Hospitality Data Privacy Compliance Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Hotel General Managers, Data Protection Officers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 16 Nov 2026 Course code SD-L-044

Before you join: Participants should have working familiarity with hospitality operations, such as reservations, front-office processes, guest services, marketing, technology or supplier management.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Hotels, resorts, restaurants, travel operators and event venues collect substantial guest information: identity documents, payment details, loyalty profiles, accessibility needs, stay preferences, CCTV images and digital interaction data. A single booking may pass through property-management systems, central reservation platforms, payment processors, guest Wi-Fi providers, mobile applications, franchise operators and travel agents. Privacy failures can arise from unclear notices, excessive collection, weak vendor controls, inappropriate staff access, delayed breach response or mishandled guest requests.

This course examines how privacy law and recognised privacy-management practices apply to hospitality operations. Participants learn to map guest-data flows, identify lawful bases, prepare privacy notices, manage consent and marketing preferences, respond to data-subject requests, assess vendor risk, apply retention rules and manage personal-data incidents. The course addresses GDPR requirements alongside transferable practices relevant to other privacy regimes, including US state privacy laws. It also examines the interaction between privacy, payment-card controls, information security, guest service and operational continuity.

Teaching combines concise legal briefings with hospitality cases involving reservations, loyalty programmes, guest Wi-Fi, CCTV, outsourced contact centres and cross-border hotel groups. Participants work through practical decisions, documentation reviews, incident scenarios and team discussions. They leave with a reusable guest-data compliance pack containing a data inventory, request-handling workflow, vendor assessment checklist, retention schedule and incident-response decision tree.

The course suits professionals who influence guest-data collection, use, protection or disclosure. It is particularly relevant where operational teams need to apply privacy requirements consistently without compromising legitimate guest-service needs.

What you will be able to do

  • Map guest-data flows across reservations, property systems, loyalty programmes and third parties
  • Assess lawful bases, consent records and transparency requirements for hospitality processing
  • Draft privacy notices and data-subject request workflows for guest-facing operations
  • Apply data minimisation, retention and access-control requirements to guest records
  • Conduct privacy impact assessments for hotel technology, surveillance and profiling proposals
  • Evaluate processor contracts and supplier controls using a hospitality vendor-risk checklist
  • Manage personal-data breaches using triage, notification and evidence-preservation procedures
  • Build a practical privacy compliance action plan for a hospitality business unit

Benefits of attending

For you

  • Make defensible decisions about guest-data collection, sharing and retention
  • Recognise privacy risks in reservations, loyalty, CCTV and guest-technology changes
  • Handle guest access, deletion and objection requests with clearer operational steps
  • Contribute credible privacy requirements to supplier and technology discussions
  • Document privacy decisions using recognised templates and assessment methods

For your organisation

  • Reduce avoidable privacy complaints arising from opaque guest-data practices
  • Improve consistency across properties, central teams, franchises and outsourced service providers
  • Strengthen evidence for regulator enquiries, customer audits and internal assurance reviews
  • Limit unnecessary retention and uncontrolled access to sensitive guest information
  • Improve incident readiness through defined escalation, triage and notification procedures

Course modules

10 modules over 5 days

Participants can identify the guest data and operational activities that create privacy obligations.

  • Guest data categories: identity, contact, payment, preference, health and location information
  • Hospitality processing lifecycle from booking enquiry through post-stay marketing
  • Controller, processor and joint-controller roles within hotel operating models
  • GDPR principles applied to front desk, reservations and concierge activities
  • Special-category data risks in accessibility, dietary and wellness service records
  • Accountability evidence expected from policies, records, training and management oversight

Participants can create a usable map and processing record for a guest-data journey.

  • Data-flow mapping from booking channel to property-management and CRM systems
  • Records of processing activities using GDPR Article 30 fields
  • Identify collection points across websites, kiosks, calls, check-in and Wi-Fi
  • Trace disclosures to travel agents, franchisees, payment providers and affiliates
  • System inventories linking data categories, owners, locations and retention periods
  • Validate maps through interviews, screen reviews, contracts and sample records

Participants can select lawful bases and prepare transparent guest communications.

  • Lawful-basis test for reservations, payments, security, marketing and service preferences
  • Consent design for optional promotions, cookies and sensitive preference collection
  • Legitimate-interests assessment using purpose, necessity and balancing tests
  • Layered privacy notices for booking engines, reception desks and mobile applications
  • Just-in-time notices for CCTV, Wi-Fi analytics and location-enabled services
  • Document purpose changes before reusing guest data for new campaigns

Participants can operate a controlled workflow for guest privacy-rights requests.

  • Data-subject rights: access, correction, deletion, restriction, portability and objection
  • Request intake workflow across properties, contact centres and online channels
  • Identity-verification methods proportionate to request sensitivity and fraud risk
  • Search protocols for PMS, CRM, email, loyalty and CCTV records
  • Exemption assessment for legal claims, security investigations and third-party rights
  • Response letters, deadline tracking and request-case evidence files

Participants can define retention and access controls for common hospitality records.

  • Data-minimisation review of pre-arrival forms, registration cards and guest profiles
  • Retention schedules distinguishing reservations, invoices, passports, CCTV and marketing records
  • Deletion, anonymisation and suppression methods for hospitality data repositories
  • Role-based access control for front desk, revenue, housekeeping and concierge teams
  • Privileged-access reviews for central administrators, vendors and temporary staff
  • Clean-desk and screen-privacy controls at reception and business centres

Participants can assess privacy controls for hospitality marketing and digital services.

  • Loyalty-programme profiling, segmentation and preference-management control points
  • Marketing suppression lists and opt-out propagation across connected platforms
  • Cookie consent management for booking engines and hotel websites
  • Mobile key, digital concierge and in-app messaging privacy considerations
  • Guest Wi-Fi analytics, device identifiers and location-data governance
  • Profiling transparency and objection rights for personalised offers

Participants can assess third-party privacy arrangements and cross-border data transfers.

  • Processor due diligence for PMS, CRS, CRM and contact-centre providers
  • Data processing agreement clauses: instructions, confidentiality, security and audit rights
  • Subprocessor approval, change notification and vendor accountability records
  • Franchise and management agreements: allocating controller responsibilities clearly
  • International transfer assessment using adequacy decisions and standard contractual clauses
  • Transfer impact assessments for cloud hosting and global support access

Participants can assess new hospitality initiatives before personal data is processed.

  • Privacy by design requirements within hotel technology procurement and change control
  • DPIA screening criteria for biometrics, surveillance, profiling and large-scale monitoring
  • Data protection impact assessment stages: describe, assess, mitigate and approve
  • Risk scoring based on likelihood, severity and affected guest populations
  • Control selection using minimisation, pseudonymisation, encryption and access restrictions
  • Residual-risk escalation and prior-consultation decision criteria

Participants can coordinate a proportionate response to a hospitality data incident.

  • Breach identification across lost devices, misdirected emails, ransomware and account compromise
  • Incident triage separating confidentiality, integrity and availability impacts
  • Evidence preservation from logs, bookings, access records and vendor notifications
  • Risk assessment for affected guests using severity and likelihood criteria
  • Regulator notification timelines, decision records and required report content
  • Guest communication principles following confirmed high-risk personal-data breaches

Participants can organise a practical privacy improvement plan for their business area.

  • Privacy governance roles for property teams, corporate functions and external operators
  • Control testing through file sampling, access reviews and notice inspections
  • Training matrix for front-office, marketing, IT, security and housekeeping personnel
  • Privacy metrics covering requests, incidents, training completion and supplier reviews
  • Audit-ready evidence packs linking controls, owners, dates and remediation actions
  • Ninety-day action plan prioritising risks, owners, milestones and review meetings

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Guest-data flow map template
  2. Hospitality privacy notice checklist
  3. Data-subject request handling workflow
  4. Vendor privacy due-diligence checklist
  5. Data retention schedule template
  6. Personal-data breach decision tree

Who should attend

  • Hotel General Managers — accountable for guest trust, operational controls and incident escalation
  • Data Protection Officers — responsible for privacy governance across hospitality operations
  • Hotel Operations Managers — oversee front-desk, housekeeping and guest-service data handling
  • Revenue and Marketing Managers — manage loyalty, profiling, promotions and preference records
  • IT and Information Security Managers — control hotel systems, integrations, access and incidents
  • Procurement and Vendor Managers — contract with reservation, payment and technology suppliers

Skills and tools covered

Guest data mappingPrivacy notice draftingData subject requestsVendor privacy assessmentBreach response coordinationPrivacy impact assessment

Tools and standards

GDPR, ISO/IEC 27701, NIST Privacy Framework, PCI DSS

How the course runs

Training methodology

The instructor uses short legal briefings followed by hospitality-specific case work and structured group exercises. Participants assess booking journeys, loyalty campaigns, guest Wi-Fi deployments, CCTV proposals, supplier contracts and breach reports using supplied templates. Simulations cover a guest access request and a suspected data disclosure at a property. Facilitated discussions compare operational choices across hotels, restaurants, resorts and travel businesses. Each participant develops an application plan that identifies priority controls, owners, evidence and next steps for their function.

Requirements and prerequisites

Participants should have working familiarity with hospitality operations, such as reservations, front-office processes, guest services, marketing, technology or supplier management. They should understand the types of guest information their function collects or uses and be comfortable reading internal policies and operational procedures. Prior exposure to GDPR, privacy law or formal compliance work is helpful but not required. The course does not require legal qualifications, coding skills, audit certification or prior experience conducting data protection impact assessments. Participants benefit from bringing non-confidential examples of systems, forms or processes they want to improve.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need familiarity with hospitality operations or a related support function such as marketing, IT, procurement or compliance. Formal legal training and prior GDPR experience are not required.

Bring a laptop if available and non-confidential examples of guest forms, privacy notices, data issues or supplier questions. Course materials and working templates are provided.

It suits hotel, resort, restaurant, travel and event professionals who collect, use, protect or share guest information. It is relevant to operational managers as well as privacy, legal, marketing, IT and procurement specialists.

The course uses hospitality processes rather than generic office scenarios. It focuses on reservations, property-management systems, loyalty programmes, guest Wi-Fi, CCTV, payment-related data and franchise or operator arrangements.

Participants can use the supplied templates to review a guest journey, improve a notice, establish a request workflow or assess a supplier. The final module helps them set priorities, owners and evidence requirements for a ninety-day plan.

The programme runs from 08:30 to 16:30 each day, providing about 6.5 contact hours daily. Ten modules are delivered in teaching order through briefings, case analysis, group work, simulations and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

More courses in Legal

Legal Disability Rights and Compliance Training Course 10 days · from USD 2,200 · next 16 Nov Legal Dispute Settlement Agreement Drafting Training Course 10 days · from USD 2,200 · next 16 Nov Legal E-Commerce Law and Digital Trade Governance Training Course 10 days · from USD 2,200 · next 16 Nov Legal Financial Services Law and Compliance Training Course 5 days · from USD 1,100 · next 16 Nov Legal Inclusive Law Reform Training Course 10 days · from USD 2,200 · next 16 Nov Legal Intellectual Property Agreements Training Course 5 days · from USD 1,100 · next 16 Nov Legal Intellectual Property Management Training Course 5 days · from USD 1,100 · next 16 Nov Legal Intellectual Property Rights and Enforcement Training Course 10 days · from USD 2,200 · next 16 Nov