IT due diligence when buying a hotel: what to check before you sign

Why IT belongs in hotel due diligence

When a hotel is bought, due diligence usually covers the accounts, contracts, property, licences and employment. Technology can get less attention, and it is where the buyer finds out, after signing, that the website domain is registered to a former manager's personal tax number, that the PMS contract renews for three more years with a penalty, or that the servers run a version of Windows with no security updates.

Some of these findings change the price, the warranties asked of the seller and the budget for the first months. Others need to be fixed, or covered in the contract, before closing. A review done before signing gives the buyer three things: a list of what has to be transferred when ownership changes, the investment the seller has deferred and the risks that need a clause in the purchase agreement.

Start by confirming what is being bought. The owner of the property is not always the company that operates the hotel or contracts its systems. In a hotel run by an operator or chain, the PMS, the IT contracts and some of the data may sit with the operator. If the purchase covers only the property, those contracts, accounts and systems may stay with the operator, and the management agreement says what changes.

The structure of the deal changes the work. In a share purchase, the company that operates the hotel generally keeps its CNPJ (Brazilian company tax number), contracts and registrations, subject to change-of-control clauses and any approvals that apply. In an asset purchase, the buyer generally operates through its own CNPJ, which may belong to an existing company, and has to work out which contracts, licences, registrations and payment accounts can be transferred, which need the other party's consent and which have to be set up again before operations change hands. That includes Cadastur, the tourism registration that the General Tourism Law (Lei 11.771/2008, art. 22) requires for accommodation providers, and the digital FNRH, which is linked to it. If the hotel is branded, also check which systems the brand requires and what happens to them if the brand changes.

What to ask the seller for in the data room

A short list, requested early, saves weeks of back and forth. For technology, ask for:

• An inventory of systems: PMS, POS, booking engine, channel manager, door lock system, ERP or finance, e-mail, telephony, CCTV and Wi-Fi.
• Every technology contract in force, with amendments, and the invoices for the last 12 months.
• A list of who administers each account: domain, e-mail, PMS, OTA extranets, Google Business Profile, acquirers and banks.
• A network diagram, or whatever exists of one, and a list of equipment with its approximate age.
• Reports of security incidents and data breaches from recent years, and any notifications to the ANPD (Brazil's data protection authority).
• Evidence of the latest PCI DSS validation, if there is any: the self-assessment questionnaire (SAQ) or report on compliance (ROC), the attestation of compliance (AOC) and any required scan reports, as the acquirer or the card brands require.
• The privacy policy, the record of processing activities if there is one, and the contracts with whoever processes data on the hotel's behalf.
• Shared services: systems, licences, administrator accounts and integrations provided by the seller's group, the hotel operator or the brand (for example Microsoft 365, backup, security monitoring and contracts managed by head office), and how they will be separated or kept after the sale.
• Technology projects under way, approved capital spending, open supplier orders and brand-required upgrades for the next 12 to 24 months.

Gaps in what the seller provides are information too. A hotel with no inventory and no list of accounts will need more work after the purchase.

At this stage, avoid asking for copies of guest and employee records. Inventories, contracts, aggregated reports and supervised demonstrations cover much of the work; detailed personal data should only be shared when it is needed, with restricted access and a review by the lawyer.

Contracts and licences

Read each contract for four things: term and automatic renewal, termination penalty, what happens on a change of control or assignment, and who owns the data and the equipment.

Also ask for the list of software installed on the computers. Unlicensed software can mean regularisation costs and a liability, depending on the structure of the deal; identify it before negotiating the price and the warranties.

Also confirm that the buyer can get a complete, usable copy of the reservations, including future bookings, the guest records, the configuration and the financial data, without relying indefinitely on the seller's systems. It is a real problem when the PMS sits in an account of the seller's group, shared with other hotels. The supplier contract may allow the export, and the LGPD still applies to how that data is used.

Reconcile future bookings with the money too. List individual, group and event bookings, deposits and advance payments, open refunds and chargebacks, commissions owed to OTAs and any vouchers or loyalty credits, and check who received each amount and who will provide the service after closing. A guest who paid the seller will arrive at a hotel that now belongs to the buyer, and settling those amounts belongs in the purchase agreement. If the acquirer or gateway changes, confirm whether stored card tokens will keep working or whether payment details will have to be requested again.

If the buyer will still depend on the seller's systems or staff after closing (e-mail, PMS, backup, finance), put a transitional services agreement (TSA) in place. It sets out which services continue, for how long, at what cost, with what support and under what rules for access to data, and it has an end date.

Accounts, domain and access

This is the part that causes most of the day-one problems, because many accounts are in the name of people, not the hotel. Build a table with each account, its holder, who administers it today and how it will be transferred:

• The website and e-mail domain at Registro.br: holder (personal or company tax number) and administrative contact.
• E-mail administration (Microsoft 365, Google Workspace or other) and the accounts of people who have left.
• Administrator users in the PMS and the other systems.
• OTA extranets, Google Business Profile and social media. Someone newly added to a Google Business Profile has to wait 7 days before becoming its primary owner, so start that transfer before closing.
• Accounts with the acquirer, PSP and banks, including the Pix keys published on the hotel's channels. A Pix key changed without confirmation is an opening for booking fraud.
• The digital FNRH access key and the person named in Cadastur.
• The company digital certificate (e-CNPJ) used for tax invoices and government systems: the CNPJ it belongs to, its expiry date, the person responsible and whether a new one will have to be issued. Do not treat handing over the private key and password as a transfer of access.
• Access to the firewall, switches, Wi-Fi, CCTV and door lock administration, and which outsiders have remote access.

Infrastructure and equipment

The aim here is to estimate the deferred investment, the spending the seller put off and the buyer will inherit. The items that weigh most are:

• Computers and servers on unsupported systems. Standard Windows 10 support ended on 14 October 2025. Before budgeting for replacement, check the edition on each machine: LTSC editions have their own support dates, and the paid Extended Security Updates (ESU) programme has technical requirements and is a temporary measure that covers security updates only. See legacy systems.
• Network: whether it is documented, whether the guest network is separate from the administrative and payment networks, and whether switches and access points still get vendor updates.
• Power: UPS units in the rack and at the front desk, and when the batteries were last replaced.
• Backup: what is backed up, where it is kept and when a restore was last tested.
• Door locks and the PMS interface: version, vendor support and the cost of an upgrade.

For each item that needs replacing, get supplier quotes before signing. A quoted number carries more weight in a negotiation than an estimate.

Cybersecurity and incidents

Ask the seller, in writing, whether there have been security incidents, ransomware, payment fraud or data breaches, and what was done. A representation by the seller in the purchase agreement can give grounds for compensation if the answer turns out to be untrue, depending on the terms the lawyer negotiates.

On the technical side, check whether multi-factor authentication is on for e-mail and remote access, who has administrator rights, whether there is managed antivirus and whether anyone looks at the alerts. An external scan of the hotel's addresses shows services exposed to the internet, but it should only be run with the seller's written authorisation.

LGPD and PCI DSS

The structure of the deal determines who is responsible for the data under the LGPD (Brazil's data protection law). In a share purchase, the company that operates the hotel may remain the controller. In an asset purchase, guest, employee and reservation records may pass to another controller, and that transfer needs a legal basis and a review of the privacy notice, access rights, retention and the purposes the data can still be used for. Marketing consent given to the seller should not be taken as permission for marketing by another company. These questions are for the deal lawyer.

For each past incident, check whether it met the reporting criteria, when the controller learned of it, whether the ANPD and the people affected were notified and whether any risk or obligation is still open. For incidents that may cause relevant risk or harm to the people affected, ANPD Resolution 15/2024 allows 3 business days to notify the ANPD and those people, counted from when the controller learned that the incident affected personal data. If an earlier incident comes to light after the purchase, the deal lawyer determines which company is responsible for the investigation and any notices. See the guide to LGPD for hotels.

For PCI DSS, ask for that evidence and check whether the hotel keeps full card numbers or security codes (CVV) in spreadsheets, e-mails or registration cards. The CVV must not be kept after authorisation, even if encrypted. If it does, do not wait for closing: access should be restricted straight away, and the remediation agreed with the seller. If operations move to another CNPJ, the hotel will have new contracts with the acquirer, and the PCI DSS validation has to be confirmed with the acquirer for the new account. See PCI DSS for hotels.

From findings to a risk register

The output of the review is a risk register the transaction adviser and the lawyer can use. Each row links a finding to a consequence, a decision and the time to act: before signing, before closing or after the purchase. Also record the evidence (contract clause, Registro.br record, inspection), the person responsible and the quoted cost, or note that the cost is not yet known. The example below is illustrative and does not describe a real hotel.

From closing to the first 100 days

Before closing: confirm the agreed conditions have been met, have the acquirer contracts, settlement bank account and tax invoicing ready if operations move to another CNPJ, and prepare with the seller and suppliers the handover plan for passwords, accounts and access. Record in that plan what depends on each password, token and integration key, so the change does not take down the PMS, payments, booking channels or the digital FNRH.

On the day ownership changes: run that plan, take over the administrator accounts and turn on multi-factor authentication for them, change passwords, tokens and keys in the agreed order, disable the accounts of people leaving with the seller, confirm the payment details and Pix keys published on the hotel's channels, and review which outsiders have remote access. Before the day ends, confirm that the PMS, payments, bookings, tax invoicing and door locks are working.

By day 30: transfer the accounts still in individuals' names, extend multi-factor authentication to e-mail and the other critical systems, and repeat the backup restore test, now under the buyer's control.

By day 100: every material finding in the risk register has an owner and an approved plan, the urgent ones are fixed and the essential controls have been checked. Work that takes longer, such as a PMS migration, a change of brand or a new network, has an agreed timeline and budget. Update the privacy policy if the controller changed, and decide whether each contract stays, is renegotiated or ends, based on the term and penalty found in due diligence. This is where supplier management comes in.

Next steps

If you are buying or taking over a hotel, HotelTI reviews the technology contracts, critical systems, operational dependencies and deferred investment, and delivers the risk register to the buyer, the transaction adviser and the lawyer. Legal conclusions are the lawyer's. Our IT assessment can work to the deal's deadlines: we use the documents the seller shares and only check the systems themselves where the seller gives us access; see a sample report. We do not resell software or have agreements with specific vendors. Talk to our team.

Sources

• Presidência da República, Lei 11.771/2008, General Tourism Law, planalto.gov.br
• Presidência da República, Lei 13.709/2018, General Data Protection Law (LGPD), planalto.gov.br
• ANPD, Resolution CD/ANPD 15, Security Incident Reporting Regulation (April 2024), in.gov.br
• Microsoft, Extended Security Updates (ESU) program for Windows 10, learn.microsoft.com
• Google, Manage your Business Profile owners & managers, support.google.com
• PCI Security Standards Council, PCI DSS v4.0.1 and Self-Assessment Questionnaires, pcisecuritystandards.org