Guest data and law 09-08: what hosts should know
What guest information to ask for — and what to avoid: purpose, proportionality, retention and access, within the framework of law 09-08.
Adding a field to a form takes a few seconds. Keeping that data for months can create additional responsibility.
The right principle is simple: every piece of information you request must have a clear reason.
Start with the purpose, not the field
Before adding “phone”, “occupation”, “date of birth” or a document to your flow, write in one sentence why this data is needed. If your team cannot explain the purpose, the field deserves a second look.
The CNDP, Morocco’s data protection authority, points out that data must be collected for specified, explicit and legitimate purposes, and must be necessary, proportionate and not excessive in relation to those purposes.
Separate mandatory, useful and optional
Information needed for an administrative formality does not have the same status as a stay preference or data collected out of habit.
This distinction helps your team avoid asking for more than necessary.
Separate administrative, operational and marketing uses
A single form can hide several uses. One item may serve an administrative formality, another may help organise the arrival, and yet another may be used for commercial communication.
Keep these purposes apart in your design. It makes the flow clearer for the guest and helps the team when it has to explain why a piece of information is requested.
Explain the request to the guest
A form becomes simpler when the guest understands what they need to provide and why. Avoid vague fields and requests without context.
Inform the guest
When data is collected, the guest must receive the required information about how it is processed. Your form and your privacy policy must match the processing you actually carry out.
Avoid generic texts copied from another website. They may describe uses that do not match your activity.
Limit retention
Keeping data “just in case” is not a strategy. The CNDP points out that data identifying individuals must be kept for a limited period, no longer than necessary for the purpose of the processing.
Your procedure should therefore set out what is kept, for how long, where and who can access it. Specific obligations that apply to certain data or documents must be checked separately.
Control access
A centralised file can improve organisation, but access rights must be managed too. The CNDP requires appropriate precautions to ensure the integrity and confidentiality of data and to prevent access by unauthorised third parties.
Apply a simple principle: each role sees what it needs to do its job. A person in charge of cleaning, for example, does not need the same level of information as a person reviewing a guest file.
Map your collection points
Guest data does not come only from the check-in form. It can also arrive through a booking platform, email, messaging, phone or paper documents. Map these points to know where information is duplicated and who can access it.
Reducing unnecessary copies then makes data easier to update, delete and secure.
Check your service providers
If a provider processes data on your behalf, the CNDP stresses the need for sufficient guarantees on security and confidentiality. List the tools your flow relies on and check responsibilities, access and, where relevant, questions related to data hosting or transfer.
Plan for requests from data subjects
Law 09-08 grants rights to the people whose data is processed. Your organisation must know where to direct a data-related request. A contact address that is displayed but never monitored is not a procedure.
Do not turn messaging into a guest file
Photos of identity documents, numbers and personal information should not be scattered across team conversations.
DarID gathers stay information in a dedicated flow and offers a free police form generator that works without an account. This does not exempt the host from defining their own rules for processing, access and retention.
Before adding a new field
Ask three questions: do we need it? who will have access to it? when can it be deleted?
Frequently asked questions
Does more data improve check-in?
Not necessarily. A longer form can increase drop-offs and create more data to protect. Ask for what genuinely serves the stay or an applicable obligation.
Can check-in data be used for marketing?
Do not assume that data collected for an administrative purpose can be freely reused for another purpose. Check the legal basis and the obligations that apply.
Does DarID guarantee CNDP compliance?
No. DarID can help organise the flow and the information. Compliance depends in particular on your processing, your purposes, your procedures and the obligations that apply to you.