Short answer: no. The Spanish guest registration rules ask you to record your guests' details, such as their name and document number. They do not ask you to keep a photo or photocopy of the passport. Many hosts still photograph every document "to be safe", but that creates a pile of the most sensitive data you hold.
This article is practical guidance, not legal advice.
What the rules ask you to record
Real Decreto 933/2021 lists the data you record for each guest in its annex I: name and surnames, sex, nationality, date of birth, document type and number, address, contact details, and details of the stay and payment. Guests aged 14 or over sign their registration (article 4). You keep the register for three years from the end of the stay (article 5.3).
What the annex lists are data fields. Recording the document number is required; keeping a picture of the document is a separate choice. For the full list of fields, see what guest data you must collect.
Why fewer copies is the safer choice
The GDPR asks you to collect only the data you need for the purpose and to keep it no longer than necessary (GDPR, article 5). A passport photo contains much more than the register needs: the photo of the person, their signature, other numbers. It is exactly what an identity thief wants if your inbox, phone or shared drive is compromised.
The Spanish data protection authority, the AEPD, publishes guidance for businesses on data protection if you want to read further.
Where copies pile up without you noticing
- WhatsApp chats where guests sent a photo of their passport.
- Email attachments, and the downloads folder of the computer that opened them.
- Your phone's photo gallery, and its automatic cloud backup.
- Shared folders with the cleaner or co-host.
- Printed copies in a drawer at the property.
A routine that keeps what you need, and only that
- Collect the fields, not the picture. Ask guests to fill in a registration form before arrival instead of sending a photo.
- Check the document in person, don't copy it. At the door, compare the document with the details on file. If something differs, correct the field.
- Delete the side copies. Once the details are in the register, delete passport photos from chats, email, your gallery and its backup.
- Keep the register for three years, then delete it. Put a recurring reminder in your calendar, or use a tool that does it.
- Limit who can see guest data. Remove access for people who no longer work with you.
Example
Example data. A guest sends a photo of their passport on WhatsApp before arrival. You thank them and send the registration form instead, which takes two minutes. When they have completed it, you delete the photo from the chat, from your phone's gallery and from the cloud backup. The register now holds the fields the decree lists, and no image.
What about scanning a document to fill in the form?
Reading a document with a phone camera to fill in the fields is a convenience, not a copy, as long as the image is discarded once the fields are read. If a tool keeps the image, it is a copy, and the same questions apply: why you keep it, for how long, and who can see it.
A tool that does not keep copies
Guest registration software can take some of this off your hands. Claveo, for example, lets guests enter their own details on their phone, stores the records with encrypted fields and, on its larger plans, deletes guest data after the retention period you choose. It cannot delete copies that live outside it, such as photos in your WhatsApp chats. See the guest form.
In short
- You record guest details; you do not need a passport copy.
- Copies in chats, galleries and backups are a risk: delete them.
- Check the document at the door instead of photographing it.
- Keep the register three years, then delete it.