Spain hotels and AI: guest register data, passports and prompts

Spain welcomed almost 94 million international tourists in 2024, according to the INE, the national statistics institute. Behind that record are thousands of hotels, holiday apartments and travel agencies that handle passports, card numbers and detailed bookings every single day. Since 2 December 2024, they must also send part of that data to the Ministry of the Interior within 24 hours.

At the same time, generative AI has moved into the front desk and the back office. Staff use it to answer a negative review, translate a message into German or write a booking confirmation. But the prompt sometimes holds much more than the text of a review.

The guest register: what Royal Decree 933/2021 requires

Royal Decree 933/2021 of 26 October 2021 (Real Decreto 933/2021) sets the record-keeping and reporting duties for accommodation providers and motor vehicle rental companies. After several postponements, the new system came into force on 2 December 2024. The data is submitted through SES.HOSPEDAJES, a platform run by the Ministry of the Interior.

The rules cover hotels, hostels, campsites, tourist and rural rentals, as well as online platforms that sell these stays in Spain and tour operators acting as intermediaries. The list of data to collect is long:

• guest identity: first name, surnames, sex, date of birth, nationality, document type and number, address, phone and email;

• the family relationship when a guest is a minor;

• stay details: arrival and departure dates and times, number of guests;

• payment data: payment method, card or IBAN identification, account holder and payment date.

This information must be sent immediately, and in any case within 24 hours, then kept for up to three years.

Why this data ends up in AI tools

Nobody deliberately copies an SES.HOSPEDAJES file into ChatGPT. Leaks come from ordinary habits. A receptionist pastes a full exchange with a guest to get a polite reply, including the booking reference, the passport number mentioned in the thread and the phone number. A travel agency asks an assistant to rewrite a group summary that lists every participant. An accounts team asks a chatbot to "tidy up" a spreadsheet of payment disputes with the last four card digits and the cardholders' names.

The sector relies heavily on seasonal staff, trained in a few days and switching between several languages. A briefing at the start of the season is not enough: AI saves them time, and they use it without thinking about what they paste. The cost of this unmanaged use is covered in our article on the real cost of shadow AI.

Reviews and emails: the most common case

Replying to online reviews is now a daily task for hotels. A public review is not a problem in itself. The risk appears when an employee adds context so the reply is precise: room number, exact dates, a refund claim, a health issue the guest mentioned, or the name of a child who was hurt at the pool. That context is personal data, sometimes special category data under the GDPR.

The same goes for emails. A request to change a stay often includes a copy of an ID document or a screenshot of a bank transfer. If the employee forwards the whole thing to a consumer AI assistant to draft the answer, the hotel loses control of data it is legally required to protect.

The legal framework: GDPR, LOPDGDD and the AEPD

Data collected for the guest register remains subject to the GDPR and to Spain's Organic Law 3/2018 (LOPDGDD). The Spanish Data Protection Agency (AEPD) is the competent authority. Article 32 of the GDPR requires technical and organisational measures appropriate to the risk, and a file that combines identity documents and payment details is clearly high risk. Our EU AI Act and GDPR compliance checklist sets out those measures.

The GDPR also sets the principle of purpose limitation: data collected for a public security obligation should not be freely reused, let alone handed to a third party service without a contract or an assessment. On the AI side, AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, completes the picture. We covered its role in our article on AESIA and how Spanish companies should prepare for the AI Act.

What a hotel or agency can do right now

Banning AI at the front desk is not realistic. It is better to set a framework:

1. List the tools actually in use at reception, reservations, marketing and accounts, including on personal phones.

2. Set one simple rule: never put a document number, card number or IBAN into an AI assistant, even for a translation.

3. Provide an approved tool with a compliant data processing agreement, rather than letting everyone pick their own.

4. Anonymise sensitive data automatically before it is sent, so staff keep the benefit of the tool.

5. Keep a record of the incidents prevented, which helps if the AEPD comes knocking.

Anonymisation is often the best compromise: the name becomes a pseudonym, the passport number becomes a fake identifier in the same format, and the generated reply is still usable. Our article on format preserving anonymization explains how it works.

Summary

Since December 2024, Spanish accommodation providers and travel intermediaries hold even more identity and payment data. Generative AI is useful for reviews, emails and translations, but every copy and paste can expose a passport or a bank card. Framing these uses, anonymising before sending and keeping evidence of controls is the calm way to face the AEPD.

ZeusLock detects and anonymises passport, DNI, card and IBAN numbers before they reach ChatGPT, Copilot or Gemini, right in your teams' browsers. Book a ZeusLock demo to see how to protect your front desk without slowing it down.