Disponible en: ES

Digital Guest Registration and Identity Verification: A Complete Guide to Legal Compliance in Spain

The holiday rental sector in Spain has undergone an unprecedented transformation in recent years. What started as an informal accommodation alternative has established itself as one of the main drivers of national tourism. However, this exponential growth has been accompanied by increasingly strict and complex regulation. Today, managing a holiday apartment does not only mean maintaining the property in perfect condition and offering excellent customer service; it also requires becoming an expert in regulatory compliance and legal certainty.

One of the biggest challenges facing property owners and property managers today is digital guest registration and identity verification. With the entry into force of more demanding regulations, traditional data collection methods — such as filling out paper forms on guest arrival or requesting passport photos via WhatsApp — are not only inefficient, but also illegal under current data protection and public safety standards.

In this article, we will analyse in depth the current legal framework in Spain, explain how identity verification tools work, and detail how automating these processes can save your business from heavy fines, saving you hundreds of hours of administrative work.

The new legal scenario for holiday lets in Spain

Public safety and the prevention of terrorism and organised crime are the main reasons why the Spanish State exercises strict control over people staying in any type of tourist accommodation. Historically, this control was governed by Organic Law 4/2015 on the protection of public safety and Order INT/1922/2003.

Under that former regulation, hosts had to complete a physical document called a "parte de entrada de viajeros" (traveller registration form), which the guest signed upon arrival. Subsequently, this data was transmitted manually to the databases of the National Police (e-Hotel), the Civil Guard (Hospederías), or regional police forces (Mossos d'Esquadra in Catalonia or Ertzaintza in the Basque Country) within 24 hours of the start of the stay.

The transition towards stricter safety controls

The rise of digital platforms and the need to unify and modernise these control systems led to the approval of a much more comprehensive new regulatory framework: Royal Decree 933/2021. This decree introduces substantial changes in the amount of information that must be collected and how it must be communicated to the competent authorities.

Although its final implementation has suffered several extensions due to the technical complexity it poses for the tourism sector, the reality is that the path towards total digitalisation and strict identity control is irreversible. Owners of holiday accommodation (VUTs) must be prepared to comply with this regulation quickly and without friction for the guest.

Royal Decree 933/2021 and the SES.HOSPEDAJES platform

Royal Decree 933/2021, of 26 October, establishing the obligations for documentary registration and information for natural or legal persons exercising accommodation and motor vehicle rental activities, marks a turning point in the operational management of tourist accommodation in Spain.

What exactly is Royal Decree 933/2021?

This regulation significantly expands the range of data that landlords must request from travellers. Basic identity document details (first name, surname, document number, and date of birth) are no longer enough. Now, the Ministry of the Interior requires detailed information regarding the contractual transaction and the payment methods used by guests.

The objective of this decree is to improve the traceability of financial operations and the identities of individuals travelling within the national territory, aligning Spain with European directives on anti-money laundering and the fight against terrorism.

The role of SES.HOSPEDAJES in holiday rental management

To centralise the receipt of all this information, the Ministry of the Interior has developed a unified web platform known as SES.HOSPEDAJES (Accommodation Information Submission Service). This portal will progressively replace the old National Police and Civil Guard platforms.

All accommodation operators, including owners of a single holiday property, must register on this platform to obtain their access credentials and begin reporting the data required by law. Data communication must be carried out electronically, preferably via direct API integrations that allow automated submission from property management systems.

Who is obliged to report traveller data

Hotels, hostels, and guest houses: Traditional hotel establishments of any category.
Tourist apartments and holiday rentals (VUTs): Any property marketed temporarily for holiday purposes, regardless of whether it is managed by an individual or an agency.
Campsites and caravan parks: Spaces designated for overnight stays outdoors.
Active tourism companies and vehicle rental companies: Providing complementary or primary accommodation or mobility services.

What data must mandatorily be collected?

The amount of information required by Royal Decree 933/2021 is one of the points that has generated the most controversy in the sector due to the administrative effort involved in manual collection. Mandatory data is divided into two main categories:

Accommodation and contractual transaction data

This data identifies the commercial operation and the channel through which the booking was made:

Operator details: Name or business name, NIF or CIF of the host/landlord.
Transaction details: Contract reference number, check-in date and time, check-out date and time, number of rooms or accommodation units booked.
Payment details: Payment method used (credit card, bank transfer, cash, digital payment gateways), card number (obfuscated according to PCI-DSS standards) or originating bank account details, financial transaction date, and receipt or invoice number.

Personal data for each guest

It is compulsory to register all guests staying at the property, not just the primary booker. This includes minors, whose details must be provided by their legal guardians:

Full name and surname: Exactly as they appear on their official identity document.
Sex: Male, female, or unspecified on the document.
Date of birth: Crucial to verify legal age and apply relevant tourist taxes.
Nationality: Issuing country of the identity document.
Identity document number: National ID card, passport, NIE, or national identity card from their country of origin.
Document type: Specify whether it is a passport, national identity card, etc.
Usual residential address: Street, number, postcode, city, and country.
Contact telephone number and email address: Direct contact details for the guest.
Family relationship: In the case of minors, the relationship with the accompanying adult must be indicated (father, mother, guardian).

The step-by-step digital guest registration process

To avoid friction during guest arrival and ensure regulatory compliance, implementing a digital guest registration process is the most efficient solution. This digitalised workflow consists of four key stages that completely transform the guest experience and property operations.

1. Data capture using OCR technology

The first step is to provide the guest with a link to a web check-in portal before their arrival. Users can use their mobile phone camera to scan their identity document or passport.

This is where OCR (Optical Character Recognition) technology comes into play. This technology analyses the document image, detects the Machine Readable Zone (MRZ), and automatically and accurately extracts all text data (first name, surname, document number, date of birth, etc.). This stops guests from having to type their details manually, eliminating typographical errors that could invalidate the police registration.

2. Biometric identity verification and validation

Scanning a document is not enough to guarantee that the person completing the registration is its rightful owner. To ensure the veracity of the process, advanced systems incorporate biometric identity verification.

The system asks the guest to take a real-time "selfie" or photo. Using artificial intelligence algorithms and facial recognition, the software compares facial features from the selfie with the photograph printed on the scanned identity document. In addition, "liveness detection" tests are applied (such as asking the user to blink or turn their head) to prevent fraud using printed photos or third-party videos.

3. Digital signature of the traveller registration form

Once data has been verified and the guest's identity confirmed, the system automatically generates the traveller registration form in PDF format. The guest can check that all information is correct and sign the document directly on their mobile device or tablet screen.

This digital signature must comply with the EU eIDAS Regulation requirements to guarantee its legal validity in any inspection or legal proceeding. The signed document is securely stored in the cloud, remaining available to the owner for the mandatory legal period of three years.

4. Automated submission and communication to authorities

With the signed document and structured data, the software automatically connects with the state security forces platform (such as SES.HOSPEDAJES, Police, or Civil Guard). Information is transmitted in an encrypted format within seconds, without requiring manual intervention from the host.

The system receives a confirmation code or proof of submission linked to the guest's booking, serving as irrefutable proof of having complied with legal obligations within the 24-hour deadline set by law.

How to automate the process without losing the human touch

Many property owners worry that digitalising these processes will cool customer relations or prove too complex for people unfamiliar with technology. However, when using the right tools, automation achieves the opposite effect: it frees hosts from heavy administrative burdens, allowing them to focus on delivering a warm welcome, personalized local recommendations, and high-quality service.

Integrating digital check-in into your workflow

The key to a successful transition to digital registration is system integration. A good property management system (PMS) should seamlessly connect the booking engine, sales channels (Airbnb, Booking.com, VRBO), and the legal registration tool.

By automating the workflow, the moment a booking is confirmed, a pre-set sequence of actions begins, guiding the guest step-by-step until their arrival day.

The importance of automated messages

Communication is the cornerstone of ensuring guests complete digital registration successfully. Setting up automated guest messaging allows you to send the pre-check-in link at key moments of the journey:

Booking confirmation message: Briefly explaining that, due to legal requirements in Spain, traveller registration must be completed prior to arrival.
Reminder 3 days before arrival: Sending a direct link to the identity verification portal so they can complete it comfortably from home.
Welcome message on check-in day: Providing access instructions or door entry codes only if they have successfully completed registration and identity verification.

Automated check-in as a competitive advantage

Offering automated check-in not only helps you comply with the law, but is also one of the features most valued by modern travellers — especially corporate guests, families travelling late, or international tourists looking to avoid unnecessary queues at reception.

Combining digital identity verification with smart locks or keypads allows guests to access the property autonomously at any time of day or night, whilst ensuring you know exactly who is inside your property and that you have met your legal obligations with the Ministry of the Interior.

Benefits of digitalisation and identity verification

Implementing a digital registration and biometric verification system should not be seen merely as a cost or government-imposed obligation. For holiday accommodation owners and property managers, this technology provides invaluable strategic value that directly impacts business profitability and security.

Fraud prevention and protection against chargebacks

One of the biggest headaches in holiday rentals is fraudulent bookings made with stolen credit cards or stolen identities. If a scammer books your property, stays, and later the genuine cardholder claims the charge back, the payment gateway or issuing bank will execute a chargeback, retrieving the booking funds from you.

Having a biometric identity verification process provides solid, irrefutable proof that the person who booked and paid with the card is the same individual who physically identified themselves and signed the accommodation contract. With this evidence, banks typically rule in favour of the owner in chargeback disputes.

Strict GDPR compliance and data security

The European Union's General Data Protection Regulation (GDPR) imposes heavy penalties on businesses that do not process personal data securely. Requesting passport photos via email or WhatsApp, or storing physical printed copies in filing cabinets without physical security measures, severely breaches this regulation.

A digitalised and approved registration system guarantees that:

Data is transmitted in encrypted format via secure HTTPS protocols.
Sensitive information is not stored on the personal mobile phones of cleaning staff or managers.
Storage servers meet ISO security standards and are located within the European Union.
Guests can easily exercise their GDPR rights (Access, Rectification, Erasure, and Objection).

Operational time savings for managers and owners

The time a host spends welcoming guests, checking passports, transcribing data into the police portal, and filing paperwork can easily exceed 30 minutes per booking. Multiplied across dozens of bookings per month, the operational cost is extremely high.

Automation reduces this time to practically zero minutes per booking for the host. The system works in the background 24 hours a day, 7 days a week, allowing you to scale your business and manage a higher volume of properties without increasing office staff.

Penalties for non-compliance: The cost of not staying up to date

Spanish legislation is extremely strict regarding traveller registration. Failing to complete guest registration, submitting data past deadlines, or gathering incomplete or inaccurate information can result in serious financial and administrative consequences for your holiday rental business.

Minor, serious, and very serious offences

According to Organic Law 4/2015 on the protection of public safety, penalties are classified as follows:

Minor offences: Delays in submitting information to authorities or minor errors when filling in data. Fines can range from €100 to €600 for each incorrect or late traveller form.
Serious offences: Failing to register guests, lacking the mandatory guest register book, or refusing to cooperate with security force inspections. Financial penalties for these offences range from €601 up to €30,000, and may also result in the temporary suspension of your tourist activity licence.
Very serious offences: Deliberately providing false information or concealing the identity of individuals wanted by law enforcement. In these cases, fines can reach €600,000 alongside the permanent closure of the establishment.

Considering the severity of these penalties, taking risks with manual processing or neglecting regulatory compliance is an unacceptable gamble for any professional owner.

Frequently asked questions about digital guest registration in Spain

Below, we answer the most common questions raised by holiday home owners and managers regarding digital registration and identity verification.

Is it legal to require guests to complete digital identity verification?

Yes, it is entirely legal and, in fact, an obligation under public safety legislation and Royal Decree 933/2021. The host has a legal duty to identify individuals staying at their property. If a guest refuses to provide identification or complete identity verification, the host has the right (and duty) to deny access to the property, without this constituting a breach of contract by the host.

What happens with minors who do not have an identity document?

For minors under 14 who do not hold a national ID or passport, accompanying parents or legal guardians must provide the minor's details during their own registration process. The digital system allows adding minors as accompanying guests linked to the adult's document, registering their name, surname, date of birth, and family relationship, strictly complying with current regulations.

How long must traveller registration forms be kept?

According to Spanish regulations, traveller register books — composed of grouped, duly signed entry forms — must be retained and made available to law enforcement agencies for a period of three years from the guests' departure date. Secure digital cloud storage makes complying with this requirement effortless, removing the need to store physical paper in offices or properties.

What happens if internet connectivity or the SES.HOSPEDAJES system fails?

If technical issues attributable to the Ministry of the Interior platform or your software provider prevent real-time data submission, the law dictates that you must store the information securely and submit it as soon as service is restored. The 24-hour window remains the baseline, but authorities accommodate justified technical incidents provided it can be proven that data was collected at the time of guest check-in.

Conclusion: The future of tourist accommodation management

Digitalisation and the automation of legal requirements are no longer a future option; they are an urgent present necessity. Compliance with Royal Decree 933/2021 and proper management via platforms like SES.HOSPEDAJES demand robust, secure, and efficient tools that minimise admin work and maximise property and guest security.

Adopting digital guest registration and biometric identity verification technology not only protects your business from devastating financial penalties and credit card fraud, but also enhances the guest experience, positioning your brand as a modern, professional, and trustworthy accommodation provider.

In a highly competitive tourism market, hosts who manage to balance technological efficiency with genuine hospitality will lead the sector and achieve top guest reviews. Do not let bureaucracy hold back your business growth; take the step towards smart automation today.