Available in: ES

Mandatory Personal and Tax Details Required to Process Legal Bookings

Introduction to the Legal Management of Bookings in Holiday Rentals and Hotels

Managing tourist accommodation requires far more than simply handling traveller arrivals or handing over apartment keys. Strictly complying with regulations on user identification and the invoicing of stays is a fundamental cornerstone for preventing severe financial penalties and ensuring public safety. In today's landscape, both holiday let managers and hotel establishments must collect key pieces of information before finalising an accommodation agreement.

The regulatory framework in Spain and Europe has evolved with the goal of strengthening oversight over tourist activities and adapting guest registration to digital demands. The entry into force of Royal Decree 933/2021 marked a substantial leap in the volume of data required by the Ministry of the Interior via the SES.HOSPEDAJES platform. Meanwhile, tax legislation and the General Data Protection Regulation (GDPR) establish strict guidelines on which fiscal information must be gathered and how it must be safeguarded to protect travellers' privacy.

Throughout this comprehensive guide, we will analyse in detail the mandatory legal requirements for formalising lawful stays, valid identity documents, invoicing obligations, and the best practices for automating the entire process without increasing your business's operational workload.

Legal Framework Regulating Guest Registration in Tourist Accommodation

Guest registration control primarily serves public order and citizen security purposes. Historically, regulations required the manual completion of guest registration forms (partes de hospedería) to be submitted to the National Police, Civil Guard, or regional police forces (Mossos d'Esquadra and Ertzaintza). However, modern legislation mandates a broader and more structured exchange of information via digital means.

Key Regulations Applicable in Spain

To understand the scope of these obligations, reviewing the body of law governing tourism activities and customer data collection is essential:

Organic Law 4/2015, of 30 March, on the Protection of Citizen Security: Establishes the general obligation for natural or legal persons engaged in activities relevant to public safety (including accommodation services) to register and identify users.
Royal Decree 933/2021, of 26 October: Regulates the documentary registration and information obligations of natural or legal persons carrying out accommodation and motor vehicle rental activities. This regulation significantly broadens the required data fields and unifies electronic reporting on the Ministry of the Interior's centralised platform.
Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD): Legislation ensuring the ethical, proportionate, and secure processing of personal data gathered throughout the booking and check-in process.
Law 37/1992 on Value Added Tax and Invoicing Regulations (RD 1619/2012): Governs the obligation to identify customers fiscally when an official invoice for their stay is requested.

Mandatory Identity Information Required from Guests

Collecting identity details is mandatory for all guests staying overnight at the property or hotel establishment. The regulations draw no distinction whether the booking was made directly, through traditional travel agencies, or via online booking platforms such as Airbnb, Booking.com, or Vrbo.

List of Mandatory Personal Details for Travellers

The guest registration protocol requires specific details from the lead guest and their accompanying travellers who are of legal age or possess their own identity document. The complete list of data required by the legal framework includes the following fields:

First name and surname: Must match the official document presented exactly.
Sex: Exactly as recorded on the identity document.
Identity document number: Alphanumeric identifier of the DNI, Passport, NIE, or equivalent official document.
Document type: Clarification on whether it is a national ID, passport, residence permit, or other valid document.
Guest nationality: Issuing country of the document or the traveller's official nationality.
Date of birth: Required to verify majority of age or the legal guardianship of accompanying minors.
Permanent residential address: Full address, including street, number, postcode, town or city, and country.
Contact telephone number: Preferred landline or mobile number to reach the guest if necessary.
Email address: Active email address used for booking management or formal correspondence.
Family or legal relationship: Where minors travelling without an official identity document are concerned, their relationship to the responsible adult must be detailed.

Valid Identity Documents for Verification

Not all documents issued by organisations or public administrations are accepted for formalising an official guest registration. Legally, the accommodation manager may only accept the following official photographic documents:

For Spanish Citizens

The National Identity Document (DNI) is the primary document. If missing due to loss or expiry, a Spanish Passport or a Driving Licence issued in Spain is valid to verify identity within the national territory.

For European Union and European Economic Area Citizens

Citizens from EU member states, Iceland, Liechtenstein, Norway, and Switzerland can identify themselves using their home country's National Identity Card or a valid Passport.

For Third-Country Nationals (Non-EU)

Travellers from outside the European Union must present a valid international Passport or, failing that, a valid Foreigner Identity Card (TIE) or valid residence visa.

Transaction and Establishment Details Required by the Authorities

One of the most notable changes introduced by recent regulations is that guest registration is no longer restricted to personal affiliation details. The authorities also require each entry record to be linked to specific booking and property details.

Contract and Booking Details

Along with guest identity, the property owner or hotel manager must include the following operational data in the electronic register:

Contract or booking reference number: Unique code identifying the commercial transaction.
Date and time of booking completion: Exact moment the client confirmed the rental.
Check-in date and time: Moment physical access to the property occurs.
Check-out date and time: Scheduled or confirmed departure from the premises.
Number of guests staying: Total agreed occupancy for the stay.
Payment method used: Specification of whether payment was made via credit/debit card, bank transfer, cash, or another payment gateway.
Payment details identification: For card payments or transfers, transaction records (such as IBAN or the last digits of the card) must be recorded, always respecting banking security standards.

Property or Accommodation Details

The submission sent to the authorities must connect the record to the physical property registered with the regional or municipal tourism authorities:

Establishment registration code: Official licence number issued by the relevant tourism board.
Commercial name of the accommodation: Name of the property or hotel.
Exact property address: Street, number, floor, door or apartment number, postcode, and municipality.
Operating entity details: Tax ID (NIF/CIF) and registered business name of the property owner or holiday rental management company.

Fiscal Requirements and Details for Issuing Legal Invoices

Beyond police guest reporting, hosts and operators are required to comply with tax legislation regarding invoicing for stays and providing payment receipts. Depending on the client type (individual or business) and applicable tax regime, requirements differ.

Invoices for Private Customers (B2C)

If the guest stays for leisure purposes and does not request a full invoice for tax deduction purposes, the law permits the issuance of a simplified invoice (factura simplificada). This document only requires the following details:

Invoice series and sequential number.
Issue date and service delivery date (if different).
Name or business name and Tax ID (NIF/CIF) of the issuer (manager or owner).
Description of the service (e.g. "Accommodation services from DD/MM/YYYY to DD/MM/YYYY").
Applicable tax rate (VAT at 10% under Spain's general accommodation regime, or IGIC in the Canary Islands) and total amount breakdown.

Full Invoices for Companies or Sole Traders (B2B)

When a booking is made by a professional, a business, or an individual seeking to deduct the expense for work reasons, issuing an ordinary or full invoice is mandatory. In this instance, legally collecting full tax details from the client before issuing the document is required:

Full individual name or Registered Company Name.
Tax Identification Number (NIF, CIF, NIE, or intra-Community VAT ID).
Full registered tax address: Street address, postcode, city, and country of fiscal residence.
Detailed breakdown of the taxable base, applicable VAT/IGIC rate, and tax quota.
Personal income tax (IRPF) withholdings: If applicable depending on the rental classification (e.g. commercial lettings or specific lease agreements not exempt as standard accommodation).

Data Handling and Strict GDPR Compliance

The volume of sensitive and personal data gathered by tourist accommodation providers calls for exceptionally stringent cybersecurity and data governance measures. Unlawful collection of identity document photocopies without explicit consent or unencrypted file storage can result in substantial penalties imposed by the Spanish Data Protection Agency (AEPD).

Key Principles for Secure Data Processing

When requesting identity details from a guest, you must ensure compliance with the principles set out by the General Data Protection Regulation:

Data minimisation principle: You must only request the fields strictly required by Royal Decree 933/2021 and tax regulations. Requesting unredacted full photocopies without justifying why non-mandatory details are collected may constitute a regulatory violation.
Duty to inform: Guests must receive a clear and accessible privacy notice explaining who the data controller is, the lawful purpose of collection (compliance with legal obligations), and retention periods.
Legal retention periods: Hospitality regulations mandate that guest registration books and entry forms be retained for a minimum of 3 years starting from the check-out date. Once this legal period expires, data must be securely erased or destroyed.
Secure storage: Leaving paper guest forms accessible to unauthorised individuals or storing unencrypted passport photos on mobile phones or unsecured cloud services is strictly prohibited.

Step by Step: How to Complete the Guest Form and Create the Guest Book

To manage guest arrivals correctly and keep your properties compliant with current regulations, the operational process should follow a systematic workflow:

1. Pre-arrival or In-person Data Collection

The guest must provide all the previously mentioned details. This can be performed during in-person check-in upon arrival via a printed document or, preferably, using online check-in software prior to travel.

2. Mandatory Guest Signature

Every guest entry form must carry the obligatory signature of any traveller aged fourteen or older. For in-person procedures, an ink signature on paper or a digital stylus signature on a tablet is used; for online procedures, a biometric or digital signature integrated into the check-in platform is utilised.

3. Creation of the Guest Registration Book

Individual guest slips must be compiled in numerical order to assemble the property's official guest books. Each book must contain a minimum of 100 pages and a maximum of 500 pages, or annual digital batches in the case of electronic systems.

4. Electronic Submission to the Relevant Authorities

Once the details are collected, the host or manager has a maximum timeframe of 24 hours to transmit the information to the official platform. Failure to submit within this window represents an administrative offence.

How to Automate Data Submission to Authorities and Form Collection

Collecting passports manually, transcribing details line by line, and logging into police portals manually leads to persistent typographical errors, wasted time, and guest friction. Today, technology enables full automation of this administrative workload.

To streamline this process and ensure compliance transparently, implementing advanced solutions such as Macufy's Automated check-in system is highly recommended, as it connects directly with official modules of the Ministry of the Interior and regional police authorities.

Benefits of Automating the Check-in Process

Deploying digital scanning and communication tools delivers immediate operational advantages to your holiday let business:

Instant OCR scanning: Guests scan their identity documents using their smartphone camera before arrival. The system extracts all text fields automatically, removing human data-entry errors.
Legally valid digital signatures: Travellers sign their guest form directly on their mobile screen with full legal validity.
24/7 automated submission to SES.HOSPEDAJES: The software generates and transmits the XML file or communicates via API directly with the authorities within the 24-hour statutory deadline, requiring zero manual intervention.
Customised guest messaging: You can set up automated guest messages to send registration links the moment a booking is confirmed or a few days before check-in.
Secure digital custody: Data is stored on encrypted servers in strict compliance with the GDPR and LOPDGDD, generating official guest books automatically.

Penalties for Non-Compliance with Hospitality Regulations

Failing to identify guests, omitting record retention, or failing to submit data to the centralised platform is severely penalised by competent authorities. Fines are graded according to severity and intent.

Classification of Offences Under Law 4/2015 and RD 933/2021

Minor Infringements

Minor infringements include slight delays in reporting data to authorities (provided they are not habitual), missing non-essential secondary fields, or minor formal errors in assembling registration books. Financial penalties for these offences range from €100 to €600.

Serious Infringements

Serious offences include failing to register guests, refusing to complete guest entry forms, repeatedly failing to report booking data to the National Police, Civil Guard, or SES.HOSPEDAJES, and failing to retain registration books for the required 3 years. Fines range between €601 and €30,000.

Very Serious Infringements

Very serious infringements include intentional falsification of identity documents, unlawful data sharing for fraudulent purposes, or persistent, systematic refusal to cooperate with law enforcement authorities. Fines may exceed €30,000 and can involve the temporary or permanent suspension of the property's tourist licence.

Frequently Asked Questions (FAQ) About Data Required for Legal Bookings

Is it mandatory to collect identity details from minors?

Yes, legislation mandates the registration of everyone staying at the property. For minors under 14 who do not hold a national identity card or passport, parents or legal guardians must provide their details, ensure they are recorded, and sign on their behalf stating their parental/legal relationship.

Can I ask the guest for a full photocopy of their ID or passport?

The Spanish Data Protection Agency (AEPD) has reiterated that photocopying or scanning entire physical documents is inadvisable unless irrelevant data fields are redacted. The legal obligation is solely to collect and verify the specific data fields required by hospitality law. Using mobile OCR scanning to extract text fields exclusively is the recommended method to comply with GDPR.

What happens if a guest refuses to provide their personal details?

If a guest refuses to identify themselves or sign the mandatory guest check-in form, the accommodation operator holds both the legal right and duty to refuse entry to the property. Accommodating an unidentified individual constitutes a serious regulatory offence subject to heavy fines.

Does submitting data to SES.HOSPEDAJES replace reporting to local police stations?

Yes, the Ministry of the Interior's SES.HOSPEDAJES platform centralises data reception across all Spanish territory governed by the National Police and Civil Guard. In autonomous communities with their own police bodies (Catalonia and the Basque Country), submissions continue through their respective dedicated portals (Mossos d'Esquadra and Ertzaintza) or via certified integrated gateways.

How long must I retain invoices and payment receipts?

For tax purposes (Spanish Tax Agency / AEAT), accounting records, receipts, and invoices issued for accommodation services must be kept for a minimum of 4 years from the deadline of the voluntary tax filing period.

Conclusion: Safety and Efficiency in Managing Your Accommodation

Ensuring that your holiday rental or hotel operates in strict compliance with the law provides peace of mind for both hosts and guests. Requesting mandatory personal and tax data not only prevents substantial administrative penalties but also elevates the professional standard of your accommodation service.

Thanks to cloud-based management technology, automating identity document scanning, creating error-free guest forms, and submitting notifications to public authorities in real time is now a swift, seamless process. Integrating specialised digital tools into your daily operations frees up hours of administrative work, allowing you to focus on delivering the best possible guest experience.