LGPD for hotels: what the law requires in practice

Hotels collect personal data in almost every interaction with a guest: registration at booking, check-in, payment, room preferences, service requests and loyalty programmes. It is a varied volume of personal data, handled routinely by several teams and systems.

The LGPD (Brazil's data protection law, Lei Geral de Proteção de Dados) applies to this collection just as it applies to any other sector. The obligations do not change because of the industry. What changes is how they apply to the day-to-day running of a hotel.

What the LGPD requires, in practice

The LGPD requires every processing of personal data to have a legal basis. For hotels, the most relevant bases are performance of the accommodation contract (booking, stay, billing and the operational communications linked to them), compliance with a legal obligation (such as the FNRH guest registration form and issuing invoices), legitimate interest (for example, property security with CCTV) and consent (generally for marketing and communications unrelated to the service the guest has booked).

This means you can use a guest's email address to send the booking confirmation and the invoice without asking for explicit consent. For newsletters or promotions, the safest basis is documented consent, with the option to opt out at any time. Legitimate interest can, in theory, support an occasional commercial contact, but it requires a case-by-case balancing test and is easier to challenge. For marketing, it is safer not to rely on it.

Beyond the legal basis, the LGPD requires:

Transparency: guests need to know what data you collect, for what purposes and how long you keep it. This belongs in the privacy policy, which must be available before the booking.

Data subject rights: any guest can ask for access to their data, correction of inaccurate information, or deletion of data that is not needed for legal obligations. You need a process to handle these requests.

Incident reporting: if a security incident may cause relevant risk or harm to data subjects, you must report it to the ANPD (Brazil's data protection authority) and to the affected data subjects within 3 business days of becoming aware of it (ANPD Resolution No. 15/2024, in Portuguese; small processing agents have twice the time). Without a documented incident response process, this becomes chaotic in practice.

Where hotels tend to have gaps

Frequent gaps in hotels include:

Guest data spread across disconnected systems: the PMS, front desk spreadsheets, staff email, the online booking system and the WhatsApp channel holding conversations with personal data. Without a map of where the data is, you cannot meet deletion obligations or answer data subject requests accurately.

No proper contracts with suppliers: suppliers that process guest data on the hotel's behalf, usually the PMS, the booking system, the email marketing platform and the payment system, tend to qualify as processors under the LGPD. Contracts with them need specific data protection clauses.

Marketing without a clear legal basis: promotional emails sent to past guests without documented consent are a frequent point of exposure: without a documented legal basis, the hotel will struggle to justify the sending if the data subject or the ANPD asks.

Our hospitality compliance team can assess your current situation and guide the compliance process.

What data your hotel processes, system by system

To know whether your operation is compliant, it helps less to talk about "personal data" in the abstract and more to map where it sits. In a typical hotel, that covers:

PMS: name, ID document, address, contact details, stay history and guest preferences, plus the FNRH data.

Booking engine and OTAs: the same identification data, plus partial payment data and, in the case of OTAs, a transfer of data that happens outside the hotel's website but is still a shared responsibility when the hotel uses that data for check-in.

Payment providers: card and transaction data, handled under PCI DSS as well as the LGPD (see the PCI DSS guide for hotels).

CCTV: images of guests and visitors in common areas are also personal data under the LGPD, with their own retention policy and access control over the recordings.

Guest Wi-Fi: connection logs, which Brazil's Internet Civil Framework (Marco Civil da Internet, art. 13) requires connection providers to keep for one year. Whether that obligation reaches the hotel's Wi-Fi is something to assess with your lawyers, and these logs need the same care as any other personal data.

Marketing: email, phone and, increasingly, the guest's WhatsApp number, used for re-engagement and promotions, generally processed on the basis of documented consent with an opt-out option.

Front desk WhatsApp: conversations with guests containing documents, receipts and preferences, one of the hardest channels to map and one of the easiest to forget in an audit.

AI tools: chatbots and guest service assistants that process messages and sometimes the guest's booking data; see our guide on AI in guest service and the LGPD.

Employee and supplier data: HR data on staff and suppliers' contact and contract details, often left out of the mapping because attention goes only to guest data.

In many flows, the hotel acts as the controller (the party that decides the purpose of the processing) and the technology supplier (PMS, booking engine, marketing platform, AI supplier) can act as a processor, as long as it processes the data on the hotel's behalf and according to its instructions. If the supplier uses the data for its own purposes, it becomes a controller for that processing. The classification depends on who makes the decisions, as the ANPD guide on processing agents (in Portuguese) explains. Once each party's role is defined, the contract with each supplier, including data protection clauses and, where applicable, a data processing agreement (DPA), becomes a central part of compliance, not a legal detail. It is also worth knowing where each supplier processes the data: if the PMS, the marketing platform or the AI tool processes data outside Brazil, there is an international transfer, which needs one of the mechanisms in art. 33 of the LGPD, such as the standard contractual clauses approved by ANPD Resolution No. 19/2024 (in Portuguese). And if one of these systems suffers an incident, the reporting deadline starts when the hotel becomes aware of it: see what to do in the first 48 hours after a data breach.

The FNRH and the consent form: the paperwork behind check-in

Two documents hold much of the legal basis for processing data at check-in. The FNRH (Ficha Nacional de Registro de Hóspedes, the national guest registration form), required by the Ministry of Tourism for public security and statistical purposes, is a long-standing hotel obligation, but it also has to be treated as a personal data record under the LGPD: who has access to it, where it is stored and how long it is kept before secure disposal.

Since 20 April 2026, the FNRH has been submitted exclusively through the Ministry of Tourism's FNRH Digital platform, and the paper form is no longer accepted. The hotel can connect its PMS to the platform by API or use the government's free system at the front desk, and it must keep its Cadastur registration up to date, with a designated person responsible for the FNRH. For the LGPD, the change matters: guest data is now transmitted to a public body, and that transmission should appear in the hotel's data mapping and privacy policy. It is also worth reviewing the contract with the PMS supplier to make clear who answers for integration failures and for data sent with errors.

The consent form, on the other hand, is the most common basis for uses of guest data that go beyond the stay, such as sending promotions, using images on social media or sharing data with commercial partners. Some of these uses can rest on another legal basis, such as legitimate interest, but only with a documented case-by-case assessment. What does not work is assuming that the FNRH completed at check-in covers these uses: it does not.

The data protection officer (DPO)

The LGPD (art. 41) requires the controller to appoint a person in charge of processing personal data (the encarregado, equivalent to the GDPR's Data Protection Officer, or DPO). The ANPD exempts small processing agents, such as micro and small businesses, from this appointment as long as they do not carry out high-risk processing, but they must still offer a communication channel for data subjects. In practice, a hotel that does not qualify as a small processing agent, because of its revenue or because it carries out high-risk processing, must appoint a DPO, who can be an internal person or an external service. Even when the appointment is not required, ANPD Resolution No. 2/2022 (in Portuguese) treats it as good practice.

A DPO receives data subject requests, advises the team on privacy good practice and is the point of contact with the ANPD in case of an inspection. HotelTI offers this as an outsourced service as part of its compliance services. Talk to our team.

Sources

• ANPD, Resolução CD/ANPD nº 15, Regulamento de Comunicação de Incidente de Segurança (security incident reporting regulation, April 2024, in Portuguese), in.gov.br
• ANPD, Resolução CD/ANPD nº 2, Regulamento de aplicação da LGPD para agentes de tratamento de pequeno porte (LGPD regulation for small processing agents, January 2022, in Portuguese), in.gov.br
• ANPD, Guia Orientativo para Definições dos Agentes de Tratamento de Dados Pessoais e do Encarregado (guidance on processing agents and the DPO, version 2.0, 2022, in Portuguese), gov.br/anpd
• Ministry of Tourism, Portaria MTur nº 41, que institui a FNRH em meio digital (ordinance establishing the digital FNRH, November 2025, in Portuguese), gov.br/turismo