if a guest refuses to provide their identity details?

As a host, you have the right and the legal obligation to deny access to the accommodation to anyone who refuses to identify themselves. Allowing a guest to enter without registering them constitutes a serious offence that can lead to fines of up to 30,000 euros. Politely explain to the guest that this is a mandatory legal requirement for national security in Spain, equivalent to the registration carried out in any hotel.

Can I do traveller registration on paper?

Although the physical paper-signed report remains valid for compiling your internal registry book, the transmission of data to the authorities must be carried out electronically via the internet (Webpol, Hospedajes Guardia Civil or SES.HOSPEDAJES platforms). It is no longer permitted to submit reports physically to police stations or barracks, except in exceptional cases of widespread computer system outages.

Do I have to register guests who only visit for the day?

No, traveller registration regulations apply exclusively to people who stay overnight at the tourist establishment. Daytime visitors who do not spend the night on the property are not required to register in the accommodation control system, although it is advisable to monitor the maximum capacity permitted under your tourist licence for safety and neighbourly relations.

Conclusion: Technology as an ally of the modern host

Complying with the law in the Spanish holiday rental sector can seem like a daunting task due to the constant legislative evolution and the technical requirements of platforms like SES Hospedajes. However, far from seeing the regulations as an insurmountable obstacle, successful hosts understand them as an opportunity to professionalise their activity.

Adopting digital automation solutions not only guarantees strict compliance with citizen security laws and the GDPR automatically, but also frees up valuable management time, reduces the margin for human error, and projects an image of modernity and trust that guests greatly appreciate. Digitising your holiday rental is the definitive step to ensure the long-term profitability and peace of mind of your business.