In Switzerland, the revision of the Federal Data Protection Act (LPD) has changed the obligations of companies that collect and process personal information. The hotel sector, where each reservation generates a flow of data (identity, contact details, stay preferences, payment methods), is directly affected.
The LPD now regulates these processes with requirements for transparency, proportionality, and security that apply to both the reception of a small establishment and the IT systems of an international chain.
LPD and hotel data: what the law changes for the processing of reservations
The LPD requires every hotel to define a specific purpose for each piece of data collected. An email address collected to confirm a reservation cannot be reused for a commercial campaign without a distinct legal basis. This principle of purpose obliges establishments to review their forms, their management software (PMS), and their internal practices.
The principle of proportionality prohibits collecting more information than necessary. Requesting a passport copy for a one-night stay without a local legal obligation constitutes an excess under the LPD. The hotel must be able to justify each field of its reservation form.
The law also provides for a right of access for the customer: any person can request what data a hotel holds about them, for what purpose, and to whom it has been transmitted. The establishment has a period of thirty days to respond. In practice, few hotels today have a formalized internal process to handle such requests, which creates a risk of non-compliance. Find information on Tout Mon Monde detailing these mechanisms applied to daily hotel operations.
Chain of digital subcontractors: mapping the risks of data leaks
A hotel almost never works alone with its customers’ data. Between the PMS, the online booking platform, the channel manager that synchronizes availability, and the payment provider, each link in the digital chain accesses a part of the stay data. The LPD makes the hotel responsible for verifying that its subcontractors ensure an adequate level of security.
Mapping these providers is a step that many establishments neglect. A dedicated risk management document for this chain recommends listing each provider, clarifying respective responsibilities, and verifying the security measures applied. Without this mapping, the hotel does not know precisely where its customers’ data is transmitted or who has access to it.
The case of booking platforms
Booking platforms have become a prime target for cybercriminals. Recent incidents in Switzerland have shown that vulnerabilities among these intermediaries could expose customers’ stay data. Fraudsters then exploit this information to send fake messages to travelers, posing as the hotel or the platform, in order to retrieve banking data.
The hotel has no direct control over the IT security of the platform. Its scope of action lies in contractual choice: requiring rapid notification clauses in case of a breach, checking the security certifications of the partner, and limiting the volume of data shared to the strict minimum necessary for the transaction.
Human error and targeted phishing: the gap that technology cannot fill
The most effective attacks against hotels do not involve sophisticated software vulnerabilities. Fraudsters send fake inquiries about a stay, accompanied by a malicious link. If a front desk employee clicks, spyware can be installed and gain access to the establishment’s internal systems.
This scenario exploits daily routine: a receptionist processes dozens of requests per day and does not always have the necessary reflexes to identify a fraudulent email. Technical measures (antivirus, firewalls) are not sufficient if the staff is not trained. The Federal Data Protection and Transparency Officer (PFPDT) particularly recommends:
- Two-factor authentication on all access to systems containing customer data, including professional messaging
- Regular training sessions for staff, focused on recognizing phishing attempts specific to the hotel sector
- A clear internal reporting procedure: any suspicious email must be forwarded to an identified contact before any action
Training is not limited to an annual module. Phishing techniques evolve, and the scenarios used against hotels are becoming increasingly personalized, with references to real reservations extracted from compromised databases.
LPD and artificial intelligence in hospitality: a still unclear framework
Some hotels are already using artificial intelligence tools to personalize the customer experience, adjust prices in real time, or automate responses to booking requests. The LPD does not contain specific provisions regarding AI, but the principles of purpose, proportionality, and transparency remain fully applicable.
A chatbot that collects a customer’s dietary preferences to prepare for their stay must inform them of how this data will be used. If a dynamic pricing algorithm uses the stay history of a regular customer, this use constitutes the processing of personal data subject to the LPD.
The limits of this framework become apparent when the AI tool is provided by an external vendor whose servers are located outside Switzerland. The issue of data transfer abroad, regulated by the LPD, adds a layer of complexity that most small establishments are not equipped to assess on their own.
LPD compliance: where to start
A hotel wishing to comply benefits from structuring its approach around three concrete axes:
- Creating a register of data processing, listing each category of data collected, its purpose, and its retention period
- Auditing contracts with digital providers to include data protection clauses compliant with the LPD
- Designating an internal contact responsible for responding to customer access requests and coordinating incident management
Compliance with the LPD is not a fixed state. Each new provider, each new tool, or each modification of internal processes can create a new data processing that requires evaluation. Hotels that integrate this logic into their daily management, rather than treating it as a one-off project, sustainably reduce their exposure to risks.
