Do hotels copy or keep my passport, and is that legal?
Hotels in many countries must record your passport details by law, but keeping a photocopy is a separate step. Here is what is lawful and what you can ask.
Updated
Why hotels ask for your passport at all
Most countries make accommodation providers keep a guest register. When you check in abroad on a trip1 booking, the property is usually filling in a legal form: your name, date of birth, nationality, document number and dates of stay, which it then files with the police or a national portal.
Spain uses SES Hospedajes, Italy uses Alloggiati Web, Greece and Czechia have their own police portals, and Germany and Austria use registration cards kept by the property. Your passport is simply the source document for those fields.
Recording details is not the same as keeping a copy
The hotel needs the data, not the document. Reading your passport and typing the details into the registration system is what the law asks for in almost every country. Scanning or photocopying the page and filing it away is an extra step that the registration rules rarely require.
The difference matters because a stored copy contains far more than the register needs: your photograph, your signature, the machine readable zone, sometimes your parents' names. That becomes a much bigger problem if the property is ever breached.
What the law says in the EU
In the EU, a hotel needs a lawful basis under the GDPR before it processes your passport, and for guest registration that basis is the national law that creates the register. The same law sets how long the details may be kept, which is around a year in Germany and several years in Austria.
Spain's data protection authority, the AEPD, took a clear position in 2025. Asking guests for a photocopy or scan of an ID card or passport for traveller registration goes beyond what the registration rules need, and it has penalised properties for doing it. Similar reasoning applies elsewhere in the EU, though enforcement varies country by country.
Outside the EU the position is different again. Japan instructs hotels to keep a copy of the passport of foreign guests who have no address in Japan, and a scan is treated as normal practice in several countries in Asia and the Middle East.
What you can reasonably ask
- Ask the property to read your details at the desk instead of taking a copy, and see what it says.
- Ask why a copy is needed and which law requires it.
- Ask how long the copy is kept and who inside the business can see it.
- Ask for the copy to be deleted after your stay if it was not legally required in the first place.
If the answers do not satisfy you, the data protection authority in the country where the property sits is the place to take it. That is the AEPD in Spain, the Garante in Italy and the CNIL in France. This article describes the general position rather than advice on your particular situation, so ask the property or the regulator directly if you need something specific.
Practical steps at check-in
- Hand the passport over yourself rather than letting it disappear into a back office, and take it straight back.
- Do not leave your passport with the property overnight, which some hotels still ask for. You need it, and there is no legal basis for it in the EU.
- If a scan is unavoidable, ask that it is deleted once the registration has been filed.
- Check the property's privacy notice, which most hotels display at the desk or link from their check-in form.
Hotel passport copies - FAQ
It depends on the country. Many countries require hotels to record your passport details, but keeping a copy is a separate step. In the EU it is only lawful where national law requires it, and Spain's data protection authority says registration does not need a copy. Japan is the main exception: hotels must keep a passport copy for foreign guests without a Japanese address.
Some do, but the law usually asks only for the details, not the document. The hotel reads your name, date of birth, nationality and document number and files them in the guest register. Spain's data protection authority, the AEPD, says asking for a copy of an ID card or passport for traveller registration is excessive, and it has penalised properties for it.
No hotel needs to hold on to your passport. Hand it over yourself, let staff read or record the details, and take it straight back. Do not leave it with the property overnight, which some hotels still ask for: you need it, and in the EU there is no legal basis for it. If a scan is unavoidable, ask for it to be deleted after registration.
Giving your passport number for guest registration is normal and, in many countries, required by law. The bigger risk is a stored scan, which holds your photo, signature and the machine readable zone. You can ask the hotel how long it keeps your details and who can see them, and ask it to record the details rather than take a copy.
Usually to fill in the guest register that local law requires, which they file with the police or a national portal such as Spain's SES Hospedajes or Italy's Alloggiati Web. The law asks for the data, not a copy, so a scan is often habit or internal procedure. Japan is different: hotels there must copy the passports of foreign guests with no Japanese address.
Only as long as the national law that creates the guest register allows. That is around a year in Germany and several years in Austria. Ask the property for its retention period, and if its answers worry you, contact the data protection authority in that country, such as the AEPD in Spain, the Garante in Italy or the CNIL in France.