Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Italian DPA July 14, 2026 3 min

Italian DPA to hoteliers: do not keep copies of guests' ID documents

Once guest data is sent to the police portal, document copies must be destroyed or deleted. What changes for hotels, B&Bs and short-term rentals

TL;DR for the DPO

Identifying the guest is a legal duty; KEEPING a copy of the document is not. After transmitting data via the police portal, copies (scans, photos, photocopies) must be destroyed or deleted. Retaining them breaches minimisation and storage limitation (Art. 5 GDPR).

The three points that matter

  • Identifying does not mean archiving: the host must verify identity and transmit the data, not build an archive of ID documents. The 'just in case' photocopy is exactly the practice being challenged.
  • The risk is twofold: a GDPR sanction for unlawful retention and, in case of a breach, an archive of ID documents is the perfect target for identity theft - triggering notification and communication duties.
  • It applies across hospitality: hotels, B&Bs, guesthouses, short-term rentals and the property-management systems used for online check-in, which often store scans by default.

What to do now, in practice

For hospitality clients: 1) review the check-in flow (physical and online): if documents are photocopied or scanned, change the procedure now; 2) clean up the existing archive with documented deletion; 3) check PMS/channel-manager settings (many keep scans: disable it or set automatic deletion); 4) update the privacy notice and the Art. 30 record with the real retention period.

Why it matters for your clients

It is the classic case of 'we have always done it this way' meeting the GDPR: the photocopy at the front desk is a deep-rooted habit that now has an explicit pronouncement against it. For a DPO with tourism clients it is a quick, concrete win that owners immediately understand.

Official source:Italian Data Protection Authority - notice to hoteliers on retention of guests' documents

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Italian DPA
29.10the day the time runs out to fix the pixels in your emails

The invisible pixel in the newsletter: time runs out on 29 October

By decision no. 284 of 17 April 2026, published in the Official Gazette no. 98 of 29 April, the Italian data protection authority set out the rules for tracking pixels in email and allowed six months to comply: the deadline is 29 October 2026. Individual open-tracking for marketing purposes requires the recipient's consent, subject to exceptions. Compliance checks are part of the inspection plan for the second half of the year. For a DPO the point is not a prohibition — there is none — but that a processing operation taken for granted for twenty years now needs a basis, a notice and a way to switch it off on its own.

Oct 16, 2026New 7 min
Italian DPA
€39kfor a refused access to GPS data

Italian DPA fines security firm €39,000: company-car GPS data withheld from a former employee

A dismissed guard asks for the data from the GPS fitted to his company car to defend himself in disciplinary proceedings. The company neither hands it over nor explains why. The Garante fines La Patria S.p.A. of Bologna and restates a rule many forget: a refusal must be reasoned too.

Sep 30, 2026New 5 min
Italian DPA
12keuro

Misconfigured document register: 12,000 euro fine for the Metropolitan City of Sassari

Following a data breach notification and a complaint, the Italian data protection authority fined the Metropolitan City of Sassari for misconfiguring its electronic document register, making documents containing personal data accessible to staff who, given their role and duties, were not authorised to process them. The fine is 12,000 euro, but the principle applies to every public body and every company running a document management system: filing is not a neutral activity, and a default of total visibility breaches the principles of integrity and confidentiality.

Jul 29, 2026 6 min