OWNER COMPLIANCE GUIDE · REVIEWED 7 SEPTEMBER 2026

SES.HOSPEDAJES Guest Registration for Holiday Rentals: 2026 Owner Guide

A practical guide to Spain’s guest-registration and reporting rules for Costa del Sol holiday rentals: who is covered, what must be communicated, the 24-hour timing rule and how to avoid collecting excessive identity data.

Important: This is general information, not legal advice. Your duties can depend on whether you operate professionally or non-professionally and on who is legally responsible for the accommodation activity. Confirm your setup with the Ministry of the Interior or a qualified adviser.

The short answer

Holiday-rental operators in Spain should treat guest reporting as a separate obligation from the tourism registration of the property. Andalucía’s Registro de Turismo de Andalucía identifies the tourist accommodation. Spain’s national guest-reporting rules govern the information that accommodation providers communicate to the security authorities.

The main national rule is Real Decreto 933/2021. It applies across Spain to accommodation activities whether they are conducted professionally or not. The Ministry of the Interior provides the reporting service commonly known as SES.HOSPEDAJES.

Tourism registration and guest reporting are not the same

1. Tourism registration

A vivienda de uso turístico in Andalucía is handled through the regional tourism framework. The Junta de Andalucía’s VUT information hub explains the declaration, registration and update procedures. Our separate Andalusia tourist-licence guide gives owners an overview of that process.

2. Guest registration and communication

Real Decreto 933/2021 requires the responsible accommodation operator to collect specified booking and traveller information and communicate the required data to the competent authorities. This is an operational duty linked to reservations and stays, not a substitute for the property’s tourism registration.

Who is responsible?

Real Decreto 933/2021 defines as sujetos obligados the individuals and legal entities that carry out or intermediate in the covered accommodation activity. The Ministry says that each obligated subject must transmit the information it holds and is required to communicate. Where several intermediary entities participate, the intermediary with the direct and final contractual relationship with the guest is responsible for that communication.

A third party may submit information on an obligated subject’s behalf when properly authorised in a legally accepted form. That authorisation does not by itself change who is the sujeto obligado. The owner-management agreement should therefore identify the obligated subject or subjects, the authorised submitter, and who handles reservations, changes, cancellations and arrivals.

What information is involved?

The official annexes to Real Decreto 933/2021 list data about the accommodation business, the establishment, travellers, the booking or contract and payment. The exact fields depend on the activity and circumstances. Use the current official form or system as the definitive checklist instead of copying a third-party list that may become outdated.

For guest entry, the rule says entry forms are signed by guests aged over 14. For a child under 14, the accompanying adult provides the child’s details. Article 4 requires the recorded information to match a document or identity system used for verification. That does not authorise the provider to request an image, scan or upload of the guest’s full DNI or passport. For an in-person check, the AEPD says visual inspection is sufficient. For remote verification, it points to proportionate methods such as a digital certificate, comparison with payment-method data, or a one-time code sent to the guest’s telephone or email.

When must information be sent?

Before the activity begins, the obligated subject must also communicate the operator and accommodation details. Article 6 requires this within ten days after completing the applicable administrative formalities and, in every case, before the activity is actually carried on.

Article 6 states that the required operational information must be communicated immediately and, in all cases, within 24 hours of the relevant moment. The rule identifies the reservation or contract—and any cancellation—and the beginning of the stay as reporting moments.

A reliable process therefore needs more than a check-in task. It should capture the reservation when required, communicate any cancellation or change to previously communicated reservation data, and complete the arrival communication on time.

Do not ask guests to send copies of passports or identity cards

The Spanish Data Protection Agency’s June 2025 guidance says the guest-reporting duty does not authorise an accommodation provider to request a copy of a DNI or passport. An identity document contains more data than the regulation requires, and retaining a copy creates additional identity-theft and privacy risks.

The AEPD says the necessary data can be collected through an in-person or online form. Build the process around the required fields and an appropriate identity-verification method; do not keep an image of the whole identity document merely because it feels convenient.

How long should records be kept?

Article 5 requires professional operators to maintain a computerised register and retain the specified data for three years after the service ends. The same article creates an exception for non-professional accommodation providers from those documentary registration and retention duties, while leaving them subject to the communication duties in Article 6.

For Real Decreto 933/2021, the Ministry currently treats as professional those individuals and entities registered in the Censo de Empresarios, Profesionales y Retenedores. Professional subjects must keep the computerised register for three years from the end of the service. Non-professional accommodation providers are exempt from Article 5’s documentary-register and retention duties, but remain subject to Article 6’s communication duties.

A practical owner checklist

• Confirm who is the legally responsible accommodation operator.
• Complete the required establishment or operator registration before trading.
• Make sure the responsible person can access the official reporting system.
• Map the booking, cancellation and arrival data that must be reported.
• Create a workflow that can meet the 24-hour deadlines.
• Collect only the information required for the legal purpose.
• Do not request or retain a copy of a DNI or passport for the Real Decreto 933/2021 reporting process.
• Restrict staff and supplier access to guest data.
• Set the correct retention rule for your operator status.
• Document a failed transmission and its correction using only the minimum technical evidence needed. Do not create another copy of identity documents or unnecessarily duplicate the traveller dataset beyond any register lawfully required by Article 5.

What owners should ask a property manager

Ask who submits the reports, who monitors failed transmissions, what happens when a guest arrives late, how changes are handled and how personal data is protected. The answer should describe a repeatable process rather than simply saying “the system is automated.”

Our property-manager due-diligence checklist covers the wider operational questions, while our Costa del Sol property management service explains how we coordinate day-to-day rental operations.

Frequently asked questions

Is SES.HOSPEDAJES the same as a tourist licence?

No. Tourism registration and national guest reporting serve different purposes. A property may need to comply with both, plus municipal, building-community and other applicable rules.

Must every guest be reported?

Yes. The required traveller details must be collected and communicated for every person staying, including minors. Travellers over 14 sign the entry form; the accompanying adult supplies the details of a child under 14.

Can I ask guests to upload a passport photo?

The AEPD says the legal reporting duty does not permit requesting a full copy of a DNI or passport. Use a proportionate form and verification process that collects only the required data.

Does Airbnb or another platform report this for me?

Do not assume that it does. Each obligated subject must communicate the information it holds and is required to send. Where several intermediaries participate, the Ministry’s current FAQ places the communication on the intermediary with the direct and final contractual relationship with the guest. Confirm the actual contractual chain and retain evidence of any authorisation given to a third-party submitter.

Where can I check the primary law?

Start with the consolidated Real Decreto 933/2021 on the BOE website, the Ministry of the Interior’s official accommodation-reporting service and the AEPD’s data-minimisation guidance.

Next step for Costa del Sol owners

If you are reviewing an existing operation, audit one recent booking from reservation to departure: confirm what was collected, when it was communicated, who had access and what remains stored. Then compare that workflow with the official requirements and correct any gaps before the next arrival.

For the wider setup, read the Andalusia tourist-licence guide, compare holiday rental management costs, or use our free owner guide and rental-revenue form.

Official sources

• BOE: Real Decreto 933/2021
• Ministry of the Interior: accommodation reporting
• AEPD: identity-document copy guidance
• Junta de Andalucía: viviendas de uso turístico