Who is covered
Royal Decree 933/2021, of 26 October (BOE-A-2021-17461) reaches practically anyone who provides accommodation for money:
- Hotels, guesthouses, boarding houses and rooming houses
- Tourist apartments, bungalows and similar accommodation
- Rural tourism establishments
- Campsites and caravan sites
And not only whoever provides the service: it also reaches the travel intermediaries and digital platforms that offer accommodation in Spain, even though they are not the ones doing the accommodating.
The obligation to report electronically was postponed twice after publication and ended up becoming enforceable on 2 December 2024. Before that date the old systems ran alongside it — Hospederías from the Guardia Civil and WebPol from the National Police — and across most of Spain they are now replaced by SES.HOSPEDAJES.
What data has to be reported
The annex to the regulation distinguishes three blocks. They are worth looking at separately, because the first is sent once and the other two on every stay.
Company and establishment details
Reported once only, within ten days of administrative registration and before starting to trade. If you are opening a new establishment, this is the first formality.
Details of each guest
This is the bulk of the daily work:
| Field | Note |
|---|---|
| Given name and surnames | Exactly as they appear on the document |
| Sex | |
| Document type and number | DNI, NIE, passport |
| Document support number | The document’s own code; it is the field most often forgotten |
| Date of birth | |
| Nationality | |
| Usual address | Street, town and country |
| Phone and email | |
| Relationship | Only for under-14s, in relation to the accompanying adult |
Transaction details
Arrival and departure dates, number of travellers, contract reference and payment details — type of method, cardholder and, where applicable, expiry date and last digits of the card — plus the details of the property itself.
The deadline: 24 hours, and it starts sooner than you think
The rule asks for the report “immediately and in any case within no more than 24 hours”. The clock does not start at check-in: it starts at whichever happens first out of the booking, the signing of the contract or the start of the service.
In practice that means a booking made two days ahead already opens the window. It is the difference between sending the reports when the guest arrives — which tends to run late — and sending them when the booking comes in.
A counter of pending reports with the deadline in plain sight solves more incidents than any reminder. In Hostelum that count sits on the front desk screen, not buried in a report.
How long it has to be kept
Three years from the end of the service. The record has to be electronic and available to the State security forces.
That retention period has a practical consequence people overlook: you cannot delete a guest’s details after six months “for GDPR hygiene”, because there is a legal obligation to keep them. And the other way round: once the three years are up there is no basis for holding on to them, so it is better to have a scheduled purge than an archive that grows forever.
Catalonia goes its own way
The Mossos d’Esquadra maintain their own guest register for accommodation establishments, with its own file format. The deadline and the retention period are the same, but the destination and the structure of the submission are not.
A property in Catalonia therefore uploads nothing to SES.HOSPEDAJES: it uploads its file to the Mossos system. That is why software that only handles SES.HOSPEDAJES falls short in Barcelona, Girona, Lleida and Tarragona.
Check your own autonomous community before configuring anything. This point depends on the administrative practice of each territory, not only on the text of the royal decree, and it is worth confirming with your hotel association.
Penalties
The regulation refers to the penalty regime of Organic Law 4/2015 on the protection of public safety. Broadly speaking, not keeping the register or omitting compulsory reports weighs more heavily than sending incomplete or late data.
We have not found any official published statistics on cases opened on these grounds, so any specific figure you read out there is worth taking with a pinch of salt.
A 2026 development worth knowing about
In June 2026 the European Commission opened an infringement procedure against Spain in connection with this register, over possible incompatibility with the European data protection directive for the law enforcement sector. The objections point at the volume of data collected, at how police access is bounded and at the retention period.
That suspends nothing. RD 933/2021 remains fully in force, with the same 24-hour deadline and the same penalty regime. It is a procedure between the Commission and the Spanish state, not a moratorium for accommodation providers.
How it gets solved in practice
What makes this heavy work is not the rule: it is the typing. One report is twelve or thirteen fields per person, dictated at the desk with a queue behind.
The two levers that genuinely save time are:
- Have the guest enter the data themselves, from their phone and before they arrive, with a link sent along with the confirmation. The front desk goes from typing to validating.
- Do not type the document, read it. Pointing a camera at the ID and having the fields fill themselves in removes most transcription errors, which are also the ones that get a file rejected.
And a third, less eye-catching but just as important: the system should delete the image of the document as soon as it has extracted the fields. The rule obliges you to keep the data, not the photograph of the ID, and storing images of identity documents means taking on a risk nobody is asking you for.
What Hostelum does, and what it does not
Hostelum captures every field required by RD 933/2021 — including the document support number and the relationship for minors — allows check-in from the guest’s own phone with document scanning, deletes the images once the data has been extracted, and generates the file ready to upload: the Mossos format if you are in Catalonia, the SES.HOSPEDAJES XML everywhere else.
The final upload is done by you. We do not send anything by API to any authority and we do not hold your official credentials. We would rather tell you that here than in the third meeting.