Accommodation businesses collect a lot of personal information: ID numbers in guest registers, contact details on booking forms, card details and email lists for marketing. The Protection of Personal Information Act (POPIA) sets out how that information must be handled.

The basics

• Collect only what you need for the booking and any legal requirement.
• Tell guests why you collect it, in your booking terms or on your website.
• Keep it secure: lock away paper registers and protect computers and booking systems with passwords.
• Ask before marketing: guests must opt in to newsletters, and every email needs an easy way to unsubscribe.
• Register your Information Officer with the Information Regulator. For most small businesses this is the owner.

Third parties

If a booking platform, payment provider or marketing service handles guest data for you, make sure your agreement with them covers how they protect it.

This is general guidance, not legal advice. If you are unsure, speak to a legal adviser.

Members can raise questions about this at the next HTA stakeholder meeting, or contact the committee.