What guest data may I collect for the guest registration form, and how long may I keep it?

What does the Data Protection Act require?

The revised Federal Act on Data Protection (FADP) has been in force since 1 September 2023. Your guests’ names, dates of birth, addresses and ID numbers are personal data. As a host, these rules matter most to you:

• Purpose and proportionality: Only collect data for a specific purpose that is clear to the guest, and no more than necessary (Art. 6 paras. 2 and 3 FADP).
• Deletion: Destroy or anonymise data when you no longer need it for that purpose (Art. 6 para. 4 FADP).
• Accuracy: Make sure the data is correct (Art. 6 para. 5 FADP). For the guest registration form, this means checking it against the ID document.
• Data security: Protect the data with measures appropriate to the risk (Art. 8 FADP). Don’t leave guest registration forms lying around in the property or ID photos in private chats.
• Software and service providers: If a provider or agency processes data for you, this is processing by a processor. Make sure the provider ensures data security (Art. 9 FADP).

What do you need to tell guests?

When collecting data, tell guests at least who you are and how to contact you, the purpose and any recipients, such as the police, municipality or tourism organisation (Art. 19 para. 2 FADP). If data is sent abroad, also name the country (Art. 19 para. 4 FADP). This duty does not apply where the processing is provided for by law (Art. 20 para. 1 let. b FADP). This covers the registration requirement itself, but not any extra data you collect, for example for marketing or reviews.

Anyone who deliberately fails to provide this information may, upon complaint, be fined up to CHF 250'000 (Art. 60 para. 1 FADP). The easiest way is to add a short notice to your booking confirmation and a privacy notice to your website.

Can I make a copy of an ID document?

For guest registration forms, federal law requires you to fill them in using the details on the ID document and for the guest to identify themselves (Art. 18 OASA). It does not require a copy. Cantons take different approaches:

• Vaud: You keep a copy of the passport or identity card in the guest register.
• Ticino: You record the ID number and type of document; photocopies are not provided for.
• We found no requirement to make copies in other cantons. There, you check the ID document and copy down the details.

Where the canton does not require a copy, it is difficult to justify one under the principle of proportionality (Art. 6 para. 2 FADP). An image of an ID document contains more data than the guest registration form needs.

How long do you keep guest registration forms?

Find out more about the cantons on the pages for Graubünden, Zug, Schwyz, Glarus, Solothurn, St. Gallen, Aargau, Thurgau, Basel-Landschaft and Jura. Delete the data once the retention period has expired (Art. 6 para. 4 FADP). Different retention periods apply to booking data you need for accounting and tax purposes.

Does the EU GDPR also apply?

The GDPR can also apply to providers outside the EU if they deliberately offer services to people in the EU (Art. 3 para. 2 GDPR). Whether this applies to a Swiss holiday rental with guests from Germany depends on the circumstances and has not been conclusively settled.

A short summary, not legal advice. The linked official source and your municipality’s rules prevail.