Personal data protection in hospitality: hotels, resorts, homestays and serviced apartments

1. Who must comply with data protection in hospitality in Vietnam?

Data protection in hospitality applies to every business that accommodates guests overnight, and to the vendors handling its guest data:

• Hotels, resorts and guesthouses: check-in records, payments, CCTV, restaurants and spas.
• Homestays, villas and serviced apartments: often household businesses taking bookings through OTAs and messaging apps.
• Hotel chains and management companies: central reservation systems, loyalty programmes and CRM.
• Technology vendors: property management systems (PMS), channel managers and Wi-Fi portals.

The PDPL has no dedicated article for accommodation, unlike insurance (Article 26) or banking (Article 27), so data protection in hospitality relies on the PDPL's general duties, its articles on recording, children, employees and advertising, and the residence laws.

The sector rarely qualifies for the small-business relief. ID card images and bank card details are sensitive personal data (Points i and k, Clause 1, Article 4 of Decree 356/2025/ND-CP). Guest numbers also add up fast: by LexData's estimate, a hotel with a few hundred rooms can pass 100,000 data subjects within a few years. Small businesses and household businesses that directly process sensitive data or reach that threshold cannot skip the DPIA and the data protection staff (Clauses 2 and 3, Article 38 of Law 91/2025/QH15; Article 41 of Decree 356/2025/ND-CP).

2. Guest registration: the legal basis behind data protection in hospitality

The provider must ask a foreign guest to present a passport or international travel document before agreeing to the stay (Clause 1, Article 33).

Processing hotel guest data for these filings needs no consent under Clause 1, Article 19 of the Personal Data Protection Law No. 91/2025/QH15: Point dd (other cases provided by law) and Point c (state management activities under the law). Data needed to perform the booking can rely on Point d (performing an agreement with the data subject). See processing without consent.

Clause 2, Article 19 still requires a processing procedure, safeguards, periodic checks and a channel for complaints. Article 47 of Decree 330/2026/ND-CP fines organisations VND 10–20 million for missing procedures, checks or a complaints channel (Clause 1); VND 20–30 million for missing safeguards that lead to a leak (Clause 2); and VND 30–50 million for using the exemption to collect or process more than necessary (Clause 3).

3. Passport copies and ID photos: where data protection in hospitality draws the line

Staff photographing ID cards and passports on their phones, posting them in team chats and keeping them indefinitely: this is the biggest risk in data protection in hospitality.

• Beyond what the report needs. Clause 2, Article 30 of the Law on Residence lists data fields, not document images. Clause 2, Article 3 of the PDPL limits collection to a specific scope and purpose. See data protection principles.
• ID card images are sensitive (Point i, Clause 1, Article 4 of Decree 356/2025/ND-CP) and need restricted access and dedicated security procedures (Clause 2, Article 4). Passport and ID numbers are basic data (Clause 7, Article 3). Passport copies are not on the sensitive list, but they are enough to impersonate someone, so LexData recommends the same protection.
• Kept too long. Data may be kept only as long as its purpose requires (Clause 3, Article 3 of the PDPL) and must be deleted once the purpose is fulfilled (Point b, Clause 1, Article 14). The exception is the duty to keep guest and visitor information for at least 36 months (Clause 6, Article 44 of Decree 96/2016/ND-CP); that duty covers the information, not images of ID documents.

Fines for organisations (individuals pay half, Clause 1, Article 7 of Decree 330/2026/ND-CP): collecting data beyond its scope or purpose, VND 30–50 million, or VND 50–80 million for sensitive data (Clauses 1 and 4, Article 48); failing to tell guests their sensitive data is being processed, VND 30–50 million (Point h, Clause 1, Article 43).

LexData recommends typing the required fields from the original document and handing it straight back, and making sure any scanning software does not store images on reception computers.

4. Hotel CCTV: where cameras may go and how to give notice

Cameras are the most visible part of data protection in hospitality. Clause 1, Article 32 of the PDPL allows recording in public places without consent to maintain public order and protect the lawful rights and interests of organisations and individuals. In return, the hotel must tell people they are being recorded (Clause 2), use the footage only for its purpose (Clause 3) and keep it only as long as necessary (Clause 4). The law sets no number of days; set your own period and automatic overwrite.

Article 71 of Decree 330/2026/ND-CP expressly covers "areas where services are provided to customers", so it applies directly to hotel CCTV in lobbies, restaurants and corridors:

• VND 10–20 million: no physical sign or electronic notice in an easily noticeable place; no controller contact details when a guest asks to retrieve their images (Clause 1).
• VND 30–50 million: using footage for commercial purposes, behaviour analysis or automated facial recognition profiling without lawful consent; unlawful extraction, sharing or publication, unless on a written request from a competent authority (Clause 2).

No-go areas. Guest rooms, bathrooms, changing rooms and spa treatment rooms are not public places, so Article 32 does not cover them; footage there concerns private life, a sensitive category (Point c, Clause 1, Article 4 of Decree 356/2025/ND-CP). Keep cameras out.

Cameras also record staff. Clause 3, Article 25 of the PDPL allows monitoring technology only if employees clearly know about it. Installing cameras in the workplace without telling employees is fined VND 50–70 million (Point c, Clause 2, Article 61 of Decree 330/2026/ND-CP). See CCTV and camera surveillance.

5. OTAs, channel managers and PMS: who is responsible for hotel guest data?

A booking made on Booking.com, Agoda or Expedia passes through the OTA, a channel manager and the PMS before the guest reaches the desk. In data protection in hospitality, getting the roles right decides who owes which duty. In LexData's analysis:

For a cloud PMS or CRM, the contract must describe the data flows, roles and security measures, and data must be encrypted at rest and in transit (Clauses 2 and 4, Article 12 of Decree 356/2025/ND-CP). An incomplete contract is fined VND 20–50 million, and no encryption VND 50–70 million (Point b, Clause 1 and Point b, Clause 2, Article 69 of Decree 330/2026/ND-CP). See controller vs processor.

6. Cross-border transfers in data protection in hospitality

Most PMS, channel managers and central reservation systems are hosted abroad, so almost every property meets this duty. Under Clause 1, Article 20 of the PDPL, storing or processing guest data on systems outside Vietnam is a cross-border transfer. The hotel must prepare a dossier on Form 09 and file it with the A05 Department within 60 days of the first transfer (Clause 2, Article 20; Article 18 of Decree 356/2025/ND-CP). See cross-border data transfer.

Three exemptions are often cited and should be read carefully:

• Guests transferring their own data (Point c, Clause 6, Article 20): a guest booking on a foreign OTA. When the hotel loads data into a PMS abroad, the hotel is the transferor.
• Employee data stored in the cloud (Point b, Clause 6, Article 20): covers staff data only, not guest data.
• Providing data to conclude contracts or complete procedures relating to hotels (Point dd, Clause 3, Article 17 of Decree 356/2025/ND-CP). In LexData's view, it fits a specific booking, not long-term storage of the whole guest database or group marketing.

Article 56 of Decree 330/2026/ND-CP fines VND 30–50 million for not preparing or not filing the dossier on time (Clause 1); VND 50–100 million for no binding contract with the recipient, or not telling guests that their data goes abroad (Clause 2); and 1–5% of the previous year's revenue in Vietnam where a missing dossier or misdeclared data flow leads to a leak affecting 10,000 or more Vietnamese citizens (Clause 3).

7. Card data, health data and children: which sensitive data do hotels hold?

These three categories are often missed when reviewing data protection in hospitality.

Payment cards. Bank card details are sensitive data (Point k, Clause 1, Article 4 of Decree 356/2025/ND-CP). Avoid emailed card photos, paper authorisation forms and card numbers in PMS notes; use payment links or the gateway's tokenisation. PCI DSS is a card-scheme requirement, not a PDPL rule, but a good benchmark.

Health. Allergies, disabilities and spa health questionnaires are health data, a sensitive category (Point d, Clause 1, Article 4). When asking for consent, the hotel must tell guests the data is sensitive (Clause 4, Article 6 of Decree 356/2025/ND-CP).

Children. Recording children's details for the stay report falls under Clause 1, Article 19 of the PDPL, so no separate consent is needed. Kids' clubs and children's photos on social media are different: the legal representative exercises the child's rights, and publishing private information about a child aged 7 or over needs the consent of both the child and the representative (Clause 2, Article 24). Article 60 of Decree 330/2026/ND-CP fines VND 30–50 million for processing children's data without the required consent (Clause 1), and VND 50–100 million for publishing the private life of a child aged 7 or over without both consents (Point a, Clause 2). See children's personal data.

8. Loyalty, email marketing and Wi-Fi: when is separate consent needed?

Loyalty, promotions and retargeting after check-out are new purposes that need their own basis, a part of data protection in hospitality that is often overlooked.

• Consent per purpose, with no mandatory condition tied to other purposes (Points a and b, Clause 4, Article 9 of the PDPL). A pre-ticked "send me offers" box is a default opt-in, which Clause 3, Article 6 of Decree 356/2025/ND-CP prohibits.
• Advertising. Article 28 of the PDPL is written for advertising service businesses. It applies directly when a hotel shares data with ad agencies or networks, and is a safe benchmark when the hotel sends its own offers. Guests must know the content and frequency and have a way to refuse (Clause 3); tracking on websites or apps for behavioural advertising needs consent (Point a, Clause 8).
• Wi-Fi. A captive portal that makes marketing consent a condition of access is a prohibited bundled consent; ask only for a room number or code.

Fines: mandatory conditions or default opt-ins, VND 30–50 million (Points b and c, Clause 1, Article 43 of Decree 330/2026/ND-CP); using basic data to deliver ads without consent, VND 30–50 million, or VND 50–70 million for sensitive data (Point a, Clause 1 and Point a, Clause 2, Article 63).

9. Four common risks in data protection in hospitality

• Booking systems breached for years. In the Marriott case, the Starwood reservation database was compromised in 2014 and discovered only in September 2018, two years after Marriott acquired Starwood. About 339 million guest records were affected, including more than 5 million unencrypted passport numbers; in 2020 the UK ICO fined Marriott GBP 18.4 million.
• Passport copies in messaging apps, still on the phones of staff who have left.
• Guest details disclosed by phone. A caller claims to be a relative and asks for a room number. Providing personal data to others without the guest's consent is fined VND 20–30 million (Clause 2, Article 49 of Decree 330/2026/ND-CP).
• Shared OTA and PMS passwords: one compromised account lets fraudsters message guests from the official channel and ask for payment.

10. After a breach of hotel guest data, who must be notified within 72 hours?

If a breach may harm guests' life, health, honour, dignity or property, the hotel must notify the A05 Department within 72 hours of discovery (Clause 1, Article 23 of the PDPL), using the content in Clause 1, Article 28 and Form 08 of Decree 356/2025/ND-CP. A PMS vendor that discovers an incident must inform the hotel promptly (Clause 1, Article 23). See the 72-hour breach rule.

Unlike banks, hotels have no statutory duty to notify each guest when card data leaks. Notice to data subjects within 72 hours applies only to location and biometric data (Article 29 of Decree 356/2025/ND-CP), for example facial recognition data used at check-in. Telling guests early so they can block cards still limits harm. Notifying the A05 Department later than 72 hours is fined VND 40–60 million (Clause 3, Article 54 of Decree 330/2026/ND-CP). An outsourced DPO from LexData can handle the incident and the regulator notice within the 72-hour window.

11. Data protection in hospitality: obligations and fines at a glance

12. Data protection in hospitality for international chains and management companies

Many upscale hotels in Vietnam run under a management agreement: a Vietnamese owner holds the property, an international group supplies the brand, systems and managers. Three points are often missed when group standards meet data protection in hospitality in Vietnam:

• Roles in the contract. The controller must set out each party's responsibilities, rights and duties in contracts involving personal data processing (Point a, Clause 1, Article 37 of the PDPL). The agreement should say who controls stay, loyalty and employee data, who files the DPIA and who reports incidents.
• Global brand standards. A rule to scan every guest's passport into a global system needs adjusting to Vietnam's purpose limitation and sensitive-data list.
• Transfer dossiers. Each flow to the group's data centre needs a cross-border transfer impact assessment. Unlike the GDPR, the PDPL has no adequacy mechanism and no general legitimate interests basis: Point a, Clause 1, Article 19 allows processing without consent only to protect rights or legitimate interests against an infringement, and the controller or processor must prove it.