Apartment Guest Register 2026: Template, Data, Storage Period

Guest Register in a Rental Apartment - Good Practice, GDPR, and Practical Templates

Running a short-term rental? It's worth keeping a guest register. Beware of a common myth: in private short-term rentals there is NO current regulation requiring you to keep a "guest book" - residence registration books were abolished around 2013. A guest register is therefore good practice (and a possible future requirement under a draft bill), not a legal obligation. In this article, we explain what data is worth collecting, on what GDPR basis, how long to store it, how to reconcile the register with GDPR, and how to avoid the most common mistakes.

Key takeaways

• A guest register in private STR is good practice, not a legal obligation - no act (Population Registration Act, Foreigners Act, Hospitality Services Act) imposes it.
• Collect only the data you actually need (first name, surname, document number, stay dates) - do not photocopy documents.
• You can keep the register in paper or digital form - both are acceptable.
• Store guest data for a maximum of 5 years (for tax purposes), then delete or anonymize it.
• The GDPR basis is Art. 6(1)(b) (performance of a contract) or (f) (legitimate interest) - NOT (c).

Do You Have to Keep a Guest Register?

This is the most common misconception in the industry. In private short-term rentals there is NO current obligation to keep a register or "guest book." Below we clarify what actually follows from each act - and why it's still worth keeping a register.

Population Registration Act (meldunek)

The Population Registration Act of September 24, 2010, concerns the residence registration obligation. The obligation to register for temporary residence applies to stays longer than 3 months and rests on the PERSON staying, not on the host. A typical tourist stay (a few days) does not trigger any registration obligation at all, and this act does not require the host to keep a guest register.

Foreigners Act

Contrary to widespread belief, Polish law does NOT impose an obligation on a private host to report foreign guests to the Border Guard (Straz Graniczna). Such an accommodation-provider reporting obligation is known from some other countries (e.g. the Czech Republic, Spain), but not from Poland. There is no regulation requiring a foreigner to be reported within 24 or 48 hours.

Hospitality Services Act

The Hospitality Services Act of August 29, 1997, regulates the rules for providing accommodation services, but does not require a facility to keep a guest register. What actually follows from it for many hosts is the option (and often the obligation) to register the property in the municipal register of other facilities providing hospitality services (Art. 38-39) - but that is a register of FACILITIES, not guests.

Draft Bill (UC135) and EU Regulation 2024/1028

EU Regulation 2024/1028 concerns the collection and exchange of short-term rental data by platforms - it does not directly require a host to keep a guest register. A mandatory "stay register," however, appears in the DRAFT Polish bill (UC135), which has not been enacted. That is why, today, you should treat a guest register as good practice and preparation for a possible future requirement.

What Data Is Worth Collecting

If you decide to keep a register, collect only the data actually needed to carry out and settle the stay. The scope below is a practical maximum - you don't have to collect everything.

Basic Data

• First name and surname of the guest
• Date of birth
• Citizenship
• Identity document number (ID card or passport)
• Check-in date (arrival date)
• Check-out date (departure date)
• Room or unit number (if applicable)

Foreign Guests

For guests from abroad you have no additional reporting obligations (see the section below). A passport number is usually enough to verify identity. You don't need to collect a visa number, purpose of stay, or foreign address unless you need it to perform the contract.

Data You Should NOT Collect

In accordance with the data minimization principle (GDPR), you should not collect information that isn't necessary. Avoid collecting:

• PESEL number (unless required by registration regulations in specific situations)
• Marital status
• Religion
• Phone number and email address (unless needed for service delivery - but then on a different legal basis)
• Photocopies or photos of identity documents (the document number alone is sufficient)

Register Format - Paper or Digital

Paper Register

The traditional form is a notebook or binder with registration cards. Each guest fills in a card at check-in. Advantages: simplicity, no equipment needed, easy to implement. Disadvantages: hard to search, risk of loss or damage, requires physical storage, harder to protect from unauthorized access.

If you choose paper format, ensure:

• A legible form with clearly labeled fields
• A GDPR privacy notice on the form
• Storage in a locked cabinet or drawer
• Card numbering and chronological order

Digital Register

More and more hosts are switching to digital solutions. A digital register can be a spreadsheet, a dedicated app, or a module in a property management system (PMS). Advantages: easy searching, automatic backups, ability to generate reports, easier GDPR compliance (access controls, encryption). Disadvantages: requires hardware and software, risk of technical failure, need for IT security.

Popular digital solutions:

• Google Sheets / Excel - simplest solution, but requires manual security (password, encryption)
• Dedicated PMS apps (Beds24, Guesty, Your.Rentals) - have built-in guest registration modules
• Online forms (Google Forms, JotForm) - guests fill out a form before arrival, data goes to a spreadsheet
• Self-check-in apps (Chekin, GuestReady) - document scanning, identity verification, automatic entries

Data Retention Period

How long must you keep guest data? This is one of the most frequently asked questions, and the answer isn't straightforward because it depends on the legal basis.

Guest Register (Good Practice)

Since the register does not arise from a specific recordkeeping obligation, the retention period is determined by the purpose for which you collect the data (usually performance of the contract and potential claims). In practice, data is kept for the period necessary to settle the stay and defend against claims.

Tax Purposes

If the guest register also serves as documentation confirming rental revenue, the retention period extends to 5 years from the end of the tax year in which the tax obligation arose.

GDPR Principle

GDPR requires that personal data not be stored longer than necessary for the purposes for which it's processed. After the retention period expires, data should be deleted or anonymized. Practical recommendation: store data for 5 years (due to tax purposes), then delete it.

GDPR and the Guest Register - How to Reconcile Them

Maintaining a guest register involves processing personal data and thus falls under GDPR. As a host, you are the data controller of guest personal data and must fulfill a number of obligations.

Legal Basis for Processing

You process guest data primarily on the basis of performing the rental contract (Art. 6(1)(b) GDPR), and - as regards protection against claims - on the basis of legitimate interest (Art. 6(1)(f) GDPR). This is NOT processing based on a legal obligation (point (c)), because no such obligation to keep a register exists in private STR today. You don't need separate consent from the guest for data necessary to carry out the stay - and without providing basic data, you simply cannot conclude and settle the contract.

Information Obligation

You must inform the guest about processing their personal data. The privacy notice should include:

• Controller data (your first name, surname, contact address)
• Processing purpose (keeping guest records for performance of the contract)
• Legal basis (performance of the contract / legitimate interest)
• Data retention period
• Guest rights (access, rectification, deletion after the retention period, right to complain to the Data Protection Authority - UODO)
• Information about any data recipients (e.g. accounting office, reservation system provider, authorized bodies - if they make a request based on regulations)

You can place the privacy notice on the registration form, in the property rules, or in a visible place at reception (check-in area).

Data Security

You must apply appropriate technical and organizational measures to protect guest data. In practice, this means:

• Paper register: locked cabinet, access restricted to authorized persons only
• Digital register: access password, file or disk encryption, regular backups, current antivirus software
• Both cases: data processing authorizations for persons with access (e.g., cleaning person, co-host)

Foreign Guests - Do You Have to Report Them Anywhere?

This is another popular myth. Polish law does NOT impose an obligation on a private host to report foreign guests to the Border Guard (Straz Graniczna) or the Police - there is no regulation providing for reporting within 24 or 48 hours of check-in. The residence registration obligation of a foreign guest (like any guest) arises only for stays longer than 3 months and rests on that person, not on you.

What does this mean in practice? When hosting a tourist from abroad for a few days, you have no additional reporting obligations toward the authorities. It's enough that - as with any guest - you confirm their identity for the purposes of the contract and settlement of the stay. If, in the future, an act introducing a national register (the CWTON system) comes into force, the scope of obligations may change - follow the legislative work.

Registration Card Template

Below are the elements a guest registration card should contain for a short-term rental apartment:

Header

Property name / host first name and surname, property address (and the national CWTON register number, once you receive one in the future).

Guest Data

• First name and surname
• Date of birth
• Citizenship
• ID document series and number
• Home address (optional, required for foreigners)

Stay Data

• Check-in date
• Check-out date
• Number of guests (including children)

GDPR Notice

Abbreviated privacy notice with reference to the full version in the property rules.

Guest Signature

Confirmation of having read the rules and agreement to the stay conditions (the signature isn't consent for data processing - that arises from performance of the contract).

Inspection and Control - What to Expect

Although the guest register itself is not required today, running a legal rental may involve inspections by various authorities:

• Tax Office - verification of proper tax reporting (a guest register can help as revenue documentation)
• Data Protection Authority (UODO) - inspection of personal data processing (if you collect guest data, you must do so in accordance with GDPR)
• Municipality - regarding registration of the property in the municipal register of facilities providing hospitality services

During a personal data inspection, UODO may check whether you have a privacy notice and appropriate safeguards. So if you decide to keep a register, it's worth doing it in accordance with GDPR from the start.

Most Common Host Mistakes

1. Photocopying documents - copying ID cards or passports violates the GDPR data minimization principle. Note only what's needed, don't copy the document
2. No GDPR notice - collecting data without informing the guest about processing violates the information obligation
3. Storing data without security - an open notebook by the door, an unprotected Excel file, data in the cloud without encryption
4. Storing data too long - registers from 10 years ago, never deleted. After the retention period, data should be destroyed
5. Wrong GDPR basis - relying on a "legal obligation" (point (c)), which does not exist in private STR, instead of performance of the contract (point (b)) or legitimate interest (point (f))
6. Collecting excessive data - asking about marital status, occupation, or religion on the guest card (collect only the data you actually need)
7. No data deletion procedure - it's worth having an established procedure for when and how you delete guest data after the retention period

Digital Tools for Keeping a Guest Register

If you want to automate keeping a guest register, consider the following tools:

• Chekin - online check-in app with identity verification and an automatic guest register (in countries that require it, it also handles police reports - in Poland no such host obligation exists). Integrates with Airbnb and Booking.com
• GuestReady - short-term rental management platform with a guest records module
• Beds24 - channel manager with guest register functionality and automatic data collection
• Google Forms + Sheets - free solution. Send guests a form link before arrival, data goes to a protected spreadsheet
• Notion or Airtable - flexible databases where you can create your own records system with filters, views, and automations

Regardless of the tool chosen, make sure it meets data security requirements (encryption, access control, data deletion capability) and that you have backups.

Frequently Asked Questions

In what form should I keep a guest register?

Regulations don't impose a specific form - you can keep a paper register (notebook, registration cards) or a digital one (spreadsheet, PMS app, online form). What matters is that the register contains all the data you need, is protected from unauthorized access, and can be presented during an inspection.

How long should I keep guest data?

The recommended retention period is 5 years from the guest's check-out date. This follows from tax regulations - if the register serves as revenue documentation, data must be kept for 5 years from the end of the tax year. After this period, data should be deleted or anonymized in accordance with GDPR.

Can I keep the register electronically?

Yes, an electronic register is fully acceptable. You can use Google Sheets or Excel (with a password and encryption), dedicated PMS apps like Beds24 or Guesty, online forms, or self-check-in apps. The key is securing the data - an access password, encryption, and regular backups.

What if a guest refuses to provide data?

Basic data (e.g. the booking person's details and a document number to verify identity) is needed to conclude and settle the rental contract - without it you simply cannot carry out the stay. You process it on the basis of performing the contract (Art. 6(1)(b) GDPR) and legitimate interest (point (f)), not a legal obligation (point (c)). In practice, you can make accepting a guest conditional on providing the data necessary to fulfill the booking.

What data is worth collecting from a guest?

In practice, the following is enough: the booking person's first name and surname, an identity document number (for verification), and the stay dates. Follow the minimization principle - don't collect data you don't need, and don't photocopy documents (the number alone is entirely sufficient). You are not required to compile an elaborate "registration card" like those used in hotels.

Summary - A Guest Register Isn't Bureaucracy, It's Your Protection

Keeping a guest register isn't a legal obligation in private STR today - it's good practice and your protection (as well as preparation for a possible future requirement under the draft bill). In case of a dispute with a guest, an insurance claim, or a tax inspection, a diligently kept, GDPR-compliant register is evidence that you operate responsibly. The time invested in creating a good records system pays off in peace of mind and security.

Don't want to search for templates and regulations on your own? The HostReady Package includes complete documentation, fill-in templates, and checklists - ready to use right after purchase.

--- *Legal notice: The content on this page is informational and does not constitute legal or tax advice or a binding interpretation of the law. Legal status: April 2026. EU Regulation 2024/1028 applies directly from May 20, 2026. The Polish implementing act (UC135) is at the draft stage and may change. Use of this content is at your own risk. For complex matters, consult a legal counsel or tax advisor.*