GDPR for Small Hotels and B&Bs: Handling Guest Data

Guest names, contact details and passport data are personal data under the GDPR. These are the main rules, applied to a small property.

Legal basis (Art. 6)

• Contract: the data you need to deliver the stay.
• Legal obligation: e.g. Latvia's foreign-guest declaration and accounting records.
• Consent: marketing emails. It must be optional and as easy to withdraw as to give.

Principles (Art. 5)

• Collect only what you need (data minimisation).
• Keep data only as long as needed (storage limitation). For example, Latvian guest declarations are kept for one year.
• Keep it secure: locked cabinet, password-protected devices, no passport photos in chat apps.

Privacy notice (Art. 13)

Tell guests who you are, why you process their data, the legal basis, how long you keep it, who receives it (e.g. booking platform, accountant, authorities on request) and their rights. Put it on the intake form and your website.

Retention schedule example

• Guest declaration (LV): 1 year
• Invoices: as required by accounting law (check with your accountant)
• Marketing list: until consent is withdrawn
• CCTV, if used: as short as possible, with signage

Official sources

• GDPR full text (EUR-Lex)
• Latvian Data State Inspectorate

Last reviewed 29 October 2026. This guide is general information, not legal or tax advice. Check the linked official sources for your case.