Guests' identity documents: what you may keep and what you must delete
Updated 14.09.2026
Almost everyone does it: you ask the guest for a photo of the document over WhatsApp, or you photograph it on arrival, and that photo stays on the phone. On 29 April 2026 the Italian data protection authority wrote to the trade associations that the legal duty concerns the transmission of the data, not its retention. The distinction is subtle and it changes what you do every day.
- There is only one duty: identify and report
- Which data is really needed: eleven fields, seven for those travelling with you
- How long you may keep the image
- The phone photo and the chat
- What you have to tell your guest
- Suppliers: the contract they expect from you
- If data gets out: seventy-two hours
- How Chilloso solves it
- Frequently asked questions
There is only one duty: identify and report
Article 109 of the Consolidated Law on Public Security requires you to accommodate only persons holding a suitable identity document and to transmit their identifying data to the public security authorities. The legal basis for the processing is the legal obligation under Article 6(1)(c) of Regulation (EU) 2016/679.
This is exactly where the authority puts its finger: that duty concerns the communication of the data, and does not entail any need to keep it at the property, because retention for five years takes place on the Ministry of the Interior's systems. The five years are not yours to serve on your phone.
Identifying and retaining are two different things, and the law asks only one of them. What you keep for five years is the portal receipt, not the guest's document.
Which data is really needed: eleven fields, seven for those travelling with you
The technical annex to the decree lists the data to be transmitted, and there are eleven: date of arrival, number of days of stay, surname, first name, gender, date of birth, place of birth, nationality, type of document, document number, place of issue.
Here comes the point almost nobody knows, and it saves you half the work. For family units it is enough for one of the spouses to fill in the form, listing the other spouse and any minor children; for guided groups the group leader does it, listing the other members. And for those members the data required is seven items: days of stay, surname, first name, gender, date of birth, place of birth, nationality.
Type of document, number and place of issue do not appear. For the wife, for the minor children, for the rest of the group you do not need the document at all: you need their personal details, which the head of the family or the group leader gives you.
| Who | How much data | Document needed? |
|---|---|---|
| Single guest | the 11 fields | yes |
| One spouse filling in for the family unit | the 11 fields | yes |
| The other spouse and minor children | 7 fields | no |
| Leader of a guided group | the 11 fields | yes |
| The other members of the group | 7 fields | no |
How long you may keep the image
The authority does not say you may never hold a copy. It says the only copies allowed are those strictly instrumental to entering the data into the Alloggiati Web system, up to the issue of the receipt of acceptance. After that the digital copy must be erased and the paper one destroyed, if still retained.
The same rule is in the decree, not only in the note: operators are required to erase the digital data transmitted and destroy the paper copy of the lists as soon as the system has generated the receipt, which must be kept for five years.
A folder full of scanned passports does not protect you in an inspection: the proof of compliance is the receipt. An image archive is nothing but exposure, before the police and before the data protection authority.
The phone photo and the chat
Among the authority's instructions there is one line that names the practice: collect identity document data without taking photos with mobile devices and without relying on instant messaging services, WhatsApp named expressly, or in any case avoiding methods that do not meet the requirements of the rules.
Why the authority stepped in now, it says itself: in recent months data breaches have increased in which large quantities of document copies were exfiltrated from accommodation businesses. An archive of passports on a phone or in a cloud is exactly the haul needed for identity theft.
And one detail is worth knowing: the note refers to a 2025 case involving properties that used scanning devices capable of capturing and storing image copies of documents at check-in. That fact-finding activity, the authority writes, is still ongoing.
What you have to tell your guest
The note does not stop at the prohibition: it lists four things to do. One concerns staff, who must be given clear written instructions on the ban on making or retaining copies after the legally required notifications. Another concerns your guest directly.
You must set out clearly how the document data is collected and used. And where check-in is carried out with devices capable of capturing a digital copy, it must be made clear to the guest that the property will not store the images. This is not a courtesy: it is one of the authority's instructions.
Suppliers: the contract they expect from you
The third instruction is the one almost no guide reports, and it concerns whoever supplies your software. The note requires you to govern, under Article 28 of the Regulation, your relationships with providers of booking management services and with those used to acquire identity document data.
With particular attention, it adds, to how the latter process that data and to establishing effective communication procedures in the event of a breach. In practice: the system that reads your guests' documents is a processor, and between you and it there has to be a contract stating what it does with that data and how it notifies you when something goes wrong.
If data gets out: seventy-two hours
If images of your customers' documents end up where they should not, notification to the authority applies without undue delay and, where feasible, within seventy-two hours of becoming aware, under Article 33 of the Regulation. In more serious cases the guest must be informed as well, under Article 34.
The simplest way never to be in that position is not to have the archive: what is not there cannot get out.
How Chilloso solves it
The image serves one purpose only: reading the data. Chilloso reads it and fills in the guest record, and the document stays in front of you until the record is complete — if a detail is missing you see it at once and do not have to chase the guest. As soon as the notification to the police has gone through, the image is deleted from our systems. What remains is the receipt.
The data and the images stay inside the European Union. They do not leave our systems and they do not end up on servers outside the Union.
The guest uploads the documents from your property's check-in link: the image goes from them to us, is read, and disappears. That is why we tell them not to send documents over WhatsApp. From there their data leaves the closed system and lands on third-party servers, and no one can say any more who keeps it, where and for how long. That copy is controlled neither by us nor by you — and it is precisely the practice the authority advises against.
Do you need more information?