Booking details, allergy notes, CCTV footage, loyalty records and marketing lists are all personal data under UK GDPR and the Data Protection Act 2018. Venues need a lawful basis for each use, such as contract for handling a booking or legitimate interests for some security measures, and must give clear privacy information explaining what they collect, why and for how long. Marketing emails and texts are also covered by the Privacy and Electronic Communications Regulations, which generally require consent, though existing customers can sometimes be marketed under the soft opt-in if they were given a chance to opt out. Allergy and health notes are special category data and need extra care and a condition for processing.
Guests have rights to access their data, correct it and in some cases have it erased, and requests must be handled promptly. Security matters: shared logins, unencrypted spreadsheets and old booking printouts are common weaknesses. Many businesses must pay a data protection fee to the Information Commissioner's Office, and serious breaches may need reporting.
What we ask on the show
- Would your venue be ready if a guest asked to see their data?
- How careful are teams with allergy notes in booking systems?
- Is the soft opt-in a loophole or common sense?
- What's the riskiest data habit you've seen in hospitality?