A German couple checks into a two-bedroom apartment at 9pm. In Rome, someone has until 9pm tomorrow to transmit their identity details to the Questura through a government portal. In Lisbon, the same couple must be reported within three working days, and reported again when they leave. In Lyon, nobody files anything: the host fills in a form, the guest signs it, and it sits in a drawer for six months in case the gendarmerie asks. In Munich, the host must see the passport on the day of arrival and keep the form for a year. In Valencia, the data goes to the Ministry of the Interior immediately, and in any case inside 24 hours.
Same guests, five different legal machines. Owners with units in more than one country tend to discover this the way most people discover regulation: through a fine, or a manager who assumed the platform was handling it.
Rules change often. This was accurate as of September 2026; always confirm with your local authority before acting. Nothing here is legal advice, the aim is to show you the shape of each system so you know what to ask a local professional.
What is a guest registration duty, and who does it actually apply to?
A guest registration duty is a public-security obligation to record, and in some countries transmit, the identity details of every person sleeping in your accommodation. It sits in immigration and policing law, not tourism law, which is why it survives independently of licences, registration numbers and tourist taxes.
Two things follow. First, it usually applies to anyone providing paid accommodation, not just hotels, Italy's portal FAQ confirms the duty reaches short-term rental operators, affittacamere and case vacanze, and SIBA states it covers anyone renting rooms, apartments or whole houses to foreign citizens for payment. A single spare bedroom counts.
Second, the scope is often narrower than hosts assume. France and Germany impose the duty only for foreign guests; Italy and Spain impose it for everyone. That distinction changes your check-in flow more than any deadline does.
The purpose is written into the law itself. The French provision opens by stating it exists "aux fins de prévention des troubles à l'ordre public, d'enquêtes judiciaires et de recherche dans l'intérêt des personnes", public order, judicial investigation, and searching for missing persons (CESEDA art. R814-1). Portugal's SIBA cites Article 45 of the Schengen Convention alongside its own foreigners law, and that is the common European root: Schengen states agreed to require non-nationals to complete and sign registration forms in accommodation. Italy's basis is older still, Article 109 of the Testo Unico delle Leggi di Pubblica Sicurezza, a 1931 statute, updated for electronic filing in 2013.
Hospitable4.4/5
Automate your vacation rental business
From $29/moBest for: Hosts who want maximum automation
Italy and Spain are transmission regimes; France and Germany are custody regimes. In Rome and Madrid you push data to the state on a clock. In Lyon and Munich you hold a record the state can demand. Custody regimes are less urgent operationally and more exposed legally: the failure only surfaces at inspection, by which point you cannot fix it.
Portugal is the one people forget twice. The exit report is a separate submission with its own three-working-day clock. SIBA's help pages state that missing either deadline can draw fines in the range of 100 to 2,000 euros depending on how many infractions have accumulated, the portal's own statement of the band, not a statutory quotation.
Germany's scope has narrowed, and the date is worth checking. The current text of § 29 BMG imposes the special accommodation duty on "beherbergte ausländische Personen", accommodated foreign persons. The duty for German nationals was removed by amendment; the effective date is widely reported as 1 January 2025, but we could not pin it to a primary source. What § 30 does spell out is the closed list of fields the form may contain: arrival and departure dates, family name, first name, date of birth, nationalities, address, the number of foreign companions and their nationalities, and the passport serial number. An exhaustive list, not a minimum.
Spain obliges platforms too, and that does not discharge you. Article 2 of RD 933/2021 names tourist intermediaries and digital intermediation platforms as obliged subjects in their own right, so both duties can exist over one booking. A platform transmitting its own dataset does not maintain your registro informático, and Article 5 puts that register on you.
The countries we could not verify, and will not fake
Guest registration exists in some form in most of Europe, and English-language content routinely lists deadlines for a dozen countries nobody has checked. We verified five. For the rest, Austria's Gästeblatt obligations, the Dutch nachtregister rooted in municipal by-laws, Croatia's eVisitor, Greece, Belgium, Poland, a duty is reported to exist, but we did not confirm its scope, deadline or portal against a government source. Ask the local police or tourism authority directly. An honest gap beats a confident wrong number.
Does the EU short-term rental regulation replace national guest registration?
No. They are two separate stacks maturing at the same time, and conflating them is the most common error in host-facing content right now.
Regulation (EU) 2024/1028 on data collection and sharing relating to short-term accommodation rental services entered into force on 20 May 2024 and has applied since 20 May 2026, as the Austrian federal ministry confirms. It standardises unit registration: a unique registration number per property, displayed in listings, plus monthly transmission of listing and activity data from platforms to authorities through a single digital entry point.
That is about the property. Guest registration is about the people in it. The 2024/1028 machinery does not send guest identity data to the police, does not set a 24-hour clock, and does not exempt you from Alloggiati Web or SES.HOSPEDAJES. Note too that the Regulation does not force every member state to create a registration requirement, Austria's ministry page states it will not activate a national scheme. "Every EU host must now register" is wrong, and so is "the EU regulation handles guest reporting".
Guesty4.3/5
The property management platform for short-term and vacation rentals
From Custom pricingBest for: Professional property managers with 20+ listings
Can I ask guests to upload a photo of their passport?
In Spain, no. On 17 June 2025 the Spanish data protection authority stated that requesting a copy of the DNI or passport in accommodation is not permitted, because a copy carries far more personal information than RD 933/2021 requires, photograph, expiry date, parents' names, and increases identity-fraud risk. Its position is that in person, visual verification of the original is enough; online, the appropriate mechanisms are digital certificates, verification against payment-method data, or an authentication code sent to the guest's phone or email.
Read that again if your check-in flow asks every guest to photograph their ID and upload it. That flow is the default across much of the check-in software market, and in Spain the supervisory authority has said plainly that it breaches data minimisation. The AEPD binds Spain and is persuasive rather than binding elsewhere, but the underlying principle is Article 5(1)(c) of the GDPR, personal data must be adequate, relevant and limited to what is necessary, and that applies identically in every member state.
The practical rule: collect the fields the statute names, verify the document, keep no image.
How does GDPR actually apply to data you are legally forced to collect?
Your lawful basis is Article 6(1)(c) of the GDPR, processing necessary for compliance with a legal obligation, not consent. If you frame guest registration as consent-based, you imply the guest can refuse and still stay, which is false, and you inherit withdrawal rights you cannot honour. Article 6(3) is what makes it work: the obligation must be laid down in member state law, and each statute above is that law.
Four consequences worth writing into your process:
Retention is set for you, and it is a ceiling as much as a floor. Three years in Spain, one year after departure in Germany followed by destruction within three months, six months in France. Article 5(1)(e) storage limitation makes the retention period the point at which you delete. A guest data table that has never been pruned is a live problem in all of these jurisdictions.
Your PMS or check-in vendor is a processor. If a tool collects, stores or transmits guest identity data on your instructions, you need an Article 28 processing agreement, and you should know where the data sits. Ask for the DPA and sub-processor list before you connect it.
Your privacy notice has to name the police. Article 13 requires you to state the purpose and the recipients. "Your identity data is transmitted to the Italian State Police under Article 109 TULPS" is the kind of sentence that belongs in your booking flow.
Do not drift into special categories. Nothing here asks for health data, religion or biometrics. Face-matching a selfie against an ID document is biometric processing under Article 9 and needs its own analysis. Do not add it because a vendor offers it.
What should a host or manager set up operationally?
The systems are different enough that the only workable approach is per-jurisdiction, not one global check-in flow. A checklist that holds up across all five:
Map every unit to its jurisdiction, portal and clock. One row per unit: country, legal basis, all-guests or foreigners-only, transmission or custody, deadline, retention. That document is the whole compliance programme.
Get portal credentials before your first booking. Alloggiati Web issues credentials and a certificate through the Questura; SES.HOSPEDAJES requires enrolment in the Ministry's e-office; SIBA requires registering the unit under the right classification. None of these are same-day.
Collect the required fields at booking, not at the door. Spain's Annex I list runs to names, sex, document type and number, nationality, date of birth, full home address, phone numbers, email and the relationship of accompanying minors. Nobody types that accurately at 11pm on a doorstep.
Capture every guest, not just the booker. Platform data gives you one name; the statutes want everyone who slept there.
Set the operational deadline tighter than the legal one. If your portfolio spans Rome and Lisbon, run everything on Rome's 24 hours and Portugal takes care of itself. Then decide who files when you are asleep.
Verify documents without storing them. Visual or equivalent verification, fields extracted, no image retained.
Automate the deletion, not just the collection. A documented per-country purge schedule is what you show an inspector.
Keep proof of filing. Italy's portal guidance is to keep receipts five years, and receipts are the only thing that proves a timely filing after the fact.
Steps 3, 4 and 5 are the same problem, and the one place software genuinely helps: getting structured data out of every guest before arrival, without chasing anyone.
Automated pre-arrival messaging is the cheapest place to start. Hospitable can trigger sequenced messages at booking and before check-in asking for exactly the fields your jurisdiction requires, with follow-ups when guests do not reply, and its Essentials tier is free for unlimited properties. If you want the capture built into a structured online check-in form rather than a message thread, Smoobu bundles a guest portal and online check-in with its channel manager, readers signing up through that link get 10% off, and Professional Flex is EUR 29/mo with a 0.9% booking fee as of writing. On the messaging side specifically, our comparison of guest communication platforms is the more useful read, and the contactless check-in guide covers how data capture fits into arrival logistics.
One caution the vendors will not print: no software makes you compliant. A tool collects fields and reminds you; the duty to file within 24 hours, hold a signed form for six months or keep a register for three years remains yours. Where a tool claims a direct national-portal integration, test it with a real booking against the portal's own confirmation receipt.
What do hosts get wrong most often?
Assuming the platform did it. Airbnb showing you a guest name is not a police filing. Even in Spain, where platforms are separately obliged, your own Article 5 register obligation stands.
Filing only the lead guest. The duty covers everyone accommodated.
Missing Portugal's exit report. Two submissions per stay, two deadlines.
Storing ID scans indefinitely. The AEPD says do not collect them in Spain at all; elsewhere, an unpruned archive of passport images is the largest breach exposure a small host carries.
Using consent as the lawful basis. It is Article 6(1)(c). Fix your privacy notice.
Confusing guest registration with unit registration. CIN in Italy, RNAL in Portugal, regional codes in Spain: different duty, different portal, different penalty. If you track those numbers on a spreadsheet, our note on tracking licences and permit renewals is the relevant one.
Unattended key handover in Italy. A Ministry of the Interior circular of November 2024 and a 2025 Consiglio di Stato ruling are reported to require real-time verified identification, which would make pure keybox self check-in non-compliant. We could not locate either text on a primary government source, so treat it as reported rather than settled, but ask a local professional before building an Italian arrival process around a keybox.
Guest registration is a data-quality problem dressed as a legal one. The 24-hour countries are not hard because 24 hours is short; they are hard because you cannot file what you never collected. Fix the collection step and every version of this obligation gets easier at once.
Gabriele manages a small portfolio of short-term rentals in Southern Italy and has hosted on Airbnb, Vrbo and Booking.com since 2018. He has migrated between channel managers more than once and dealt with double bookings, cleaning chaos and last-minute cancellations first-hand. On RentalDuel he puts our software tests into practice, running the various platforms across his own rentals to see what actually holds up day to day.
