Hotel IT: what stays under the hotel's control and what can belong to suppliers
The more technology suppliers a hotel accumulates, the easier it is to lose track of who answers for what. Here is what a hotel's leadership should never fully outsource, and what can safely be left to suppliers.
Why this line becomes blurred
A hotel rarely hires a single technology supplier: it hires several, one for the PMS, another for the network, another for technical support, another for security. Each one may handle its own part well, but often nobody is responsible for making sure the sum of those parts serves the hotel, and not each supplier's commercial interest. Without a clear line on who decides what, technical decisions end up being made by whoever carries out the work, not by whoever answers for the result.
What the hotel should keep under its control
- Control of the data: in many data flows, the hotel acts as the controller of guest, booking and spending history data, and should keep access to it and the right to export it. The PMS or POS supplier may act as a processor when it handles that data on the hotel's behalf and according to its instructions; if it uses the data for its own purposes, it becomes a controller for that processing, as the ANPD guide on processing agents (in Portuguese) explains.
- Administrator credentials: the administrator accounts for critical systems should stay under the hotel's control, kept in a credential manager, and not only in the personal account of one of the supplier's technicians.
- The final decision on suppliers: hiring, renewing or replacing a supplier is a decision for the hotel's leadership, supported by a technical recommendation, not decided unilaterally by whoever already provides the service.
- Security and compliance policy: defining the access, data retention and incident response rules required by the LGPD (Brazil's data protection law) and PCI DSS, and monitoring the controls that fall to the hotel, remains the hotel's responsibility, even when part of the execution is outsourced. Under PCI DSS, some requirements are shared with service providers, and that split needs to be documented.
- Budget and priorities: what to invest in first is a business decision, and should not be dictated by a single supplier's product catalogue.
What usually stays with suppliers
- Technical work on site: installation, cabling and physical configuration of equipment
- First-line support: handling day-to-day tickets
- Hardware maintenance: replacing parts and equipment
- Technical management of the contracted licences, such as installation and activation, with the hotel tracking quantity, actual use and renewals
- Applying updates and security patches to the contracted systems
Several areas are shared in practice: the hotel defines and monitors, the supplier carries out part of the work. The table below shows what falls to each side, and what matters is that this split is written into the contract.
| Area | Hotel | Supplier |
|---|---|---|
| Guest data | In many flows, the controller (LGPD): defines the purpose and the rules | May be a processor, when it handles the data on the hotel's behalf and according to its instructions |
| Administrator credentials | Under the hotel's control | Uses them with permission, does not hold them alone |
| Choice of suppliers | Final decision | Submits a proposal |
| Security and LGPD policy | Defines and approves | Implements technically |
| Day-to-day technical support | Raises tickets and monitors the SLA | Carries out the work and resolves |
| Hardware maintenance | Approves the investment | Carries out the maintenance |
| Patches and updates (shared) | Sets deadlines and approves maintenance windows | Applies them to the contracted systems and reports exceptions |
| Backups (shared) | Defines what to back up and for how long, and follows the restore tests | Runs and monitors the backups |
| Incident response (shared) | Coordinates, decides and makes the notifications the LGPD requires | Investigates and contains within its own system, and tells the hotel without delay |
| PCI DSS controls (shared) | Documents who looks after each requirement and validates the whole | Meets the requirements it took on by contract |
What happens when this split is not clear
A frequent scenario is the hotel discovering, at the worst moment, that it has no access of its own to its own infrastructure: passwords, configurations and documentation that only the supplier knows. In an ANPD (Brazil's data protection authority) inspection or a PCI DSS assessment, a lack of clarity about who answers for which control becomes a compliance risk in itself. PCI DSS itself (requirement 12.8.5) requires the hotel to keep a record of which requirements are managed by each service provider that handles card data or can affect its security, which are managed by the hotel and which are shared. And when the relationship with a supplier deteriorates, replacing it becomes far more expensive and slow than it needs to be.
The role of an IT consultancy in this split
An independent IT consultancy helps define and document, together with the hotel's leadership, what stays under internal control and what can be safely delegated to suppliers, making sure the split is explicit in the contracts rather than agreed verbally. That includes confirming that the administrator accounts and the data are under the hotel's control, regardless of who does the day-to-day technical work.
Next steps
If your hotel is not clear on who controls what in its own IT infrastructure, that is usually the first point to resolve, even before discussing new investments. Talk to our team.
Sources
- PCI Security Standards Council, PCI DSS v4.0.1, requirement 12.8.5, pcisecuritystandards.org
- ANPD, Guia Orientativo para Definições dos Agentes de Tratamento de Dados Pessoais e do Encarregado (guidance on processing agents and the DPO, version 2.0, 2022, in Portuguese), gov.br/anpd
Hotel IT Management
A clear definition of responsibilities between the hotel and its technology suppliers, with documented governance.
View service- Responsibility mapping
- Administrator accounts under the hotel's control
- Documented security and LGPD policies
- Supplier-independent governance
Related reading
Which IT responsibilities should a hotel never fully outsource?
Control of guest data, the administrator accounts for critical systems, the final decision on hiring or replacing a supplier, the definition of security policies and LGPD compliance, and the prioritisation of the technology budget. These points can be supported by an external consultant, but the decision and the control should stay with the hotel.
What can be left to IT suppliers?
Technical work on site, first-line support, hardware maintenance, applying updates and patches, and day-to-day operational monitoring. These are tasks that need a constant technical presence, but not strategic decisions about the direction of the hotel's IT.
What happens when this split of responsibilities is not clear?
The hotel risks becoming hostage to the supplier: credentials, configurations and documentation that only the supplier knows, security decisions made without the leadership's oversight, and real difficulty replacing the supplier if the relationship deteriorates. In an ANPD inspection or a PCI DSS assessment, a lack of clarity about who is responsible for which control also becomes a compliance risk.
What is the role of an IT consultancy in this split of responsibilities?
To define and document, together with the hotel's leadership, what stays under internal control and what can be delegated to suppliers, and to make sure that split is explicit in the contracts rather than agreed verbally. That includes checking that the administrator accounts and the data are under the hotel's control, regardless of who does the day-to-day technical work.
Not clear who controls what in your hotel's IT?
Talk to our team and organise the responsibilities between the hotel and its suppliers.