LGPD and Compliance for Hotels
LGPD compliance, guidance aligned with ISO 27001 and PCI DSS, and supplier management for a compliant hotel operation.
What's included
Compliance is not a one-off project. We support the hotel from initial alignment through to the ongoing maintenance the LGPD and industry standards require, across the areas below. Specific legal matters, such as contracts and documents with legal effect, are signed off by the hotel's legal counsel.
Assessment and gap analysis
Mapping the guest personal data the hotel collects, stores and shares, including the national guest registration form (FNRH), and comparing it against the LGPD, ISO 27001 and PCI DSS, with a prioritised remediation plan.
Policies and procedures
Privacy and consent documents, plus information security, acceptable use and access control policies, adapted to how the hotel operates.
Contracts and suppliers
Data processing agreements (DPAs) reviewed and security questionnaires for the suppliers that process guest data.
Data subject rights
Defined processes for responding to requests to access, correct or delete data within the legal deadline.
Audit readiness and support
Internal reviews ahead of external audits to find non-conformities early, and support during the audit itself, with the documentation organised and ready.
Data breaches and ANPD notification
A process to assess, document and, where required, notify the ANPD and affected guests of a personal data breach, working alongside the incident response plan.
ISO 27001 and PCI DSS
Alignment with ISO 27001 information security guidelines, and support in defining PCI DSS scope (including skimming checks on POS terminals) and preparing for the SAQ or a QSA assessment, where the hotel processes cards.
Retention and disposal
Clear rules on how long to keep each type of data, including in backups and in the data used for reporting (BI), and how to dispose of it securely.
Internal IT and security audits
Periodic checks of access rights, configurations and patch status, to confirm controls work in practice and not just on paper.
Records of processing and RIPD
Records of processing activities, as required by Article 37 of the LGPD, with the legal basis for each use of data, and a data protection impact assessment (RIPD) where processing carries higher risk.
Risk register
A likelihood and impact matrix that is maintained and kept up to date, not a document written once and forgotten.
External DPO (encarregado)
We support the hotel's DPO or take on the role as an external DPO, the point of contact for guests and the ANPD.
- Gap analysis report against the LGPD, ISO 27001 and PCI DSS
- Privacy and data protection policy
- Risk register with a likelihood and impact matrix
- Data processing agreement (DPA) templates for supplier contracts
- Prioritised remediation plan
Why this matters for your hotel
Hotels collect and store large volumes of guest personal data: identity documents, payment details, preferences and stay history. The LGPD, Brazil's data protection law, treats this as a legal responsibility, not an option. That includes the FNRH (the national guest registration form), a Ministry of Tourism requirement that also needs access control and a defined retention period, and the consent form, the most common legal basis for uses of guest data beyond the stay itself, such as marketing and use of images.
Being compliant reduces the risk of sanctions and legal liability, and strengthens guest trust in your brand. We help your hotel organise processes, policies and contracts in a clear, auditable way, with guidance aligned with the ANPD's guidelines, ISO 27001, PCI DSS (for payment data) and, where applicable, international references such as the European GDPR, for hotels that actively market their services to European customers or belong to groups with operations in Europe.
An external audit should not bring surprises. That is why the work includes mapping exactly where the gaps are before a formal assessment, keeping a living risk register (not a static document filed away after the first review) and simulating the auditor's process so your team arrives prepared, with the right evidence organised.
Related articles (in Portuguese)
PCI DSS for hotels: a practical v4.0.1 guide for hotel operations
Hotels have one of the most complex PCI DSS scopes in retail: PMS, POS, booking engine and OTAs create multiple cardholder data environments with different requirements.
Read article
LGPD for hotels: what the law requires in practice
Hotels collect personal data in almost every guest interaction. The concrete obligations, and where the gaps are most common.
Read article
ISO 27001 for hospitality: is certification worth it for your hotel?
When ISO 27001 certification makes sense for hotels, what the process looks like and what alternative exists for smaller operations.
Read articleFrequently asked questions about compliance in hospitality
How does a hotel apply the LGPD?
In four steps: map which guest and employee data each system handles, and on what legal basis; adjust contracts with the suppliers that handle that data (PMS, booking engine, Wi-Fi, cameras, gateway); define access, retention and disposal policies and a process for handling data subject requests; and prepare the incident response plan. Compliance is not a document, it is a set of routines that need to keep working.
Which guest data does a hotel need to protect?
More than most people think: identity documents and registration details from the FNRH, card data and payment receipts, stay history and preferences, camera footage, Wi-Fi connection logs (which, under Brazil's Marco Civil da Internet, we recommend keeping for one year), health information given for accessibility or dietary needs, and any biometric data, which the LGPD classifies as sensitive. Each category has its own retention and access rules.
What is an LGPD assessment and what does it deliver?
It is a survey of all the hotel's personal data flows, system by system and supplier by supplier, compared with what the law requires. It delivers the data inventory, the list of gaps by severity, the contracts that need a processor clause and a prioritised compliance plan. Without that assessment, the privacy policy describes a hotel that does not exist.
Does a hotel need PCI DSS?
Every hotel that accepts cards, directly or indirectly through a gateway, is in scope for PCI DSS, a contractual requirement of the card schemes and the acquirer, not a law. For most hotels, the practical obligation is the annual self-assessment questionnaire (SAQ). The most valuable work is reducing scope: a segmented network, terminals that do not expose the card number to the PMS, and no card data in spreadsheets or email.
Is ISO 27001 certification worth it for a hotel?
For many independent hotels, the value lies in using ISO 27001 as a reference set of controls, not in pursuing the certificate. Certification makes sense when a corporate contract, an international brand or an investor requires it. Either way, the starting point is the same: an asset inventory, a risk analysis, policies and evidence that the controls work.
Does a hotel need a data protection officer (DPO)?
As a rule, yes. The LGPD requires the controller to appoint a data protection officer (the "encarregado"), and the ANPD exempts small processing agents from that appointment, provided they do not carry out high-risk processing and keep a communication channel open for data subjects. In hospitality, the volume and sensitivity of guest data usually justify the appointment even where an exemption applies. It does not need to be a dedicated position: it can be an employee with that formal responsibility or an external service. We can support the hotel's DPO or, if needed, take on the role as an external DPO.
Ready to bring your operation into compliance?
Identify the LGPD, PCI DSS or ISO 27001 gaps in your operation. We work in English or Portuguese, Monday to Friday, 9:00 to 18:00 Brasília time.