Do hotels copy or keep my passport, and is that legal?

Why hotels ask for your passport at all

Most countries make accommodation providers keep a guest register. When you check in abroad on a trip1 booking, the property is usually filling in a legal form: your name, date of birth, nationality, document number and dates of stay, which it then files with the police or a national portal.

Spain uses SES Hospedajes, Italy uses Alloggiati Web, Greece and Czechia have their own police portals, and Germany and Austria use registration cards kept by the property. Your passport is simply the source document for those fields.

Recording details is not the same as keeping a copy

The hotel needs the data, not the document. Reading your passport and typing the details into the registration system is what the law asks for in almost every country. Scanning or photocopying the page and filing it away is an extra step that the registration rules rarely require.

The difference matters because a stored copy contains far more than the register needs: your photograph, your signature, the machine readable zone, sometimes your parents' names. That becomes a much bigger problem if the property is ever breached.

What the law says in the EU

In the EU, a hotel needs a lawful basis under the GDPR before it processes your passport, and for guest registration that basis is the national law that creates the register. The same law sets how long the details may be kept, which is around a year in Germany and several years in Austria.

Spain's data protection authority, the AEPD, took a clear position in 2025. Asking guests for a photocopy or scan of an ID card or passport for traveller registration goes beyond what the registration rules need, and it has penalised properties for doing it. Similar reasoning applies elsewhere in the EU, though enforcement varies country by country.

Outside the EU the position is different again. Japan instructs hotels to keep a copy of the passport of foreign guests who have no address in Japan, and a scan is treated as normal practice in several countries in Asia and the Middle East.

What you can reasonably ask

• Ask the property to read your details at the desk instead of taking a copy, and see what it says.
• Ask why a copy is needed and which law requires it.
• Ask how long the copy is kept and who inside the business can see it.
• Ask for the copy to be deleted after your stay if it was not legally required in the first place.

If the answers do not satisfy you, the data protection authority in the country where the property sits is the place to take it. That is the AEPD in Spain, the Garante in Italy and the CNIL in France. This article describes the general position rather than advice on your particular situation, so ask the property or the regulator directly if you need something specific.

Practical steps at check-in

• Hand the passport over yourself rather than letting it disappear into a back office, and take it straight back.
• Do not leave your passport with the property overnight, which some hotels still ask for. You need it, and there is no legal basis for it in the EU.
• If a scan is unavoidable, ask that it is deleted once the registration has been filed.
• Check the property's privacy notice, which most hotels display at the desk or link from their check-in form.