Guest data, AI and UK GDPR: a practical checklist
Hospitality businesses hold a surprising amount of personal data: names, contact details, booking histories, preferences, and sometimes allergy or accessibility information. As AI tools arrive in booking systems, chat assistants and marketing platforms, it is worth checking that your use of them stays on the right side of UK GDPR — and keeps guests’ trust.
This checklist is general guidance, not legal advice, but it covers the questions we work through with clients.
Before you switch an AI tool on
- Know what data it will see. Limit each tool to the data it genuinely needs.
- Know where data goes. Check where the provider stores and processes data and whether it is used to train their models.
- Check your contract. Make sure a data processing agreement is in place with the provider.
- Consider a DPIA. For higher-risk uses, such as profiling guests or handling health-related information like allergies, a data protection impact assessment is good practice.
When guests interact with AI
- Tell guests clearly when they are talking to an automated assistant
- Provide an easy route to a real person
- Keep a human in the loop for decisions that significantly affect guests or staff
- Update your privacy notice to explain how AI is used
Day-to-day safeguards
- Use role-based access and strong authentication, including two-factor sign-in
- Avoid pasting guest or staff personal data into public AI chat tools
- Keep records of what AI tools you use and why
- Review the set-up at least annually or when tools change
Handled well, AI can improve service without compromising privacy. The key is deciding these things deliberately at the start, rather than discovering them later.
Want help applying this to your business?
Our fixed-scope AI Readiness Review rates your current systems, maps how your data flows and identifies your top three AI opportunities, with a costed 90-day plan.
