Hotel receptions all over Europe copy passports. That's why plenty of hosts think a photo of the document is standard and that without it they're not “covered”. It's the other way around. Czech law wants the details from the document, not the document itself. Copying a Czech ID card without demonstrably freely given consent is an offense with a fine of up to CZK 10,000, and at the same time a breach of the GDPR data minimization principle, which is dealt with by the Úřad pro ochranu osobních údajů (Office for Personal Data Protection, ÚOOÚ).

And consent along the lines of “otherwise I won't let you stay” isn't freely given.

Rule 1: you know why you collect each piece of data

You don't process guests' data because the guest allowed you to, but because the law requires you to. The evidenční kniha (guest register) for the municipality and the domovní kniha (house book) for the police are legal obligations. The legal basis is compliance with a legal obligation, not consent. A checkbox saying “I consent to the processing of my personal data” in the check-in therefore adds nothing — it just gives the impression that the guest can say no. They can't.

You'd only need consent for something extra: for example, using a guest's photo in your marketing. A newsletter to former guests about your own similar services is fine even without consent, as long as every message includes a free unsubscribe option.

Rule 2: you don't collect anything extra

What you may record: what the guest register and the registration form require. First name, surname, date of birth, citizenship, address, number and type of document, visa number, purpose and length of stay. What you may not: a copy or photo of the document, the Czech personal identification number, anything “just in case”.

The practical consequence for the cleaning team's portal, shared spreadsheets and group chats: the cleaning team sees the dates and the name, not document numbers. The Airbnb iCal calendar link contains the last four digits of the guest's phone number, so it doesn't belong in a group chat.

Rule 3: you tell guests in advance

The information about who processes the data, why, for how long and what rights guests have is given to the guest when the data is collected. That means in the check-in form, before it's submitted. Not at the door and not only on request. You deal with a guest's request for access to their data within 1 month.

Rule 4: after the retention period, you delete the data

You keep both registers for 6 years from the date of the last entry. After that, the legal basis ends and keeping the data any longer is a breach in itself. Watch out for two traps: the period doesn't run from the guest's departure but from the last entry in the register; and accounting documents have their own retention periods, so an invoice with the guest's name is assessed separately.

What if data leaks

You report a breach that poses a risk to guests to the ÚOOÚ within 72 hours of the moment you learned about it. Not after you've finished investigating. The most common real-world leak for small hosts isn't a hacker but a lost phone with photos of passports in the gallery. Anyone who doesn't photograph documents doesn't have this problem.

Small hosts and documentation

You don't need a data protection impact assessment or a data protection officer. You do need a record of processing activities — the exemption for companies with fewer than 250 employees applies only to occasional processing, and keeping guest records isn't occasional. It's one page: what data, why, who it's passed on to, for how long.

How I've solved it

The guest fills in their details themselves on their phone; at the door I just compare them with the document and don't photograph anything. The information about processing is part of the form. The cleaning team has its own portal without guests' personal data. Data is anonymized automatically once the retention period expires. A guest's request for a copy of their data is then a matter of a minute.