„Do I need consent from guests to process their personal data?“ No — and that is precisely the most common misunderstanding. You process guest data because the LAW requires you to, not because the guest allowed it. A consent checkbox in the check-in adds nothing: it merely creates the impression that the guest can say no — and they cannot.

For a host, the GDPR is no bogeyman. It is four rules: know why you collect each piece of data, collect nothing extra, tell the guests about it and destroy the data once the period expires. Below you will find the limit, the deadline and the penalty for each.

What to do

Legal grounds: you do not need consent

The GDPR knows six legal grounds (Article 6 (1) (a) to (f)). In practice you stand on three:

1. 1A LEGAL OBLIGATION (letter (c)) — the guest register under § 3g of the Act on Local Fees, the house book and the notification of a foreign national's accommodation within 3 working days under § 100 (c) and (f), § 101 and § 102 of the Act on the Residence of Foreign Nationals, the basis for the municipal stay fee. This data you MUST process; the guest's consent is beside the point and they cannot „withdraw“ it.

1. 1PERFORMANCE OF A CONTRACT (letter (b)) — the booking, the contact details, communication about the stay, the settlement. It covers pre-booking communication too, if the guest initiated it with their enquiry.

1. 1A LEGITIMATE INTEREST (letter (f)) — a camera at the entrance, recovering damage to the furnishings, offering your own similar services to former guests. Here you must be able to justify that your interest outweighs the guest's privacy (a balancing test), and the guest has the right to object (Article 21).

Save consent for whatever fits into none of these three grounds — and even there remember that, according to the Data Protection Authority, consent conditional on the service being provided „does not meet the condition of a freely given expression of will“ (Article 7 (4) GDPR).

Minimisation: the law is a ceiling, not a floor

The minimisation principle (Article 5 (1) (c) GDPR) allows you to process only data necessary for the given purpose. For statutory records the scope is set exhaustively: § 3g (2) of the Act on Local Fees lists the dates of the stay, the guest's identification including the address of the place of registration, the details of the identity document and the amount of the fee collected, or the reason for exemption — a separate article goes through them item by item. For foreign nationals the scope of the registration form is added (§ 101 and § 103 of the Act on the Residence of Foreign Nationals). → The guest register: what must not be missing (and what does not belong there)

That list is also your ceiling:

• No copies or photos of documents „for the drawer“ — the law wants the particulars from the document, not the document itself.
• No birth numbers — the guest register does not require them.
• No data „in case it comes in handy“ — every extra detail is nothing but a risk, at a breach and at an inspection alike.

A copy of a document is not merely excessive caution but a breach of two separate acts. Making a copy of an identity card without the holder's consent is prohibited by § 39 (c) of Act no. 269/2021 Coll.; it is an offence with a fine of up to CZK 10,000 (§ 65 (1) (d)) dealt with by the municipal office of a municipality with extended powers, not by the Data Protection Authority. For a travel document the prohibition is broader: § 2 (3) of Act no. 329/1999 Coll. forbids making a copy of a travel document „by any means“ without the citizen's consent — so not even a photo on your phone; the fine is again up to CZK 10,000 (§ 34a (1) (i)). That act applies to Czech travel documents — for foreign nationals' passports the GDPR itself leads to the same conclusion: you have no legal ground for a copy.

The law says „without the holder's consent“ and some read that as „if the guest agrees, I may“. You may not: you have no legal ground for a copy, and consent conditional on being accommodated is not freely given. In practice — do not copy, do not photograph. You look into the document, write down the number and type and hand it back; the Data Protection Authority does not regard mere inspection as processing.

Do not ask for a birth number at all: only its holder may deal with it, otherwise it may be used only in the cases under § 13c of Act no. 133/2000 Coll. — and the guest register does not require it, since 2020 the date of birth is entered.

The duty to inform: what the guest must know

Under Article 13 (1) GDPR the information is provided „at the time when personal data are obtained“ — that is, when the guest is filling in the form, with an online check-in before it is submitted. Not when you hand over the keys. Data you already have from the booking (name, e-mail, telephone) is covered by the information given at the booking or in the confirmation.

The content of Article 13 is longer than people expect. It includes:

• who you are (name or company, IČO) and how to contact you,
• the purposes of the processing and the legal basis for each of them — statutory records (§ 3g of Act no. 565/1990 Coll., §§ 101–102 of Act no. 326/1999 Coll.) and performance of the accommodation contract,
• the recipients or their categories: the municipality as the administrator of the stay fee, the Czech Police for foreign nationals, your software provider as a processor,
• the storage period — 6 years from the day of the last entry,
• the guest's rights: access, rectification, erasure, restriction of processing, objection,
• the right to lodge a complaint with the Data Protection Authority,
• that providing the data is a statutory requirement, and the consequences if the guest does not provide it,
• any transfer outside the EU and the safeguards that apply to it.

It does not all have to be at the form: the GDPR allows a layered approach — a short paragraph at the check-in plus the full text on your website or behind a QR code. There is a single condition: the short version must genuinely link to the full one.

Security, deadlines and a data breach

The six years do not run from the guest's stay: the law says „for a period of 6 years from the day the last entry was made“ (§ 3g (4) of the Act on Local Fees). With a register kept continuously you therefore hold the oldest entries substantially longer than 6 years after check-out. The house book has the same rule (§ 101 (4) of the Act on the Residence of Foreign Nationals); the paper documents that replace it are kept for 6 years from the end of the foreign national's accommodation, and a retained registration form for 6 years from the accommodation of the foreign national (§ 102 (4)).

The specific archiving periods that most often apply to a host:

• Financial statements and the annual report — 10 years beginning at the end of the accounting period they relate to (§ 31 (2) (a) of Act no. 563/1991 Coll., on accounting).
• Accounting documents, accounting books, depreciation plans, inventory lists, the chart of accounts and summaries — 5 years beginning at the end of the accounting period they relate to (§ 31 (2) (b) of the same Act).
• Tax documents, if you are a VAT payer — 10 years from the end of the tax period in which the supply took place (§ 35 (2) of Act no. 235/2004 Coll., on value added tax).
• Documents on the basis of which social security contributions are assessed and paid — 10 calendar years following the year they relate to (§ 22c of Act no. 589/1992 Coll.); this concerns you only if you have employees.
• If instead of accounts you keep only tax records, follow the tax assessment period: it is 3 years, it is extended by 1 year if one of the facts under § 148 (2) of the Tax Code occurs in the last 12 months before it ends, and it ends at the latest 10 years after it began (§ 148 (1) and (5) of Act no. 280/2009 Coll.). So in practice keep the documents for a given year for 10 years.

Where several regulations apply to a single document, the longer period prevails: if you use an accounting record for tax proceedings or for social security as well, § 32 (1) of the Act on Accounting requires you to keep it even after the period under § 31 has expired. In practice: you do not delete an invoice bearing a guest's name from 2026 at the end of 2031 just because „accounting documents are five years“ — if it carries VAT, the period runs until the end of 2036.

The practical security minimum (Article 5 (1) (f), Article 25 and Article 32 GDPR):

• Access only for whoever needs it for their work. The cleaner needs the dates and possibly the name, not the document number or the date of birth. → Cleaning without phone calls: your cleaner's own portal
• Backed-up records with controlled access are safer than a notebook in the flat or a spreadsheet on an unlocked laptop.
• Do not forward guest data by ordinary e-mail or messenger — after six years you will not be able to delete copies you do not know about.

When data leaks (a lost notebook, a hacked e-mail, a spreadsheet sent by mistake), Article 33 (1) GDPR applies: report it to the Data Protection Authority without undue delay and, where feasible, within 72 hours of the moment you became aware of the breach — the deadline runs from discovery, not from the event. It is not reported only where the breach is unlikely to result in a risk to guests' rights and freedoms; a lost notebook with document numbers typically does pose one. If you report later you state the reasons for the delay.

Two things people forget: where the risk is high you must also inform the guests themselves without undue delay (Article 34 (1)), and you must document all breaches, including the unreported ones (Article 33 (5)). The Authority's channels: the form „Notification of a personal data breach under the GDPR“ at uoou.gov.cz, data box qkbaa2n, posta@uoou.gov.cz, or by post to Pplk. Sochora 27, 170 00 Praha 7. → Data box: 20 minutes that save you years of trudging between offices

Processors and controllers: who holds the data for you

If you use software (such as ours), its operator is your PROCESSOR — it processes guest data for you and on your documented instructions (Article 4 (8) and Article 28 (3) (a) GDPR). For that the GDPR requires a contract with the elements under Article 28 (3) (a) to (h): instructions, confidentiality, security, sub-processors, cooperation on guests' rights, incident reporting, erasure or return of the data at the end, audits. Written form includes electronic form (Article 28 (9)), so the contract may be part of the terms and conditions — with us it is. You remain the controller and you bear responsibility for compliance (Article 5 (2), Article 24).

Airbnb and Booking.com, by contrast, are NOT your processors. Airbnb passes data to hosts as one independent controller to another; you are therefore an independent controller with your own duties. Two things follow: you may not use data from the platform for another purpose without your own legal ground (typically building a marketing database out of it), and the platform will not meet your statutory record-keeping duty for you.

If you use tools with data outside the EU, you must state that to guests under Article 13 (1) (f) and know the safeguards for the transfer (Article 44 et seq.); an overview of where the data is stored is in our documentation.

Guests' rights — and their limits

A guest may ask what you hold about them (Article 15) and request the correction of an error (Article 16). You must reply without undue delay and at the latest within 1 month of receiving the request (Article 12 (3)); for complex or numerous requests the period may be extended by a further 2 months, but you must inform them of the extension within the first month. Handling is free of charge (Article 12 (5)); where you have reasonable doubts about the identity of the applicant you may request additional information (Article 12 (6)).

A REFUSAL must also be communicated within 1 month, with reasons and with information that the guest may lodge a complaint with the Data Protection Authority (Article 12 (4)). Silence is a breach in itself.

And a limit worth knowing by heart: „delete me“ does not apply to statutory records. The right to erasure does not apply where the processing is necessary for compliance with a legal obligation (Article 17 (3) (b)) — and both the guest register and the house book are held by law for 6 years from the last entry. So you explain that to the guest and cite the act. Erasure applies only to what you process beyond the statutory scope: a marketing contact, notes, photos.

Marketing: when you may write to former guests

You may send a former guest an offer of your own similar services even WITHOUT consent — under the opt-out regime of § 7 (3) of Act no. 480/2004 Coll. There are three conditions: you obtained the e-mail in connection with providing the service, you offer only your own similar services, and the guest had a clear and free opportunity to refuse both when the contact was obtained and in every further message. The GDPR ground is then a legitimate interest with the right to object (Article 21 (2) and (3)).

You need consent (opt-in under § 7 (2)) only where the other party is not your customer — with enquirers who never booked in the end — and for offers of other people's services.

Under § 7 (4) every commercial communication must be clearly marked as a commercial communication, it must be clear who the sender is, and it must contain a valid address for refusal. Supervision is again exercised by the Data Protection Authority. When a guest unsubscribes, stop sending and delete or block the contact for marketing — this does not concern the guest register.

The paperwork to have: the record of processing activities

An impact assessment (a DPIA under Article 35) and internal policies are not required for ordinary guest records. A record of processing activities under Article 30 (1), however, is — and it is the most common formal gap among small hosts. The exemption for entities with under 250 employees (Article 30 (5)) does not apply where „the processing is not occasional“, and guest records are not occasional: you keep them regularly, all year round.

The interpretation is not uniform here — the Data Protection Authority illustrates the exemption with a small tradesperson holding a client list. We recommend not relying on it: a one-page record is the cheapest proof of compliance you can have at an inspection. It is enough to write in it the purpose (statutory records, performance of the contract), the legal basis, the categories of data subjects and data, the recipients (the municipality, the Czech Police, the software provider), the storage period and who has access. A controller must be able to demonstrate compliance (Article 5 (2), Article 24) — and „I know it by heart“ cannot be demonstrated.

Cameras at the entrance

A camera is separate processing with its own rules. They follow from the GDPR; a practical guide is the Data Protection Authority's methodology on the design and operation of camera systems of 8 February 2024 — it is not legally binding, it is based on the GDPR and on EDPB Guidelines 3/2019, and it is written for small operators too.

• The ground is usually a legitimate interest (Article 6 (1) (f)) supported by a balancing test — write it in advance, not at the inspection.
• The information notice belongs before you enter the frame; the details may be layered.
• Retention period: under the methodology a period of up to 72 hours should suffice in most cases, and for a longer period the controller must state clear reasons why it is necessary.
• Documentation: the record of processing activities (Article 30), the balancing test and a consideration of whether a DPIA duty arises.
• Inside the rented flat cameras have no place. In an apartment building you must also respect the owners' association rules for common areas — discuss any view into them with the association in advance.

What is coming

Regulation (EU) 2024/1028 on the collection and sharing of short-term rental data applies, under its Article 19, from 20 May 2026. The registration procedure for hosts in it, however, is conditional, not mandatory: a member state introduces it if it requires online platforms to pass data on (Article 4 (2)). Czechia has no such procedure — the bill (parliamentary print 761) never reached its third reading and fell with the end of the electoral term. On 12 August 2026 the Ministry for Regional Development presented eTurista to the Business Council as a central register operating from 2027.

In practice: as of September 2026 no registration of hosts and no registration number for listings exists in Czechia. The guest register, the house book and the reporting of foreign nationals through UbyPort within 3 working days apply unchanged. The dates 1 July 2026, 1 October 2026 and 1 January 2027 circulating in commercial articles come from a discarded bill. When eTurista does arrive, a new recipient of data will be added — and with it a line in the information for guests. → UbyPort without the stress: how to report foreign guests to the foreign police correctly

What you risk: fines in practice

The GDPR has two upper limits. Up to EUR 10,000,000 or 2 % of total annual turnover (whichever is higher) punishes breaches of a controller's and processor's duties — security, records, incident reporting, processor agreements (Article 83 (4)). Up to EUR 20,000,000 or 4 % of turnover covers breaches of the principles, a missing legal ground and breaches of guests' rights (Article 83 (5)).

For 2025 the Data Protection Authority imposed 7 fines totalling CZK 14,671,000 (out of 23 proceedings opened); among them CZK 96,000 for processing a name, surname and telephone number without a legal ground and CZK 7,500,000 for handling birth numbers. The number of submissions grew by 68 % year on year — the most since the GDPR took effect.

The most common mistakes and myths

• „Without the guest's consent I may not record their data.“ — On the contrary: you must record it by law and consent is beside the point. Spare yourself the checkbox for statutory records.
• „If the guest signs a consent, I can photograph their passport.“ — Consent conditional on being accommodated is not freely given and you have no legal ground for a copy: by storing a copy you breach minimisation (dealt with by the Data Protection Authority) and, without demonstrably free consent, the ban on copying the document as well (a fine of up to CZK 10,000).
• „A newsletter to former guests needs consent.“ — It does not, if it concerns your own similar services and every message carries a free unsubscribe option (§ 7 (3) of Act no. 480/2004 Coll.).
• „I delete the data 6 years after the guest leaves.“ — The period runs 6 years from the day of the last entry in the register, not from the stay; deleting „6 years after check-out“ contradicts § 3g (4).
• „Airbnb is my processor, it will handle it for me.“ — Airbnb is an independent controller; it will not keep the guest register, report to the police or pay the municipal fee for you.
• „A small host needs no documentation.“ — No DPIA and no policies, but a record of processing activities yes: the exemption for companies with under 250 employees applies only to occasional processing.
• „I'll report the breach once I have investigated it.“ — The 72-hour deadline runs from the moment you became aware of the breach; a late report must be justified.
• „I'd rather keep the records forever, to have them at hand.“ — Once the period expires the legal ground falls away and holding the data any longer is a breach in itself (Article 5 (1) (e) GDPR).

Frequently asked questions

Updated: 5 September 2026, verified against the sources listed above. This is informational text, not legal or tax advice — consult a professional about your specific situation.