When booking a hotel room, most customers only think that they are providing a few basic information to complete the transaction. However, from the time of searching for a room on the online platform, making a reservation, check-in, using the service to check-out, a large amount of personal data has been collected, stored, analyzed and processed by the accommodation business.
In the digital economy, hotels are no longer merely places to provide accommodation. Every modern hotel is simultaneously a large-scale data collection and processing system. Through booking platforms, mobile apps, hotel management systems, loyalty programs, surveillance cameras, wifi systems, and customer behavior analysis tools, accommodation businesses can hold a huge amount of information about their customers.
Many people think that the data that hotels collect only includes full names, phone numbers or information on citizen IDs
The development of technology helps to improve customer experience and business efficiency. However, it also poses new challenges in terms of privacy, data security, and corporate liability.
In the context that Vietnam's Personal Data Protection law has been enforced in practice, the hotel industry is entering a new stage of governance, where personal data is not only a business resource but also an object that needs to be strictly managed and protected.
Hotels are holding more data than customers think
Many people think that the data that hotels collect only includes full names, phone numbers or information on citizen IDs. In fact, the scope of data held by accommodation businesses is much wider.
Right from the booking stage, businesses often receive information such as full name, gender, nationality, phone number, email address, check-in date, check-out date, number of guests, payment information and special requests related to the service.
When guests carry out check-in procedures, businesses continue to collect information from citizen IDs, passports, visas or other identification documents as required by the law on residence and management of foreigners.
During the stay, the amount of data continues to increase through service usage activities. The hotel may record the history of using restaurants, spas, minibars, conference rooms, transportation services, entertainment services or other facilities on site.
At the same time, the internal management system is also capable of recording the history of customer interactions with the business such as service feedback, support requests, complaints, or personal preferences from previous stays.
If in the past, hotel businesses mainly managed identification information, now many units have switched to managing the entire customer experience journey.
From a data perspective, businesses can not only know who their customers are, but they can also know what types of rooms they prefer, when they usually travel, what their average spend is, what services are used frequently, and how satisfied they are with each stay.
Four data groups that hospitality businesses are holding
From a data governance perspective, customer data in the hospitality industry can be divided into four main groups.
The first group is personally identifiable data.
This is the most common type of data, including full name, date of birth, nationality, address, phone number, email, citizen identification number, passport number, or similar identifying information.
The second group is transaction data.
These are data arising from accommodation activities such as booking information, payment history, invoices, services used, loyalty information and data related to commercial relations between customers and businesses.
The third group is behavioral data and location data.
Through mobile applications, wifi systems, electronic locks or other digital platforms, businesses can record the time guests enter and exit the room, the service use area, the time of stay in each area or the habit of using services in the hotel.
This is a group of data that has great commercial value because it allows businesses to build behavioral profiles and personalize services.
The fourth group is sensitive personal data.
According to the Law on Personal Data Protection 2025, in some cases, accommodation businesses can access or process data in sensitive groups such as biometric data for customer identification, health data arising from specialized health care or resort services, etc. location data is continuously monitored or information reflects the private life of customers.
This is the group of data with the highest level of risk if it is exposed or misused.
Where is customer data being stored?
In previous years, customer data was mostly kept at the hotel in the form of paper records or on internal computer systems. Today, the picture has changed completely.
The majority of accommodation businesses use property management systems (PMS), customer relationship management systems (CRM), online booking platforms, and cloud computing solutions. This makes it possible for customer data to be stored simultaneously in many different locations.
A booking information can appear on the hotel's system, online booking platform, payment system, customer service software, and automated marketing system.
For international hotel groups, data can also be synchronized to data centers or centralized management systems in many different countries.
Data fragmentation improves operational efficiency but also significantly increases the challenges of controlling, protecting, and governing data.
On what basis is the hotel processing personal data?
One of the important changes of the Law on Personal Data Protection 2025 is to require businesses to clearly define the legal basis for each data processing activity.
For the hospitality industry, the majority of data processing is carried out based on three main groups of bases.
The first is to implement the contract or necessary measures before concluding the accommodation contract.
Confirming reservations, arranging rooms, making payments, issuing invoices, or settling service requests all fall into this group of activities.
The second is to fulfill legal obligations.
Accommodation establishments shall be responsible for declaring their stay, keeping accounting vouchers, fulfilling tax obligations or providing information to competent state agencies in accordance with law.
The third is on the basis of customer consent.
Activities such as sending advertisements, direct marketing, building customer profiles for business activities, or personalizing advertising often need to be considered from the perspective of the consent of the data subject.
This means that businesses cannot automatically use all the data they collect for all business purposes.
For international hotel chains or hotels using global cloud computing platforms, the fact that data is processed or stored outside the territory of Vietnam is becoming an important compliance issue.
Data risk in the hospitality industry is on the rise
The hospitality industry has long been seen as one of the sectors with a high level of data risk.
The reason lies not only in the amount of data collected, but also in the value of that data.
A hotel customer database can contain identity information, financial information, travel itinerary, consumption behavior, and many other private information simultaneously.
The first risk is cyberattacks and data leaks.
Booking systems and customer databases are often attractive targets for cybercriminals because of the huge commercial value of data.
The second risk is the misuse of data from within the business.
Receptionists, customer service departments, IT staff, or outsourced service providers can all become links to the risk of data leaks without the right control mechanisms.
The third risk is sharing data with third parties beyond the scope necessary.
In fact, hotels often have to coordinate with multiple technology partners, advertisers, payment gateways, or other service providers. Each time data is shared, there is an increased risk of losing control of customer information.
The fourth risk is transferring data abroad.
For international hotel chains or hotels using global cloud computing platforms, the fact that data is processed or stored outside the territory of Vietnam is becoming an important compliance issue.
What do hotel businesses need to prepare?
From a management perspective, the biggest challenge of hotel businesses today is not data collection but data lifecycle management.
Businesses need to know exactly what data they are collecting, where it is collected from, where it is stored, who has access to it, and for whom it is shared. Therefore, data review and mapping should be seen as the beginning of any compliance program.
Next, businesses need to assess the necessity and legality of each data processing activity. Data that is not strictly necessary for the provision of services should be limited to collection or removed from operational processes.
For businesses that use third-party technology platforms or storage systems, supplier management needs to be elevated to an independent risk management content.
In addition, businesses also need to build a process for detecting, responding to and handling personal data incidents. In the context of increasingly sophisticated cyberattacks, the ability to respond quickly to an incident can determine the extent of financial damage, reputation, and liability.
In the end, the most important factor is still people. Technology can support data protection, but it can't completely replace HR compliance awareness.
The hospitality industry owns one of the most valuable repositories of personal data in the service economy. From identities and transactional data to behavioral data and sensitive data, all can create a competitive advantage for businesses if harnessed properly. However, along with the increasing economic value comes increasing liability. Therefore, for hotel businesses, data management capacity may become an important competitive factor no less than service quality or geographical location as before.
Lawyer Nguyen Van Phuc
HM&P Law Firm
