Yes — it’s normal, it’s required, and your host is following Spanish law rather than being nosy. Under Real Decreto 933/2021, accommodation providers in Spain keep a guest register and report each stay to the authorities, in most cases within 24 hours of check-in. The duty covers hotels, hostels, guesthouses, tourist apartments, campsites and rural houses, so expect the request whether you booked direct, through Booking.com or on Airbnb.
Why does a host in Spain ask for my passport?
Spain requires accommodation providers to identify who is staying with them and to file that record electronically. It isn’t an Airbnb rule and it isn’t your host being over-cautious: the same register is taken at a hotel reception desk and at a two-bedroom holiday flat in Seville.
What exactly gets recorded?
The register — still often called the parte de entrada de viajeros — holds your identity details, your contact and residence details, and the details of your booking and stay. It is the same core information a receptionist has always copied from a passport at check-in; what changed is that it must now be filed through a national system rather than kept on a paper form in a filing cabinet.
Who receives it, and how quickly?
Providers file through SES.Hospedajes, the national channel live since December 2024. The Guardia Civil’s hospederías service and the Webpol portal are the earlier channels. Accommodation in Catalonia and the Basque Country reports through the regional platforms run by the Mossos d’Esquadra and the Ertzaintza.
Timing runs on a 24-hour clock: booking and cancellation data, and check-in data, must be sent immediately and no later than 24 hours after each event. The decree covers accommodation activity whether or not it is run professionally, so the same register applies to a private host with one apartment and to a hotel group.
What is the legal basis now?
The law providers work from is Real Decreto 933/2021, in force since 27 April 2022 — see the official text on the BOE. The older Orden INT/1922/2003 is the framework the decree replaced, named in its preamble. The rules are also contested: on 4 June 2026 the European Commission opened a formal infringement procedure against Spain over the decree, and hotel associations have asked for it to be repealed. It has not been annulled, so nothing changes for your stay today.
Can I refuse to give my passport details?
You can, but your host cannot complete the register without them. In practice, refusal usually means the provider cannot finish check-in and may have to cancel the booking. You normally only need to show the document and let the details be recorded — the original stays with you.
Is it safe, and how do I spot a request that isn’t legitimate?
A legitimate request arrives through the platform you booked on, or through the digital check-in link the property sends before arrival. What should make you pause:
- A request to send a passport photo to a personal email address, or to a number you cannot match to the property.
- Links that do not point to the booking platform or the property’s own domain.
- Pressure to send your details before you have a confirmed reservation.
A compliant host can tell you which channel the property reports through. Your data is covered by the GDPR and Spain’s LOPDGDD: you can ask what was recorded about you, have mistakes corrected, and ask for deletion once the register’s retention period has run.
If you’re the one collecting the details
The Spanish duty is operational: someone has to collect the document, check it against the guest, get the fields into SES.Hospedajes or the regional platform within 24 hours, and keep evidence of what was sent. A hotel absorbs that in reception; a manager with a dozen tourist apartments usually can’t, and the failures cluster in the same places — the 01:00 arrival, the guest who books the morning they travel, the passport emailed to a personal inbox.
A guest management system built for this step handles the collection, the ID verification at digital check-in and the reporting to the national authorities in one flow, and keeps the guest conversation around it in a single inbox. UpMarket is built for that step, so check-in and ID verification travel with the booking confirmation instead of chasing the guest at the door. Book a demo to see the Spanish reporting flow end to end.
Are you a host or a hotel manager? UpMarket collects and files these details for you: see online check-in for hotels and automatic check-in for vacation rentals.
Staying elsewhere in Europe?
Same question, different rules, and many countries apply one: Portugal, Italy and France each apply their own reporting duty, and we explain what each one asks of the guest.
Frequently asked questions
Is it legal for accommodation in Spain to ask for my passport details?
Yes. Real Decreto 933/2021 requires providers to keep a guest register and report it, and it names the earlier Orden INT/1922/2003 as the framework that preceded it.
How is my information used?
It goes into the guest register and is reported to the competent authority for the region — SES.Hospedajes nationally, the Mossos d’Esquadra in Catalonia, the Ertzaintza in the Basque Country — and handled under the GDPR and the LOPDGDD.
How fast do my details have to be reported?
Immediately, and no later than 24 hours after check-in, with booking and cancellation data on the same clock.
Can I refuse?
You can, but the provider cannot complete the register without your details, so the booking may be cancelled.
Is it safe?
Yes, when the request comes through the booking platform or the property’s own check-in link — never send a passport image to an address that appears partway through your stay.
This guide was last reviewed in November 2026.
