Hotel PMS contracts: 15 clauses to check before you sign

Choosing a PMS often takes months of demos and proposals. The contract arrives at the end, with pressure to sign, and it is what decides how much the hotel will pay over the next years, what the vendor has to deliver and how to leave if the system does not work. The clauses below are the ones that weigh most on a hotel's operation. The list helps prepare the conversation with the vendor and the lawyer, and it does not replace legal review.

Scope and price

1. Scope and pricing model

The contract should list the modules contracted, the number of rooms or users and what is charged separately: interfaces, training, new properties, extra storage. Check whether the price is per room, per user or per property, and what happens if the hotel grows or shrinks.

2. Interfaces and API

List every integration the hotel needs (booking engine, channel manager, POS, door locks, telephony, ERP, digital FNRH, tax invoicing) and who pays for it, at implementation and in maintenance. Also ask whether the hotel can add new integrations through the API without depending on the vendor, and at what cost. And ask what happens if the vendor changes or retires an API, integration or module the hotel relies on: how much notice it gives, whether it helps with the transition and who pays. See hotel systems integration.

3. Implementation and acceptance

The timeline, what the vendor delivers at each stage and the acceptance criteria: what has to work for the hotel to consider the system live and start paying the full fee. Without acceptance criteria, the hotel can end up paying the full monthly fee with the system half done. See how to plan a PMS migration.

4. Price adjustment

The index used for annual adjustment, how often it applies and whether there is a cap. A contract that lets the vendor change its price list with notice, and no index, leaves the hotel unable to forecast its costs.

5. Legal updates

Who pays when the law changes: the digital FNRH, the national NFS-e (service tax invoice), the tax reform fields. The contract should say whether these changes are included in the monthly fee and how quickly the vendor delivers them.

Data

6. Data access and export

The contract should give the hotel the right to access, use and export its operational data (reservations, guest records, folios, financial transactions and system settings), within the limits of the LGPD. The export has to be complete and usable, in a documented format that keeps the links between records (guest, stay, folio, payment), at any time and at the end of the contract, free of charge or at a stated cost. A CSV that loses those links is no use for a migration. Ask for a test export before signing, or as an implementation milestone. This is the clause that weighs most when the hotel changes systems.

7. LGPD and roles

In general the hotel is the data controller and the PMS vendor is the processor under the LGPD, Brazil's data protection law (art. 5). Each party's role depends on the processing it carries out, not on the label in the contract. The processor handles data on the controller's instructions (art. 39) and must have security measures in place (art. 46). The contract should set out those instructions, the list of sub-processors (cloud hosting, support) and where the data is stored. If data leaves Brazil, including through remote support from another country, identify who receives it, for what purpose and which transfer mechanism applies (arts. 33 to 36 and ANPD Resolution 19/2024, which sets out standard contractual clauses). Transfers are allowed under one of these mechanisms; the European Union, for example, was recognised as adequate by ANPD Resolution 32/2026. See LGPD for hotels.

8. Incident notice

Under ANPD Resolution 15/2024, the hotel has 3 business days to notify the ANPD and the people affected of an incident that may cause significant risk or harm, counted from when it learned that personal data was affected. That is the hotel's legal deadline as controller; the vendor's deadline is whatever the contract sets. Ask for notice without undue delay of a suspected or confirmed incident affecting the hotel's data or service, with a maximum time for the first notice (24 hours, for example) and updates after that. The contract should also say what information the vendor sends, who the contacts are on each side, and that the vendor preserves evidence and cooperates with the hotel's investigation. An attack that takes the PMS down should trigger the notice even before anyone knows whether personal data was affected.

9. PCI DSS responsibilities

If the PMS vendor stores, processes or transmits card data, or can affect the security of the hotel's card data environment (through admin access or a payment integration, for example), the contract should say which PCI DSS requirements the vendor handles, which the hotel handles and which are shared. PCI DSS v4.0.1 calls for a written agreement in which the service provider acknowledges responsibility for the security of that data (requirement 12.8.2), annual monitoring of its compliance status (12.8.4) and a record of who handles each requirement (12.8.5). Ask for the vendor's attestation of compliance (AOC) every year, and check that it is current and covers the service the hotel buys, not another part of the vendor's business. See PCI DSS for hotels.

Service

10. Service level agreement (SLA)

The availability promised, how it is measured and what is left out of the count (scheduled maintenance, a failure of the hotel's own internet). Support hours, response time by severity and, separately, the time to restore the service: a reply within 15 minutes does not mean the system is back within 15 minutes. Service credits are one remedy, but they are often small, have to be claimed and may be the only remedy the contract allows. Check what happens after repeated or long outages: escalation and, for persistent failures, the right to terminate without penalty.

11. Backup and continuity

How often the vendor backs up, how long backups are kept, how fast it restores and whether the hotel can ask for a test. Agree recovery objectives for the PMS: how much data the hotel can afford to lose (RPO) and how long the system can be down (RTO), and ask whether tested recovery procedures back those numbers. What the hotel gets to keep working during an outage: exported reports such as the arrivals and in-house lists, and contingency access. A backup held only inside the vendor's environment does not help the front desk while that environment is down. See the IT contingency plan.

Term and exit

12. Term, renewal and penalty

The initial term, whether renewal is automatic, how far ahead the hotel has to give notice that it will not renew and how the early termination penalty is calculated. A long notice period, missed in the calendar, locks the hotel in for another cycle.

13. Exit support and data deletion

What the vendor does before and after the contract ends: when transition support starts, how long the old system stays available while the hotel migrates and reconciles data, whether more than one export is allowed, and the cost of that support. Deletion of the data comes after the transfer is confirmed and the retention periods are met, confirmed in writing. The LGPD provides for data to be deleted when processing ends, with exceptions such as retention for a legal obligation (art. 16).

14. Assignment and change of control

What happens if the hotel is sold or changes its CNPJ (company tax number), and if the vendor is bought by another company. Check whether the hotel can assign the contract to a buyer and whether that needs the vendor's consent. A change of vendor owner does not change the contract by itself, so set out what the hotel can do if it leads to a material change: less support, higher charges, a module withdrawn. See IT due diligence when buying a hotel.

15. Limitation of liability

How much the vendor is liable for. Standard contracts often cap liability at a few months of fees. Check whether the cap also applies to data breaches and LGPD breaches, which losses are excluded, whether service credits are the only remedy and whether the vendor is insured.

How to negotiate

Ask for the draft contract together with the commercial proposal, not after you have chosen. Compare the finalists' drafts clause by clause against the list above, with the same attention given to price. Promises made in the demo (a report, an integration, a deadline) go into a functional annex to the contract. And take the draft to the hotel's lawyer before signing. See also the PMS comparison for Brazil, how to choose a PMS with Pix integration and how to reduce licence costs.

Next steps

HotelTI reviews the technical and operational side of PMS and other system contracts: scope, integrations, data, SLA and exit. Legal review is for the hotel's lawyer. This work is part of our hotel systems service and of supplier management. We do not resell software or have agreements with specific vendors. Talk to our team.

Sources

• Presidência da República, Lei 13.709/2018, General Data Protection Law (LGPD), arts. 5, 16, 33 to 36, 39 and 46, planalto.gov.br
• ANPD, Guidance on the definitions of personal data processing agents and the DPO (in Portuguese), gov.br/anpd
• ANPD, Resolution CD/ANPD 15, Security Incident Reporting Regulation (April 2024), in.gov.br
• PCI Security Standards Council, PCI DSS v4.0.1, requirements 12.8.2, 12.8.4 and 12.8.5, pcisecuritystandards.org
• ANPD, Resolution CD/ANPD 19, International Data Transfer Regulation (August 2024, in Portuguese), in.gov.br
• ANPD, Resolution 32, adequacy of the European Union (January 2026, in Portuguese), in.gov.br