Guest data: Regi never asks for a copy of the ID

To register a guest you do not need a copy of their ID. The Spanish data protection authority (AEPD) says so plainly: asking for one breaks the GDPR. It is enough for the person to give you the data the law requires.

Regi’s check-in works that way. The guest types their details and signs on their own phone. There is no step for photographing or uploading the document.

This version of the article corrects the previous one, which said the guest uploaded their document and that Regi archived those documents. The product has never done that. The text was wrong, and what follows is the real flow.

The AEPD is blunt: do not ask for a copy of the ID

The agency published a note on this on 17 June 2025. Its conclusion is short: asking for a copy of an ID card or passport in order to comply with Real Decreto 933/2021 (the Spanish royal decree on traveller registration) breaches the data minimisation principle. Minimisation means collecting only what is needed and nothing else.

The agency gives four reasons, and all four are easy to follow:

The document carries more data than the rules ask for. The photo, the expiry date, the CAN number and the parents’ names too. None of that goes into the report.
Keeping the copy creates a risk you did not have to take. If that image leaks, it is enough to impersonate the person.
The document alone does not hold every field of the report. You would still be missing data, so the copy saves you no work.
A copy does not prove who sent it. Receiving a photo of a passport does not show that its holder sent it to you.

That last point is the one that surprises people. Many hosts ask for the copy believing it protects them. The agency argues the opposite: for the purpose of the rule, which is public safety, an image sent over the internet verifies nothing with certainty.

How to identify the guest without a copy

The AEPD takes the view that a form collecting only the data the royal decree requires can be enough. That form can be filled in at the property or online.

What remains is checking that the data is true. The agency describes two situations:

If the guest arrives in person, it can be enough to look at their document and check it matches what they wrote. Look at it, do not photocopy it.
If check-in happens remotely, it names digital certificates, matching the data against the payment method used, or sending a code to the guest’s phone or email.

Diagram: the guest fills the form and, if they arrive in person, you look at their document; if not, a code goes to their phone or email. — The guest always fills the form. What changes is how you check their data.

One important caveat here. None of those routes is a safe harbour that always works. The agency itself says other valid procedures may exist and that the controller must assess their own. The controller is you, the property owner.

What the guest types in Regi, and what they do not

The guest opens a check-in link that identifies the property and fills in a form on their phone. They type:

The document type and its number, plus the support number when it is a DNI or NIE (the Spanish ID and foreigner ID cards).
Their name, surnames, date of birth, sex and nationality.
Their address: country, town, postcode and street.
A phone number or an email address.
Their signature, drawn on screen.

Travellers under 14 skip the document and signature steps, which do not apply to them.

What is not in that form is an upload button, a camera, or any automatic reading of the document. The step does not exist. What travels to SES.Hospedajes (the national police reporting platform) is those typed fields, as a data file: neither the document nor the signature leaves with it.

The form is available in seven languages (Spanish, English, German, French, Dutch, Czech and Polish), saves the draft step by step in case the guest is interrupted, and ends with a PDF receipt. We cover the arrival experience in how to make online check-in faster.

What is stored, and for how long

The signature is the only image of the guest in the system. It is stored on AWS, is only read from your account, and appears in the report PDF, which is what the rules ask it for.

The report data deletes itself. A weekly task removes reports whose check-out date is more than three years old, along with the travellers and submissions attached to them. Unfinished check-in drafts are deleted too.

Three years is the registration period, not “forever”. Keeping less leaves you without a backup if you are asked about a past stay. Keeping more is not compliance either.

The three-year rule does not apply to everyone

There is an exception worth knowing. Article 5.4 of the royal decree exempts anyone running accommodation on a non-professional basis from the registration and retention duties. That person still has to report the data, but does not have to keep it for three years.

The exception is narrower than it sounds, and it is not a label you can simply claim. We explain it in detail in the traveller register and the parte de entrada. If you think it covers you, confirm it before deciding what to keep.

You are the controller; Regi is your processor

This distinction looks bureaucratic and it is the one that orders everything else.

You are the data controller. You decide why you collect the data and by what means. The duty to register and report is yours, not your supplier’s.

Regi is a processor. It handles that data following your instructions and cannot repurpose it. That relationship is signed in writing, in the data processing agreement.

The Ministry of the Interior receives the data because a law says so. Its files are its own and follow their own rules, not your contract with us.

One nuance that often gets muddled: Regi filing reports in your name is a matter of representation before the authorities, and that is a different thing from the processing agreement. That is why the guided sign-up asks which case applies to you first, instead of assuming you want to delegate, and spells out what that representation means before you accept it.

What to look for in any supplier’s contract

Whatever tool you use, the processing agreement has to say these things. It is a short list and you can check it in one sitting.

What it processes, why, and for how long.
Which data, and about which people.
That it acts only on your instructions.
That its staff are bound by confidentiality.
Which security measures it applies.
Which other companies work underneath it, and how you are told if they change.
How it helps you if a guest exercises their rights or if there is a breach.
What happens to the data once you stop being a customer.

Loose lines about encryption or where the servers sit are not a substitute for that contract.

Where the risk actually sits

In practice, privacy problems in tourist accommodation almost never come from the software. They come from three habits:

Collecting more than needed. Photographing an entire passport “just in case” is exactly what the AEPD advises against.
Storing it in the wrong place. A drawer of photocopies, a folder on the desktop, a phone album that syncs to a personal cloud account.
Moving documents through open channels. Forwarding a guest’s ID over WhatsApp to the cleaning company or an accountant. That file is no longer under your control.

This is where it pays to be specific, because “we respect your privacy” means nothing on its own. These are the decisions that are built in:

Website analytics wait for consent. Regi uses PostHog, but capture does not start by default: it switches on when the visitor accepts.
Events from before consent are held in memory. If the visitor accepts, they are sent. If they refuse, they are discarded. There is no provisional collection legitimised afterwards.
Cookies are stripped before anything is forwarded to PostHog or Sentry.
With your consent, analytics are tied to your host account: internal id, email, name, subscription status and whether you finished onboarding. That is your data, not your guests’, and it stops being sent if you withdraw consent in the preferences.
Two things leave the server without waiting for consent. One is a single event when an account is created, carrying the internal id and, if you arrived from one of our emails, that link’s identifiers: no name, no email, no phone, and there is a toggle to switch it off. The other is a set of signals about how a check-in is progressing (how many travellers, dates, whether it completed) that carry nobody’s name, document or contact details.

The boundary that matters: your guests’ data lives in the registration circuit and never enters analytics. Product analytics is a separate circuit and it deals with you, the host. They are not the same system and they do not cross over.

What is still on you

Whatever tool you pick, some habits depend on you:

Stop asking for copies of the document. It is the change with the biggest effect, and the one the AEPD asks for. How to check the document without copying it, and what to do with copies you already keep, is in copying a guest’s passport or ID: what the law says.
Do not collect fields you are not required to collect. Each extra one is information to safeguard for no reason.
Do not forward guest data through messaging apps. Not to the cleaning team, not to a partner, not to yourself.
Inform the guest when you ask for the data. Who you are, what it is for, who it goes to and how long you keep it. Informing is not asking permission: the report is a legal duty and is not consented to.
Review who has access if you share the dashboard with a co-host or a management company.

Where Regi ends and you begin

Worth saying plainly: Regi does not replace your own data protection obligations. You remain the controller in your business, and that involves things no tool can do for you. Informing your guests, keeping your documentation in order, handling their rights requests and controlling who you grant access to.

What Regi does do is stop the technical side from being something you improvise. The rest depends on your situation. This article describes how a product works and it is not legal advice.

Frequently asked questions

Can I ask a guest for a copy of their ID card or passport? According to the AEPD, no. Its June 2025 note says requesting that copy breaches the minimisation principle and amounts to excessive processing. What you can do is ask them to fill in a form with the data the rules require.

Then how do I check the guest is who they say they are? If they arrive in person, by looking at their document and checking it matches what they wrote. If check-in is remote, the AEPD names digital certificates, matching against the payment method, and codes sent to a phone or email. No route works for every case: assessing yours is your job.

Does Regi store any image of my guest? Only their signature, because the parte de entrada (the entry report) needs it. There is no photo of the document, because the form never asks for one.

How long must traveller data be kept? Three years from the end of the service, if you keep the computerised register the rules require. Article 5.4 exempts non-professional accommodation from that register, though the duty to report remains. Confirm which case is yours before deciding.

Do Regi’s analytics use my guests’ data? No. Traveller data lives in the registration circuit and does not enter analytics. What analytics does handle is your host data, and only if you accept.

Details and sources

The AEPD’s exact wording. The note, dated 17 June 2025, says: “Solicitar una copia del Documento Nacional de Identidad o del Pasaporte vulnera el principio de minimización de datos, establecido en el artículo 5.1.c) del RGPD, y supone un tratamiento excesivo de datos” (requesting a copy of the ID card or passport breaches the data minimisation principle in article 5.1.c of the GDPR and amounts to excessive processing). On verification it adds that sending a copy of the document “no permite verificar con certeza la identidad de la persona” (does not allow the person’s identity to be verified with certainty).

The form as the alternative. The same note takes the view that it “podría ser suficiente” (could be enough) for people to complete a form collecting exclusively the data required in sections A.3, A.4, B.3 and B.4 of annex I of the royal decree, online or in person.

The closing caveat. The AEPD “no descarta que puedan existir otros procedimientos válidos” (does not rule out other valid procedures), and states that their compatibility with the GDPR must be assessed in every case by the controller.

The three years and the exception. Article 5.3 of RD 933/2021 sets out that the computerised register’s data must be kept for three years from the end of the service. Article 5.4 exempts those running accommodation on a non-professional basis from the documentary registration and retention duties, leaving them subject only to the reporting duties.

Sources: