Spain's New Tourist Data Rules: What Hotels and Car Rentals Can Ask You For

Spain is by far the most popular destination for British holidaymakers, and from Monday 2 December 2024 visitors face extra paperwork when checking in to their accommodation or renting a car. A new Spanish law, aimed at improving security, requires providers to collect significantly more information from travellers and share it with central government in Madrid. Some alarming reports have circulated, but most of the genuine impact is administrative rather than intrusive.

Photo by Andrew Cutajar on Pexels

What data Spain now collects

Hotels have always recorded some guest details, but the new rules extend both the list of data required and the range of accommodation covered, including apartments booked through platforms such as Airbnb. For everyone aged 14 or above, providers must now record full name, gender, nationality, passport number, date of birth, home address, landline (if any), mobile number and email address. Adults travelling with under-14s must also explain their relationship to the children.

The same applies when you rent a car: the driver's personal details, along with the payment-card information, are passed to the authorities for the first time. For package holidaymakers, hotels may collect very little beyond a name today, so check-in could become noticeably slower as staff type details from passports.

Why the rules — and the bank-balance myth

The Spanish State Secretariat for Security says the measure is about protecting citizens from terrorism and organised crime, both of which it describes as having a strongly transnational character. The aim is to know who is staying where and to cross-check details against databases of people of interest.

Some media reports warned of "Big Brother" demands, including guests having to reveal their bank balances. Nothing in the Spanish government's rules supports that. The business you pay must transmit how you paid: for most people a credit or debit card number and expiry date, or, if you happen to pay by bank transfer, your account location and number, but never the balance or any other financial detail.

Penalties, privacy and the bigger picture

Importantly, the penalties fall on the accommodation provider, not the guest. A business that is negligent in collecting the data can be fined thousands of euros, but no sanctions are envisaged for travellers, though a provider may make cooperation a condition of check-in. The data must be kept for three years, and most hotels are likely to delegate its handling to specialist companies rather than store card details in a back office.

Spain also, in theory, expects British visitors to be able to show access to sufficient funds, around £850 for a stay of up to nine days, though in practice this is almost never checked. Sharing more personal data is increasingly part of travel everywhere, and once the EU's EES and ETIAS systems are running, travellers will hand over plenty of information before they even board a plane. For country-specific entry details, see our guide to travelling to Spain.