Is it legal to ask a guest for a photo of their identity document? NO!
💡 Tired of guest registration? Did you know you can automate data collection and submission to the authorities?
With iButlers, you manage the entire process securely, legally and without hassle.
Is it legal to ask a guest for a copy of their DNI?
Many accommodation providers still ask guests for copies of their DNI out of habit or as a precaution, but this practice breaches data protection legislation and can lead to substantial penalties.
What does Royal Decree 933/2021 say?
This decree sets out the obligation to register guest information before the stay begins, but does not require copies of documents to be kept. Identity can be verified visually or through other valid methods.
The AEPD has been clear: Requesting a copy of a DNI or passport breaches the data minimisation principle established in the GDPR. You can read the official statement here: AEPD press release (2025) .
The documents contain more information than necessary (photograph, parents’ details, codes, etc.), increasing the risks and the accommodation provider’s liability.
Which data must be collected by law?
- Full name
- Document number (DNI, passport, etc.)
- Nationality
- Date of issue and validity
- Address
- Contact details and payment method (if applicable)
How can you verify identity without storing documents?
The law allows you to verify a guest's identity without keeping copies:
- In person: visually checking the original document presented.
- Online: using digital certificates, video calls, authentication codes or verified payment methods.
What happens if you do not comply?
Failure to comply with the GDPR can lead to fines of up to 20 million euros or 4% of annual worldwide turnover.
Need help complying with regulations?
Specialist platforms help you collect only the permitted data without putting your customers’ privacy at risk. Look for solutions that:
- Avoid storing documents
- Automate submissions of registration forms to the Ministerio del Interior
- Adapt to future changes in the law
💡 iButlers: a comprehensive, legally compliant solution
At iButlers.com, we offer services designed to help owners and managers of tourist accommodation comply with Royal Decree 933/2021 and the GDPR automatically, securely and without complications.
- We collect only the details required by law
- We do not request or store copies of documents
- We verify identities lawfully and protect your guests’ privacy
- We send arrival reports to the Ministry of the Interior for you
✅ Visit our website or write to us at contacto@ibutlers.com for more information and personalised advice.
Legal references:
- Royal Decree 933/2021
- General Data Protection Regulation (EU) 2016/679
- LOPDGDD – Organic Law 3/2018
- AEPD notice on document verification (June 2025)
- Organic Law 4/2015 on Citizen Security
