Guest registration in Mallorca – the key questions about SES.Hospedajes

SES.Hospedajes is the Spanish Ministry of the Interior's central reporting system for guest data. It is based on Royal Decree 933/2021 (RD 933/2021, published in the official state gazette BOE on 26 October 2021, reference BOE-A-2021-17461). Its use has been mandatory since 2 December 2024, replacing the earlier procedures – the paper registration form and the Webpol and Hospederías systems.

Every accommodation provider in Spain, explicitly including private holiday-let owners. It covers holiday flats and houses just as much as hotels, hostales, guesthouses, campsites, country houses and hostels. Car hire companies fall under the same rules.

Yes. The duty does not depend on how much you let. Even if you only occasionally hand your property over to holiday guests, you have to be registered and report every stay.

Yes – but you do not need a separate account for each property. The system has two levels: first the host is set up as the responsible individual or company, and beneath that each individual property with its own code and its own credentials for submitting data. So if you look after several properties, you manage them all under one account. If you manage properties for different owners, each owner is a separate host in the system – because it is the host who is legally liable for the report.

Yes. Access to the government's electronic platform works with a digital certificate, the electronic Spanish ID card (DNIe) or Cl@ve, Spain's official digital identity service. Registration itself is free.

Allow time for this: a digital certificate is not issued instantly, and Cl@ve may require you to identify yourself in person at a public office. Without one of these, registration is impossible – in our experience this is the first hurdle for owners who do not live in Spain.

Yes. As a foreign private individual you need your NIE (the Spanish tax and identity number for foreigners); if you let through a Spanish company, you need its NIF (company tax number). You also provide the full address of the property, its category, the autonomous region and – if you have one – the number of your tourist licence.

Yes. Registration, online check-in, data submission and record-keeping can all be organised remotely. A contact on the ground is still valuable, though – for instance when details of the property change, a submission is rejected or official post arrives.

RD 933/2021 lists the mandatory fields in Annex I. They include, among others:

About the guest: full name, ID number (DNI, NIE or passport), date of birth, nationality and sex.

About the stay: arrival date, planned departure date and the exact address of the property.

About the booking: the payment method, among other details. That one surprises most hosts – but it is part of the report. On card numbers, the Spanish data protection authority has clarified that the last four digits are normally enough.

The rules require the report to be made without delay and tolerate a maximum of 24 hours. So 24 hours is the upper limit, not the normal deadline.

Important: there are two separate reports with two different starting points.

1. The booking report – triggered by the booking, the contract or a cancellation.
2. The guest report (parte de viajeros) – triggered by the start of the stay, that is, check-in.

Each is subject to its own 24-hour limit. If you only think about check-in, you miss the first one.

The registration form has to be signed by everyone aged 14 and over. For children under 14, the details are given by the accompanying adult, who also states the family relationship. So children do not disappear from the report; they are simply recorded differently.

Yes, and it is the most practical way. With a digital online check-in your guests enter their own details before they travel. The system checks the entries for completeness and the submission happens on time, with nobody typing data in by hand.

Yes. An interface can connect online check-in, data capture and submission to SES.Hospedajes. You enter the credentials once, and from then on each stay is reported automatically.

Any change to details already submitted triggers a new reporting duty. A cancellation has to be reported too – within the same 24-hour deadline.

There is no edit function. An incorrect record is not overwritten by a new one: it has to be cancelled and then submitted again correctly.

Rejected submissions come back with an error code. The clock keeps running in the meantime – which is why submissions should be checked the same day, not at the weekend. A common reason for rejection is a missing mandatory field, such as the family relationship for a minor.

The reporting duty falls on you as the host, not on the guest – and without the data you cannot meet it. In practice you solve this in your booking terms: online check-in with data submission is a condition for handing over the keys. The earlier you say so, the fewer discussions you have on arrival day.

Three years, counted from the end of the booked stay. The data you keep has to match what was reported and be available to the authorities on request.

No. On 17 June 2025 the Spanish data protection authority (AEPD) published an information note answering exactly this question, agreed in advance with the Ministry of the Interior and the industry association. The conclusion: the duty to collect data under RD 933/2021 does not entitle you to request a copy of the ID document. That applies to photocopies just as much as to scans or phone photos.

The authority gives three reasons:

1. Too much data. A Spanish DNI contains information the rules do not ask for – photograph, expiry date, CAN number, parents' names. Processing it increases the risk of identity fraud and breaches the principle of data minimisation (Art. 5.1.c GDPR).
2. Too little data. Conversely, the ID document does not contain everything RD 933/2021 requires. On its own it is not even enough to meet the reporting duty.
3. No proof of identity. Sending a copy of a document does not reliably establish who actually sent it.

The AEPD sets out the permitted route in concrete terms: the guest provides the required data, collected through a form – on site or online.

When guests arrive in person, a visual check of the document is enough. It is shown, not copied and not filed.

For online check-in the authority suggests digital certificates, matching the data attached to the payment method, or authentication with codes sent to the guest's phone or email.

Yes – under clearly defined conditions. The AEPD's June note initially left this question open; a subsequent resolution from the authority answered it.

Optical character recognition is permitted where the system is built from the outset to extract only the fields required by law and to store neither complete images nor superfluous information. If an image is captured in order to read it, it may only be processed temporarily and must be discarded immediately afterwards. The document must also not be kept as proof of verification.

So the difference between lawful and sanctionable does not lie in the scan itself, but in what happens to the image afterwards.

No. The AEPD explicitly requires more than an assurance: the controller must be able to demonstrate what the system actually does – which data the OCR captures, how long it is processed, for what purpose and with what safeguards. That follows from the accountability principle.

In practice that means deletion routines, storage locations and retention periods per data type have to be documented, not merely claimed. So ask your provider specifically how deletion is implemented technically and how it is documented. And as the authority stresses: operational convenience must never take precedence over the rights and freedoms of the individual.

How widespread something is proves nothing about whether it is lawful – quite the opposite. The AEPD acted precisely because the practice is so widespread, and it continues to sanction it: in one case a hotel was fined 9,000 euros for scanning its guests' ID documents, and was also ordered to delete the stored documents and change its data capture system. The authority points out that in individual cases fines can exceed 100,000 euros.

No – and this is the point that surprises most owners. What you must keep is the data and the submission confirmations, for three years from the end of the stay. The ID image was never part of the report and is irrelevant to an official query.

On top of that, it is no use as evidence anyway, since in the AEPD's view a copy does not reliably establish identity. Keeping it “just in case” means holding a document that could not answer the question – and taking a considerable risk to do so.

For your internal record that the check took place, a note is enough: ID document presented and checked, with the date and the person who checked it.

The scale is very different in each case. A late or incorrect report under RD 933/2021 sits in the range of 100 to 600 euros. A data protection breach, by contrast, falls under the GDPR's sanction framework of up to 20 million euros or 4% of worldwide annual turnover – whichever is higher.

Put differently: the storage that is meant to create security creates the bigger risk.

Your guests scan their ID document during online check-in with their phone camera – no typing anything in by hand. Our system reads only the fields required by law, which your guests then check and confirm themselves.

The image of the document is discarded after it has been read and is not stored. We keep only the reported data and the submission confirmations – for the three years the law requires, and then delete them.

That way we combine the convenient route for your guests with what the Spanish data protection authority expects of systems like this.

A fair question – data breaches at accommodation providers are a real thing. With any solution, look at where the data is hosted, who has access, how long it is kept and whether there is a process for data subject rights (access, correction). In the event of a data breach, there is a 72-hour deadline for notifying the AEPD.

No. The holiday letting licence (ETV, estancia turística en viviendas) is granted by the autonomous region – in Mallorca that means the Balearic Islands – and confirms that your property meets the standards for tourist letting. Without a licence, letting is not permitted, no matter how properly you report.

No. The report to SES.Hospedajes fulfils the public-security reporting duty. The Ecotasa, the Balearic tourist tax, is charged and paid over entirely separately.

You should not rely on it. According to the Ministry of the Interior, each party submits the data it holds – where several intermediaries are involved, the duty falls first and foremost on whoever has the direct final contractual relationship with the customer. The guest report itself remains the accommodation's responsibility.

Sanctions follow Organic Law 4/2015 on public safety; the authority decides how a case is classified.

Minor breaches – 100 to 600 euros: according to the Ministry of the Interior, this covers submitting incorrect data, errors in guest details, omitting some information and reporting late.

Serious breaches – considerably higher: failing to keep the required register and failing to report at all are treated as serious under Article 36.20 of Organic Law 4/2015.

In short: reporting late is unpleasant. Not reporting at all, or not being registered, is the far more expensive option.

Legal responsibility for the report stays with the host, that is, with whoever runs the letting business. A service provider can take the whole process off your hands but does not relieve you of that responsibility. All the more reason to have clear records of which reports were submitted when and in whose name – and to be able to see that evidence whenever you want.

You have to be able to show that the data was reported and that your own records match what was reported. So keep the submission confirmations for the full three years – not just the guest data itself.

The registration itself is free and can be done in a manageable number of steps. It is the preparation that takes time: obtaining a digital certificate or Cl@ve, having your NIE or NIF to hand, setting up each property correctly, generating the credentials for submission and entering them in the software you use. For owners with no experience of Spanish government portals, this is the point at which most look for help.

Software handles the repetitive part reliably: check-in, validation, submission on time. What it cannot do is help when a certificate expires, the details of a property change, a submission is rejected with an unclear error code, or a one-off situation arises that no form anticipates. That is why, for many owners, the combination is what counts: automated processes plus someone who knows the official side.