Data protection for hotels and restaurants: Swiss FADP, guests and bookings
By Advisorn · updated on 26 October 2026
In brief
Hotels and restaurants process guests' data for bookings, billing and, in hotels, for registration with the authorities (Art. 16 Foreign Nationals and Integration Act and cantonal laws). The FADP requires them to inform guests, collect only the data needed, have contracts with booking systems and follow the rules on video surveillance. Those who actively target guests in the EU must also take the GDPR into account.
The typical data
- bookings, contact details and guests' preferences;
- guest registration forms and identity documents;
- payment data and invoices;
- allergies and intolerances;
- video surveillance footage and Wi-Fi log-ins;
- staff data, including seasonal staff.
Sensitive personal data
Allergies and intolerances are health data (Art. 5 let. c FADP): they are needed only for the service, should be shared with those who cook and serve, and deleted after the stay unless the guest asks for them to be kept.
Guest registration
Anyone who accommodates foreign nationals on a commercial basis must register them with the authorities (Art. 16 FNIA), and the cantons regulate registration and the tourist tax. Collect only the data your canton's form asks for, and do not copy identity documents unless required.
Bookings and systems
- the hotel management system, the booking engine and the restaurant system are processors: contracts are needed;
- booking portals are as a rule independent controllers for the data they receive: this must be stated in the privacy notice;
- guest Wi-Fi: only the data needed and short retention periods.
Video surveillance
Cameras at the entrance or the till are allowed if signposted, limited to what is needed and with footage kept for a short time; not in rooms, bathrooms or changing rooms, and not to monitor staff (Art. 26 ArGV 3).
Related questions
- Video surveillance in a business or shop: what does the new FADP allow?
- Newsletters: is consent needed to send marketing e-mails in Switzerland?
- Revised FADP and GDPR: what are the differences, and when do both apply?
- What is sensitive personal data?
- How long may personal data be kept?
- Do we need a contract with vendors that process data for us?
Useful templates
- Website privacy notice template (FADP and GDPR)
- Privacy notice template for customers and contractual partners
- Video surveillance notice and sign template
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Employee privacy notice template
- Cookie policy template for Swiss and European websites
The other sectors
General information, not advice on your case: for your case the text of the law is what counts, and for a sector with rules of its own, those rules too.