- A Spanish hotel must see your passport and record a fixed set of details for the Interior Ministry. That part is the law, and you cannot refuse it.
- What it may not do, under a June 2025 ruling from Spain's data-protection regulator, is photocopy, scan, photograph or keep your passport. You can politely refuse the copy.
- A small hotel in Cantabria was fined for demanding a photocopy at check-in, so the ban has teeth. So does the other side: hotels face far bigger fines for failing to register guests, which is why front desks push.
- Check-in is genuinely slower in Spain than it was before December 2024. Allow ten extra minutes on arrival day and don't pick a fight at the desk.
No, a hotel in Spain does not get to keep your passport, and since June 2025 it is not allowed to photocopy or scan it either. What it must do is look at the document and record a fixed list of details, which Spanish law obliges it to send to the Interior Ministry. You cannot refuse the details. You can refuse the copy. Knowing which is which turns an awkward front-desk moment into a thirty-second one.
What Spanish hotels must legally collect at check-in
Since 2 December 2024, every Spanish hotel, hostel, tourist apartment, campsite and car-hire firm has been required to collect and report guest data under Royal Decree 933/2021, feeding a Ministry of the Interior platform called SES Hospedajes. The reporting duty is real, national, and enforced; the data is kept for three years.
For each guest that means around fifteen personal details: full name, gender, the passport number and document type, nationality, date of birth, home address, phone numbers, email, and how your group is related if a child is travelling. On top come the stay and payment details: booking reference, arrival and departure dates, and how you paid. Children are registered too, with a parent providing the details for anyone under 14, and everyone over 14 signing the entry form.
Hotel owners say the decree can demand up to 42 separate details; the government says only 13 are strictly required. Either way, it is far more than the old system, and it is why the front desk now types for several minutes where staff once swiped your passport through a scanner. The hotel trade's own estimate is that manual registration can add up to ten minutes per guest at busy times, which is the honest explanation for those slow-moving arrival queues along the costas since the winter of 2024.
One thing worth knowing before you reach for cash: how you pay is one of the details they have to report either way, so paying in cash does not take you out of the system.
Can a hotel photocopy or keep your passport?
No. On 17 June 2025 the AEPD, Spain's data-protection regulator, published guidance saying plainly that hotels and other accommodation may not ask for a copy of a guest's ID card or passport, because a copy contains far more than the law requires (your photo, the document's expiry date, your parents' names) and breaches the GDPR's data-minimisation principle. The hotel may look at the document to check you are who the form says you are, and note down the details it needs. Photocopying it, scanning it, photographing it, or holding onto it behind the desk are all off the menu.
This is not a theoretical rule. The AEPD fined a small Cantabrian guest house, the Posada El Azufral, 1,500 euros after it demanded a photocopy of a guest's ID at check-in and cancelled the booking when the guest refused, a case reported across Spain's legal press in early 2025. At the other end of the scale, a Mallorca hotel that digitally stored full passport copies was fined 30,000 euros, reduced to 15,000 on appeal. The pattern is clear: seeing your passport is required, copying it is a violation.
If a receptionist insists on a photocopy, stay friendly and say: “You're welcome to look at my passport and note down the details, but the AEPD ruled in June 2025 that hotels may not copy or keep it.” In Spanish, the regulator's own phrasing is “no está permitido solicitar copia del DNI o del pasaporte”. Most desks back down at the mention of the AEPD; if they do not, ask for the hoja de reclamaciones (the official complaint form every Spanish business must keep) and you can later complain to the AEPD itself.
Two things to remember. First, the registration data itself is mandatory: a guest who refuses to provide the details can lawfully be turned away, so the script above is about the copy, never the information. Second, hand the passport over willingly so they can check it; the problem is keeping and copying it, not the receptionist holding it for thirty seconds.
Why hotels push so hard anyway
Because the law leans on them from the other side. A hotel that doesn't keep and send the required records faces fines that run from small ones for sloppy record-keeping up to 30,000 euros for serious failures. The staff member asking for your passport at 11pm is squeezed between a registration law that threatens the business and a data-protection ruling most guests have never heard of. That is worth remembering in the moment: the person behind the desk did not design the system, and a friendly, informed refusal of the photocopy gets a better result than a lecture.
It also explains a request that surprises people at booking time: some hotels ask for passport numbers days before arrival. The decree requires reservation data to be reported within 24 hours of booking, so asking for registration details before you arrive can be entirely legitimate. What should make you suspicious isn't the request itself, it's how the message arrives: if a message about your booking asks you to re-enter card details through a link, that is a different problem entirely, and our guide to telling a genuine hotel payment message from a scam is the thing to read before you reply.
The EU is now challenging Spain's rules
The newest development is in Brussels. On 4 June 2026 the European Commission opened an infringement procedure against Spain (reference INFR(2026)4005), formally objecting that the traveller-registration regime breaches EU data-protection law for police matters: the data demanded is excessive (payment details among it), police access to it is not limited to specific purposes, and keeping everything for three years is disproportionate. The complaint that started it was lodged by a Spanish travel-agency federation back in January 2023.
Spain was given two months to respond, and that deadline passed in early August 2026. At the time of writing, Spain hasn't formally responded or changed the rules, and the next escalation step, if Brussels is unsatisfied, would be a reasoned opinion and eventually the EU Court of Justice.
Nothing yet. The rules remain fully in force for 2026 holidays, front desks are still obliged to register you, and any binding change is likely months or years away. Treat the EU challenge as an interesting reason the rules may eventually soften, not as grounds to refuse registration at a reception desk this summer.
Three different sets of rules people mix up
Half the confusion online comes from bundling separate systems into one scare story, so here's how they differ. Guest registration (this article) is Royal Decree 933/2021: every guest's details, reported to the Interior Ministry, nationwide. Short-term rental licensing is about the property itself, whether a flat may legally be let to tourists at all; it changes nothing about what you hand over at check-in. EES and ETIAS are EU border systems: EES registers non-EU travellers' fingerprints and photos at the external border itself, and ETIAS is a pre-travel authorisation. None of them lets a hotel keep your passport.
One regional wrinkle is genuine but minor: in Catalonia and the Basque Country your details go to the regional police forces rather than the national platform. The data collected, and the ban on copies, are the same everywhere in Spain.
Quick answers
Can I check in with my UK driving licence instead?
No. For non-residents the passport is the identity document Spanish registration works from, and a photo driving licence doesn't count as an ID document under Spanish law. Bring your passport to the desk; you can lock it away safely afterwards. Back home the answer runs the other way, and our guide to what a UK hotel can ask for at check-in explains why a British guest is rarely asked for a document at all.
Do my children need to be registered too?
Yes, every guest is registered regardless of age. For children under 14 the accompanying adult provides the details; everyone over 14 signs their own entry form. A family of four means four records, which is part of why arrival takes longer than it used to.
Does the hotel keep my passport at the desk overnight?
It should not, and it does not need to. Registration is done in front of you: they look at the document and type in the details. If a hotel wants to hold the document “to enter the data later”, decline politely and wait while they do it there and then; keeping hold of it is exactly what the regulator has banned.
Will these rules disappear now the EU has stepped in?
Not this year. Infringement procedures move in months and years, Spain has shown no public sign of changing the decree, and the AEPD's no-copies rule stands on GDPR grounds that would survive even if the registration regime were rewritten. Plan every 2026 trip assuming the current system applies.
One last thing to do before you fly: note down or screenshot the AEPD's June 2025 position, “no está permitido solicitar copia del DNI o del pasaporte”, with the date attached. A phone screen showing a regulator's own words, in Spanish, settles more front-desk stand-offs than any amount of indignation, and it takes ten seconds to save.
