Have you heard of Royal Decree 933/2021? If your business entails accommodation or car rental, this article is especially for you. On the 2nd of December 2024 this new legislation came into force, which changes the rules of the game regarding the registration of travellers and clients. Are you ready to comply with the new obligations? Let's break down the key points so that you don't get caught by surprise.
Paralegal
Royal Decree 933/2021 (Real Decreto 933/2021 por el que se establecen las obligaciones de registro documental e información de las personas físicas o jurídicas que ejercen actividades de hospedaje y alquiler de vehículos a motor) establishes new record-keeping and reporting obligations for companies and individuals engaged in accommodation and car rental. Of course, these entities are used to collecting personal data about their customers, but the controversy of this legislation comes from the fact that it obliges them to collect much more personal data than before, something that customers may not feel comfortable with and which subjects companies to more data protection responsibilities.
On the other hand, the aim of these new requirements is to improve public security "in the face of terrorist threats and other very serious crimes committed by criminal organisations".
The list is long, but basically if you offer accommodation or rent cars without a driver, then these provisions apply to you. For example:
Hotels, hostels, guesthouses, lodgings
You have to create and maintain a record of your customers' data.
:Get ready to ask your clients for more information. Now, in the case those whose professional business is providing accomodation, the data that will have to be collected includes, but is not limited to:
We recommend that you take a look at Annexes I and II of the Royal Decree to find out exactly what data you must register and report to the authorities, depending on the activity you carry out and whether or not you do so professionally.
The accommodation or car rental company shall ensure that the data are correct and match the documents or systems which confirm the identity of the users, who shall display or provide that information.
You'll have to store all of this information for 3 years from the end of the service contracted.
You must send this information to the Police or Civil Guard within the 24 hours following:
These communications shall be made electronically. You are exempt if you carry out accommodation activities in a non-professional manner, in which case you may make these communications by non-electronic means, via the procedure to be determined.
Note: If you carry out accommodation activities on a non-professional basis, you are also exempt from the obligations of documentary registration and data storage, and are only subject to the obligation of communication to the authorities.
LEGAL AND FINANCIAL OBLIGATIONS OF COMPANIES IN SPAIN
The Ministry of the Interior has created an online platform to facilitate this process. It's called SES.HOSPEDAJES and it's where you will have to submit all the information.
Failure to take these regulations seriously could be costly. Penalties for non-compliance are governed by the provisions of Organic Law 4/2015 (Ley Orgánica 4/2015):
Serious infringements, with a fine of 601 to 30,000 euros:
Minor infringements, with a fine of 100 to 600 euros:
Liability for the infringements committed shall be borne directly by you, as the natural or legal person who carries out or intermediates in the performance of the activities.
With so much personal data at stake, data protection becomes crucial. This is where the General Data Protection Regulation (GDPR) comes in. You'll need to:
We understand that all of this information can be a headache. Complying with Royal Decree 933/2021 and at the same time making sure you respect the GDPR isn't an easy task. This is where our law firm can lend you a hand. At CONESA LEGAL we specialise in data protection, as well as commercial, labour and tax regulations and obligations. We can help you analyse your current situation and ensure that your handling of personal data complies with the GDPR, providing you with, among other things, the necessary policies and clauses adapted to your needs.