GDPR – The Basics for Tourism Businesses

The General Data Protection Regulation (GDPR) is the law that governs how personal data is collected, stored, and used. For tourism and hospitality businesses, this applies to guest bookings, contact forms, mailing lists, and even enquiry emails.
​
Getting it right helps build trust with your customers and avoids fines or complaints. It doesn’t have to be complicated — here are the essentials.

🔑 The Core Principles (in plain English)

• Lawfulness, Fairness, Transparency
  Always tell people why you’re collecting their data and what you’ll use it for.
• Purpose Limitation
  If someone gives you their email to make a booking, don’t add them to a marketing list without asking.
• Data Minimisation
  Only ask for what you really need — if you don’t need someone’s passport number, don’t collect it.
• Accuracy
  Check and update your records — especially repeat guest information and email addresses.
• Storage Limitation
  Don’t keep personal data longer than you need to. Set a clear retention policy (e.g. delete enquiry emails after 12 months).
• Integrity and Confidentiality
  Keep data safe. Use passwords, antivirus protection, and don’t leave printed lists lying around.

✅ Practical Tips for Tourism Businesses🛎️ When Taking Bookings

• Ask only for relevant info (e.g. name, contact details, party size, special requests).
• Include a link to your privacy policy in your booking confirmation.
• If you use a booking system, check it’s GDPR-compliant and secure.

📬 Storing Contact Details

• Store digital guest info in secure systems (e.g. encrypted software or cloud booking systems).
• If you keep physical guest books or records, store them in a locked cabinet and set a schedule to destroy old entries (e.g. shred after 12 months).
• Never share guest data (e.g. to other businesses) without explicit consent.

✅ Email Lists & Marketing

• Use clear opt-in checkboxes if you're collecting data for newsletters or promotions — no pre-ticked boxes.
• Keep a record of when and how someone gave consent.
• Provide an easy unsubscribe option in every marketing email.

🗑️ How Long Can You Keep Guest Data?

• Booking data: typically OK to retain for 6 years (for HMRC or complaint purposes).
• Marketing data: review and cleanse at least every 2 years; remove inactive contacts.
• Enquiries: if they didn’t book, delete after 12 months unless they opted in for updates.

📄 What You Should Have in Place

• ✅ A simple, up-to-date privacy policy (link it from your website and booking emails)
• ✅ A basic data retention plan (how long you keep info)
• ✅ Clear opt-ins for marketing
• ✅ Secure passwords and storage for digital and paper records
• ✅ Staff awareness — even if it's just family helping in the summer

🧰 Helpful Resources

• ICO’s GDPR guide for small businesses:
  ico.org.uk/for-organisations/advice-for-small-organisations
• GDPR for Tourism (WTM/UKH Resource):
  GDPR Quick Guide for Hospitality

Final NoteYou don’t need a legal department to comply with GDPR — just a bit of awareness and consistency. And if you’re ever unsure, we’re here to help.
Back to Member Resources ➔
Contact the MWT Cymru Team ➔