Spain’s guest register does not start at reception. It starts when guests book.

Picture this: a couple from London arrives at half past eleven at night at a five-star hotel in Marbella, after a delayed flight. At reception they are asked for both passports, the document support number, their relationship to their twelve-year-old daughter and the details of the card they paid with. No one had told them in advance. It takes ten minutes, and their memory of the hotel starts there.

Spain’s guest register is usually treated as a matter for reception and the property management system. I see it differently. The law requires data to be reported from the moment of booking, and at that moment the guest is not at your desk. They are on your website, on a platform or on the phone.

What the rule asks for, precisely.

Royal Decree 933/2021 requires anyone providing accommodation in Spain, professionally or not, to collect guest data and report it to the Interior Ministry. That includes hotels, holiday apartments, campsites, tour operators and online platforms that act as intermediaries, as long as they offer services in Spain. The report must be made immediately and within 24 hours at most from two moments: when the booking is made or cancelled, and when the stay begins. Every guest over fourteen signs a registration form.

The list is long. For each guest: first name, both surnames, sex, document number and support number, document type, nationality, date of birth, full address, phone numbers, email, number of travellers and relationship if minors are present. For each stay: contract reference, dates and times of arrival and departure, number of rooms, internet connection and payment data, including the payment method, its identification, the holder and the card’s expiry date. Professional providers must also keep an electronic register for three years.

Failing to make the mandatory reports is a serious offence under Spain’s public security law, with fines from 601 to 30,000 euros. Reporting late or with irregularities is a minor offence, from 100 to 600 euros. The rule has applied in practice since December 2024. Catalonia and the Basque Country use their own reporting systems.

What Brussels challenges.

On 4 June 2026 the European Commission opened infringement proceedings against Spain, with a letter of formal notice, for breaching the Law Enforcement Directive on data protection. It considers the categories of data collected excessive, including payment and GPS data. It considers that police access is not limited to specific and explicit purposes. And it calls the three-year retention of all data disproportionate. Spain had two months to reply. A coalition of European tourism associations, including the hotel association HOTREC, welcomed the move.

That does not suspend the rule. The royal decree remains in force. According to the Spanish travel agency federations, the Interior Ministry told them at the end of June that it is pausing the ministerial order that develops the decree until the European procedure ends. Before changing how you work, confirm with your adviser or association what is required of you today.

The law decides which data is requested. Your website decides how the guest feels giving it.

Why this is a website matter.

If the data has to be reported from the moment of booking, whatever your booking engine does not collect will have to be requested later, by email, by phone or at the desk. In a luxury hotel, every late request is friction for someone who pays not to have any.

The alternative exists and is not complicated: online pre-arrival registration, sent with the confirmation, in the guest’s language, which they can complete from their sofa in two minutes. On arrival, reception only has to welcome them. It is an automation the guest notices on arrival and the team notices every day.

There are two conditions. First, security: passports and card details must not end up in a shared inbox or a spreadsheet. Second, transparency: guests should know, before giving their data, that this is a legal requirement in Spain, to whom it is reported and for how long it is kept. That belongs in the privacy notice and, in one clear line, in the form itself.

Where I stand.

I share the Commission’s doubt: asking for a passport’s support number and a card’s expiry date for one night in a hotel is a lot. But while the rule is in force, it has to be followed. And if it has to be followed, I would rather the guest did it calmly at home, in their own language, than at midnight in front of a desk. Guests do not remember the rule. They remember how they were asked.

What I would check.

• The data journey. What your website collects at booking, what arrives from platforms and what is still missing when the guest walks in.
• Pre-arrival registration. Whether it exists, in how many languages, and how long it takes a guest to complete on a phone.
• Where documents end up. Who can see passports and payment data, and where they are stored.
• The explanation to guests. Whether the form and privacy notice say why the data is requested and to whom it is reported.
• Flexibility. Whether you can remove fields without rebuilding the website when the rule changes.

Where to start.

1. This week

   Make a test booking

   From the website and from a platform, and note which data is missing at the end of the journey.

2. This month

   Review guest information

   One clear line in the form and an updated privacy notice.

3. This quarter

   Launch pre-arrival registration

   A secure link with the confirmation, in the guest’s language, connected to the system that reports to the ministry.

4. When it is resolved

   Adjust the fields

   Follow the European procedure and remove whatever stops being mandatory.

Make a test booking at your own hotel and count the minutes the guest spends at the front desk on arrival. Now imagine that guest after twelve hours of travel, with two sleeping children and a passport at the bottom of the suitcase.

How many of those minutes could your website have handled beforehand, calmly and from home? And a question to ask before the law asks it: does the guest know why you are asking for each piece of data?

If you would like me to review your website and your guest registration from this angle, start with the Strategic Diagnostic. Which data you must report in your specific case is for your legal adviser or your hotel association to confirm.