That deadline comes from Spain's traveller register, and since 2023 the register runs through one platform: SES.Hospedajes, run by the Ministry of the Interior. Below is what the law says — who it applies to, which data, when, and for how long — with the article numbers, so you can check every line yourself.
Who has to report — and who is exempt from what
The rules are set by Spain's Royal Decree, Real Decreto 933/2021 of 26 October 2021.
It covers anyone who rents out a room or a home for overnight stays for payment. It doesn't matter whether this is your business or you let one flat now and then: the decree says "de modo profesional o no", professionally or not (art. 2.1). Tourist apartments are named separately (art. 2.1.b).
Online intermediary platforms such as Booking.com or Airbnb have obligations too (art. 2.1.d and 2.3). So who actually reports the data?
Spain's Ministry of the Interior publishes an official document answering frequently asked questions about the platform. The latest version is dated 10 August 2026; below we simply call it "the Ministry's FAQ". It says that when several intermediaries are involved, the data is reported by whoever has the direct, final contract with the guest ("relación contractual directa y final con el cliente").
Non-professional hosts have fewer duties. They only have to report the data; they don't have to keep or store the register (art. 5.4). The Ministry's FAQ treats as professional anyone registered in the Censo de Empresarios, Profesionales y Retenedores, Spain's tax census of businesses. If you run apartments as a registered business, both duties apply to you: reporting the data and keeping the register.
The decree applies across Spain (art. 3). SES.Hospedajes went live on 2 January 2023. The adaptation period was extended several times, and since 2 December 2024 the rules apply in full.
What SES.Hospedajes asks for, guest by guest
Annex I of the decree lists the data. For professional operators it falls into four groups:
- You: name or company name, tax number, municipality, province, phone, email, website and the URL of the listing.
- The property: type, name, full address, postcode, town and province.
- Each traveller: first name, both surnames, sex, document type (DNI, passport, TIE), document number and support number, nationality, date of birth, usual address, landline and mobile, email, number of travellers, and the relationship between travellers if any of them is a minor.
- The transaction: contract reference, date and signatures; date and time of check-in and check-out; the property's address, number of rooms and whether it has internet; and payment details — type, means of payment, its holder, card expiry date and payment date.
The Ministry's FAQ adds three practical points:
- which documents are accepted: the DNI for Spanish citizens, a national ID card for EU citizens, a passport for everyone else;
- if a guest has no email, a mobile number is enough;
- sex is recorded when it appears on the document or the guest states it.
Who signs. The guest registration form (parte de entrada) is signed by everyone over 14. For younger children, the adult travelling with them provides the data (art. 4.2).
Who is responsible for accuracy. According to the Ministry's FAQ, the host: the data in the register must match the document the guest showed or provided.
When: two 24-hour deadlines, and one step before the first guest
Before you start. You register yourself and each property (the first two groups of the annex) within ten days of completing the administrative steps for the activity, "y, en cualquier caso, con anterioridad al ejercicio efectivo de esta" — before the first guest arrives (art. 6.1–6.2). If those details change, you report them again.
For every stay, the traveller and transaction data go to the platform "de manera inmediata, y en todo caso en un plazo no superior a 24 horas" (art. 6.3), counted from two moments:
- when the booking is made or the contract signed, or when it is cancelled;
- when the contracted service starts — in practice, the stay.
The communication must be electronic (art. 6.4); only non-professional hosts may use other means.
To register on SES.Hospedajes you need a digital certificate or a Cl@ve account. You fill in the form and sign it with Cl@ve-Firma or AutoFirma. After that, the platform offers access for daily reporting, including access without a certificate, and a web service that booking software can use. According to the Ministry's FAQ, someone else may send the data for you if you authorise them "por alguna de las formas admitidas en derecho para obrar en nombre de otra persona".
How to collect the data without copying passports
The quickest way to collect everything is to photograph the passport. The Spanish Data Protection Agency says you shouldn't. In a note of 17 June 2025 the AEPD concluded that asking guests for a copy of their ID or passport to meet this decree goes against data minimisation. The agency also notes that an ID card does not contain every field the annex asks for anyway.
The police don't need a photo of the passport. They need the data, within 24 hours.
According to the Ministry's FAQ, any collection system that lets you verify the data is accurate will do, "incluso sin que sea necesaria su presencia física", as long as it complies with data-protection law; electronic identity checks are valid on the same condition.
What remains is a form that asks for exactly the annex fields, plus a check of the document the guest shows you at the door. If guests fill in the form before arrival, check-in is a comparison, not data entry.
It's easiest to put the link to this form in the same message you send guests before arrival with instructions on how to get into the flat. We wrote about those instructions in what a guest needs to get in at 2 a.m..
Fitting it into a working day
The law sets the deadlines; how a team meets them is its own choice. Here is one way to map the duties onto a working day:
- At booking: within the day, send the booking communication. Do the same when a booking is cancelled.
- Before arrival: send the guest the data form along with the access instructions.
- At check-in: compare the form with the document shown. Every guest over 14 signs.
- The same day: send the traveller data. Don't leave it until the morning: a Friday-night arrival plus a Saturday off already eats the 24 hours.
- Changes: a guest who arrives with an extra person, or a stay that changes dates, means new data.
- Afterwards: keep the register for three years from the end of the stay (art. 5.3), then delete it. Keep it yourself: in the software you use, or in a separate spreadsheet with the date each communication was sent. You can't get a list of everything you've sent from the Ministry: according to its FAQ, there is no such option. So keep the list yourself.
The weak point is rarely the platform. It is step 4 on a busy evening, when everyone on the team thinks someone else will send the data. In CortoCasa you can make it an item on the property's check-in checklist: "data sent" is ticked by a named person responsible for that check-in.
Mistakes that come up again and again
- Counting 24 hours from the wrong moment. The deadline runs from the booking and again from the start of the stay. Reporting only at check-in leaves the booking communication out.
- Forgetting cancellations. A cancelled booking is also a communication (art. 6.3.a).
- Missing travellers. The data covers every guest, including children under 14 through the accompanying adult, and the relationship when a minor travels.
- Copying documents "just in case". The AEPD says no. Collect the fields, not the photo.
- Keeping data forever. The decree sets three years from the end of the service; after that it no longer requires the data.
- Assuming Booking.com or Airbnb sent the data. The platforms have obligations under the decree too, but according to the Ministry's FAQ the data is reported by whoever has the direct contract with the guest. Check with the Ministry or a lawyer who that is in your case.
What happens if you don't — and where the rules differ
Sanctions follow Chapter V of Spain's public-security law, Ley Orgánica 4/2015 (art. 8.1). The decree sorts breaches into two groups:
- Serious: "la carencia de los registros documentales" and "la omisión de las comunicaciones obligatorias" (art. 8.2).
- Minor: irregularities in filling in the register, and communications made "fuera del plazo establecido" (art. 8.3).
The Ministry's FAQ gives the amounts: minor infringements — false or wrong data, partial omissions, late communications — carry €100 to €600; not being registered as an accommodation provider or not reporting guests carries €601 to €30,000.
If your property is in Catalonia or the Basque Country, confirm the current procedure with the regional police (Mossos d'Esquadra, Ertzaintza). The decree itself does not describe regional channels.
A one-line summary
SES.Hospedajes asks for three things: the right data for every guest, sent within 24 hours of the booking and of the arrival, and kept for three years, no more.
This article summarises Real Decreto 933/2021, the Spanish Ministry of the Interior's FAQ for platform users (updated 10 August 2026) and public guidance as of 11 November 2026. It is not legal advice. For your specific situation, consult a lawyer or the competent authority. Sources: Real Decreto 933/2021 (BOE) · AEPD note on the traveller register.
