Every hotel, apartment and campsite in Spain is legally required to register your details when you check in, that part genuinely isn't optional. What a lot of properties still get wrong, and what Spain's own data protection authority has actually fined hotels for, is scanning, photographing or keeping a photocopy of your passport or ID card itself. Here's exactly what you have to hand over, what you don't, and what to say if a hotel pushes for more than it's allowed to take.
This isn't a Costa del Sol thing, or a Majorca thing, or something specific to one hotel chain. Since Royal Decree 933/2021 came into force, every type of tourist accommodation in Spain, hotels, apartments, campsites and rural tourism properties, along with vehicle hire firms, has to record a set list of guest details and submit them to a central government database used by Spanish police. It applies nationwide, so it's exactly the same rule whether you're staying on the mainland Costas, in the Balearics or out in the Canary Islands.
Giving those details isn't up for debate, and I wouldn't want anyone thinking this is a rule to try and get out of. What is genuinely optional, and what a consumer group and Spain's data protection authority have both said plainly in the last year, is letting a hotel take and keep an actual copy of your passport or ID document.
Name, date of birth, nationality, document number and a handful of other fields, collected on a form.
A hotel cannot lawfully scan, photograph or photocopy your passport or ID card to meet this requirement.
Offer to fill in a form instead, or show the document for a visual check without handing over a copy.
Royal Decree 933/2021, of 26 October, sets out exactly what accommodation providers in Spain need to record for every guest. According to Spain's consumer organisation OCU, the required fields are your full name, sex, the type of document you're travelling on, DNI, passport or TIE, the document number, its support or reference number, your nationality, date of birth, full home address, phone number, email address and the total number of travellers. If anyone in your party is a minor, the relationship between travellers is also needed.
That's a genuinely long list, and it's worth knowing it exists so a hotel asking for your email address or home address at check-in doesn't feel like an odd overreach, it's the same form every other guest is filling in. The data gets submitted to a central government system, generally known as SES Hospedajes, that Spanish police and the Guardia Civil can access.
None of this is anything to worry about or try to avoid, it's a standard legal requirement and every hotel, apartment or campsite in Spain asks the same of every guest. The only thing worth knowing is where the line sits between this and what comes next.
Plenty of hotels across Spain have got into the habit of scanning, photographing or photocopying a guest's passport or ID card at check-in, often without even asking. The Spanish Data Protection Agency, the AEPD, put out a clear informative note on this in June 2025, and it was reaffirmed just as plainly by the consumer group FACUA in July 2026: hotels can ask to see your document to check the details match, but they are not permitted to keep a copy of it.
The reasoning comes down to data minimisation under GDPR. A passport or ID card carries far more information than the registration form actually needs, your photo, signature, and on a Spanish DNI, your parents' names and a security CAN code. None of that is on the required list above, so keeping a copy means holding data the hotel has no legal basis to store, and it creates a genuine identity theft risk if that copy is ever lost or leaked.
This isn't just guidance on paper. The AEPD has actually fined a hotel over it. A four star hotel in Girona was fined €9,000, reduced to €5,400 after discounts for accepting responsibility and paying promptly, roughly £7,450 reduced to roughly £4,480 at today's rate, after it scanned a guest's DNI when the guest had specifically objected.
If a hotel scans or photographs your document without asking, it's worth politely flagging that you'd rather they didn't keep a copy. Most of the time it's just a habit on their end rather than anything deliberate, and a lot of properties genuinely don't realise it's not allowed.
In practice, most check-ins go smoothly and nobody ends up needing to push back on anything. But if a hotel does insist on taking a scan, photo or photocopy as a condition of letting you check in, both the AEPD and OCU set out the same practical options.
I always tell clients not to stress about this one. The vast majority of hotels I book get check-in right without any fuss. It's just genuinely useful to know where the line sits, so if a property does ask for more than it should, you know you're allowed to say no.
Separately from the photocopy rule, the wider traveller registration scheme itself is currently being challenged. In June 2026, the European Commission opened infringement proceedings against Spain over the system, arguing that collecting payment details and information about travelling companions goes further than necessary, that the three year data retention period is too long, and that police access to the database is too broad. Spain was given two months to respond or amend the system.
That dispute is about the scope of the wider scheme, not about whether hotels can copy your ID, which is a separate, already settled point. As of now it hasn't been resolved either way, so it's genuinely one to watch rather than something that changes what you need to do on your next trip. Whatever happens with that case, you'll still need to provide your registration details at check-in, and a hotel still won't be entitled to keep a copy of your passport.
This dispute is worth knowing about if you follow Spanish travel news, but it doesn't change anything you need to do before your next holiday. The required details and the photocopy rule both stay exactly as they are regardless of how that case plays out.
| What | Can a hotel ask for it | Notes |
|---|---|---|
| Name, date of birth, nationality, document number and the other required fields | Yes, required by law | Collected on a paper or digital form |
| Seeing your passport or ID to check the details match | Yes | A visual check is allowed |
| A scan, photo or photocopy of your passport or ID | No | Not permitted under AEPD guidance, enforced with real fines |
| Sending a copy by email or messaging app | No | Same rule, just a different way of taking a copy |
| Filling in a form instead of showing ID at all | Yes | AEPD has confirmed a form alone meets the requirement |
Based on Royal Decree 933/2021 and AEPD guidance at the time of writing. Rules can be updated, so check the current official guidance for anything that matters to your specific trip.
None of this should put anyone off booking Spain, it's genuinely still one of the easiest and best value places for UK holidaymakers to visit. It's just worth knowing the basics before you travel.
If anything about check-in on a holiday I've booked for you ever feels off, message me. I can't change Spain's own rules, but I'm always happy to help you work out what's reasonable and what isn't.
Yes. Royal Decree 933/2021 requires every type of tourist accommodation in Spain to record a set list of guest details, including your name, date of birth, nationality and document number, and submit them to a central government database. It applies nationwide, including the mainland Costas, the Balearics and the Canary Islands.
No. Spain's Data Protection Agency, the AEPD, confirmed in June 2025 that hotels cannot keep a scan, photo or photocopy of your passport or ID card. They can only ask to see it for a visual check, or collect the required details on a form.
Offer to fill in a form instead, since the AEPD has confirmed that's enough to meet the requirement. You can also mention that a copy isn't required under the AEPD's own guidance. If a hotel still won't budge, a complaint can be made to the AEPD or the consumer group FACUA.
Yes. The AEPD fined a four star hotel in Girona €9,000, reduced to €5,400 after discounts, after it scanned a guest's DNI despite the guest's objection. The fine was based on Royal Decree 933/2021 not permitting the collection of data beyond what's required.
The European Commission opened infringement proceedings against Spain in June 2026 over the wider scheme, citing concerns about payment data, travelling companion information, a three year retention period and broad police access. That's a separate issue from the photocopy rule, and it hadn't been resolved at the time of writing. Either way, it doesn't change what you need to do at check-in right now.
From the Costa del Sol to the Canaries, I'll always give you the honest practical details alongside the booking itself. Tell me where you fancy going and I'll take care of the rest, honestly and without the pressure.