GDPR for Vacation Rentals: A Practical Guide

Every host collects personal data: names, phone numbers, often passport or ID scans required by law. Under the GDPR you are the data controller for that information, which means you decide why it is collected and you answer for how it is kept. Here is what that means in practice.

What guest data you handle

• Identity: name, date of birth, nationality, and in many countries an identity document.
• Contact details: email and phone.
• Stay details: dates, number of guests, booking channel.
• Payment data: usually handled by the platform or your payment provider. Avoid ever storing card numbers yourself.

The legal basis for each piece

• Legal obligation: guest registration required by law (for example the Italian police registration, or proof of age for a tourist-tax exemption).
• Contract: the data you need to deliver the stay.
• Consent: marketing messages, and only with a clear opt-in.

Collect what the law and the stay require, nothing more. If the registry needs a document number, you do not also need a copy of the guest's driving licence "just in case".

How long to keep it

Set a retention period for each kind of data, based on the law that requires it, and delete or anonymise the data when it ends. Keeping guest documents forever is the most common GDPR mistake in short-term rentals.

Storing identity documents safely

• Not in email or WhatsApp chats, and not in a shared folder on your phone.
• In one place with access control, where only you (and people you authorise) can see them.
• With a record of who looked at what.

Guests' rights

Guests can ask to see their data, correct it, have it deleted when no legal obligation requires you to keep it, and receive a copy. Have a simple way to export one guest's records and to delete them.

Common mistakes

1. Keeping documents indefinitely.

2. Collecting documents through chat apps.

3. No privacy notice for guests.

4. Sharing guest lists with cleaners or partners who do not need them.

5. No way to answer a guest who asks what you hold about them.

How EasyRentFlow helps

• Online guest registration: guests enter their details and upload their documents through a secure link, after accepting a privacy notice. You review and approve each document; the guest is emailed the outcome.

• A separate guest database per account, with encrypted documents and an audit log of access.
• Retention dates and automatic anonymisation when the retention period ends.
• Exports of the guest registry (with or without document numbers) and a complete export of your account under GDPR Art. 20, plus a Data Processing Agreement.

• No card data: payments go through your own payment provider.

See the guest registry features.

General information, not legal advice. Retention rules depend on your country's law.