Priority sector
Hotels, resorts, restaurants and tourism operators process guest data every day and employ large, often seasonal, workforces.
Key obligations
Registration, payments, loyalty programmes and marketing require clear legal bases, information notices and retention rules.
CCTV in guest and staff areas must be proportionate, properly signposted and limited in retention.
Internal whistleblowing channels and, in Portugal, the RGPC compliance programme apply to employers with 50 or more workers.
Employers with 150 or more workers must report their gender pay gap by 7 June 2027, with smaller employers following later.
Hospitality is a people business. Hotel and tourism groups collect personal data at every step of the guest journey, often through booking platforms and other intermediaries, and employ large teams with high turnover. Data protection, employment-related obligations and integrity rules weigh more heavily than in many other sectors, while customers expect visible care for their privacy.
Data Protection Officer: for hotel groups, resorts and tourism operators, including guest data, CCTV and marketing;
whistleblowing and integrity: internal channels and, in Portugal, RGPC programmes;
people compliance: pay transparency readiness and training for seasonal and permanent staff;
third parties: processor contracts with booking platforms, software providers and service suppliers.
A free Compliance Assessment identifies the priorities for each unit and the group.
Related domains: Data Protection · Whistleblower Protection · Anti-Corruption · Pay Transparency · Third-Party & Supply Chain
Regulated functions: Data Protection Officer · Whistleblowing Officer · Compliance Officer · All sectors
General information as at October 2026; it does not constitute legal advice.
Request a free assessment designed for hotels and tourism operators.