Copying a guest's passport or ID in Spain: what the law says

Don’t scan or photocopy your guests’ passports or ID cards in Spain. Don’t ask them for a photo of it either. Spain’s data protection agency, the AEPD, says that collects more data than you need.

What you do need is the guest’s details for the registration form, and a look at their document. This guide shows how to check it in person and remotely, and what to do with the copies you already have.

The short answer: don’t ask for a copy

Many hosts ask for a photo of the passport out of habit. They think it makes them safer. It doesn’t.

The AEPD (Agencia Española de Protección de Datos) explained why in a note dated 17 June 2025. Asking for a copy of an ID card or passport is excessive processing of personal data. It gives four reasons:

A copy shows data nobody asked for. The photo, the expiry date or the holder’s parents’ names are not part of the registration form.
A stored copy can be stolen. Someone could use it to pretend to be your guest.
A copy isn’t enough. A Spanish ID card doesn’t carry every detail the form needs, such as a phone number or email. You still have to fill in the form.
A photo doesn’t prove who sent it. Receiving an image of a passport doesn’t show that its owner sent it.

The rule is the same whether you run a holiday flat, a rural house or a hostel.

What the law does ask: details and a look

Spain’s guest registration rule is Real Decreto 933/2021, the royal decree behind the “parte de viajeros” (the guest registration form). It asks for two things:

Collect each guest’s details. Everyone aged 14 or over signs their form.
Check the details match their document. The guest shows it to you.

Showing is not handing over. Looking at the document meets the rule, and the rule never asks you to keep a copy.

The full list of fields is in what guest details to collect for the registration form. How the form reaches the police is in the guest registration guide.

How to check the document without copying it

It depends on one thing: whether you see the guest when they arrive.

Diagram: the guest fills in the form. If you meet them, you look at their document. If not, you send a code to their phone or email. Neither path keeps a copy. — With the guest in front of you, looking at the document is enough. Remotely, a code to their phone or email. Neither path needs a copy.

If they arrive in person

Ask them to show their passport or ID card. Compare it with what they typed: name, document number and date of birth. If everything matches, hand it back. That’s all.

An example. Lucía welcomes a couple to her flat in Valencia. Both filled in the form on their phones. When she hands over the keys, she glances at their passports and gives them back. She’s done.

If you never meet them

This happens with key boxes or keypad entry. The AEPD suggests three ways to check the details remotely:

A security code sent to the guest’s phone or email. You already collect both for the form.
Matching the details to the payment. This works for the person who paid, not for the people travelling with them.
A digital certificate, if the guest has one. Few foreign guests will.

The AEPD says other methods may also be valid. Pick one that fits your property, and be ready to explain why it respects data protection law.

If you haven’t chosen how to collect details before arrival, what to look for in a check-in app lists the six things worth checking.

What happens if you keep copies

Keeping copies cost a hotel in Mallorca a €30,000 fine from the AEPD. The hotel scanned each guest’s full passport at check-in. Staff then used the guest’s photo to recognise them around the hotel.

A Dutch guest complained. The AEPD found the hotel had no legal basis to use that photo. In March 2024, Spain’s National High Court (Audiencia Nacional) upheld the breach and cut the fine to €15,000.

That was a large hotel, but the same rule applies to a holiday flat. And the fine isn’t the only risk. A folder of passports on your phone, in your email or in a chat is exactly what identity thieves look for. If it leaks, you are the one responsible.

What to do if you already keep copies

Stop asking for them today. Remove the request from your automated messages, house rules and listing.
Check your register. Each guest’s details should be in your guest register, not only in the photo.
Delete the copies. Check your phone, email, chats, cloud storage and bin. Shred paper copies.
Check your tools. If your check-in form asks for a photo of the document, ask the provider why and where they store it.

The registration forms themselves are kept: three years from the end of the stay, then deleted. The guest register and registration form guide explains it.

Airbnb verifies guests, but not for you

Airbnb asks some guests for an ID to verify who they are. That check belongs to Airbnb. Its help centre says the ID and selfie are not shared with hosts.

So Airbnb’s check doesn’t replace your guest registration. You still collect the details and look at the document. And Airbnb checking IDs doesn’t give you permission to ask for a photo yourself.

If you’re the guest and they ask for a photo

In Spain, a hotel or host can ask for your details and ask to see your passport or ID. That is legal, and they have to. What they don’t need is a copy or a photo.

If they ask for one, say you’d rather show the document and fill in the form. You can point to the AEPD’s June 2025 note. If they still insist, you can file a complaint with the AEPD.

Frequently asked questions

Is it legal to scan a guest’s passport in Spain? You don’t need to for guest registration, and the AEPD considers it excessive. Collect the details in a form and look at the document.

What if a guest sends me a photo without being asked? Don’t keep it. Copy the details you need into the form and delete the image, from the chat and the bin too.

Can I keep a passport photo to prevent fraud? It’s a bad idea. The hotel fined in Mallorca used the photo to recognise its guests, and the fine still stood in court.

What happens if I don’t check the document? You are responsible for the details on the form being accurate. A mistyped number can get the form rejected by SES.Hospedajes, the Interior Ministry’s system that receives it. The most common rejections are in SES.Hospedajes errors.

Can a check-in app ask for a photo of the document? Many do. The AEPD note makes no difference between paper, email or an app: a copy is still more than you need. Always ask what the app stores and for how long.

Details and sources

The AEPD note. Dated 17 June 2025. It says that asking for a copy of the ID card or passport “vulnera el principio de minimización de datos, establecido en el artículo 5.1.c) del RGPD” (breaches the data minimisation principle in Article 5(1)(c) GDPR) and is excessive processing. It adds that the Spanish ID card does not contain all the data required by Annex I of Real Decreto 933/2021, and that sending a copy does not verify the person’s identity with certainty. It considers that a form with only the data in sections A.3 and B.3 of Annex I “could be enough”, online or at the property. In person, a visual check of the document “could be enough”. For online collection it cites digital certificates, matching against the payment method and security codes sent by phone or email, and does not rule out other methods, whose compliance with the GDPR the data controller must assess.

Real Decreto 933/2021. Article 4.2 requires everyone over fourteen to sign the form. Article 4.3 makes the property responsible for the accuracy of the details, which must match the identity documents that guests “show or provide”. Article 5.3 sets a three-year retention period from the end of the stay. Non-professional hosts are exempt from keeping the register but must still send the details (Article 5.4).

The Mallorca fine. AEPD case PS/00078/2021 against Marins Playa, S.A., for breaching Article 6 GDPR (processing without a legal basis): a €30,000 fine and an order to fix its guest registration within a month. The hotel argued legitimate interest for using the photo; the AEPD rejected it. The Audiencia Nacional, in a judgment of 18 March 2024 (appeal 710/2022), upheld the breach and set the fine at €15,000 because some aggravating factors did not apply.