# Running a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → audit: the checklist for a multi-property portfolio
A regulator's inspector walks into the corporate office of "Meridian Hotels," a fictional 40-property group spanning the US and Europe, and asks for one thing first: "Show me who accessed guest passport scans in the last 90 days, and why." Meridian's compliance lead cannot produce the log in under three days. That single gap, an incomplete access log, is often enough to trigger a formal investigation. This lesson walks through the audit script that would have caught it.
A single independent hotel has one property management system (PMS), one front desk, one data flow. A 40-property group has decentralized check-in systems, a central reservations database, loyalty program data flowing to a , third-party OTAs (online travel agencies, like Booking.com or Expedia) pushing bookings in, and outsourced spa, restaurant and parking vendors pulling guest data out.
Each handoff is a place where personal data (any information that identifies a guest: name, passport number, payment card, biometric face scan for keyless entry) can leak, be over-retained, or be shared without a valid legal basis.
Regulators treat the "controller" (the entity deciding why and how data is processed, in this case Meridian corporate) as accountable even when a vendor or a single property mishandles data. Scale multiplies exposure; it does not dilute responsibility.
Full GDPR text is available free via EUR-Lex, the EU's official legal database.
Run this in order. Each stop produces evidence a regulator would actually ask for.
Ask: what personal data do we hold, where, and why? A group of 40 properties should have a single data map listing every system (PMS, loyalty CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.Voir la définition complète →, keyless entry, Wi-Fi captive portal, spa booking app) and every data category it stores (name, passport/ID number, payment tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.Voir la définition complète →, biometric template, health notes from concierge requests).
Check: does each entry have a documented legal basis (consent, contract necessity, legitimate interest)? Under GDPR, "legitimate interest" is not a blank check; it requires a documented balancing test against guest rights.
Red flag at Meridian: three properties still store scanned passport images in local folders with no retention limit, five years after check-out. GDPR's data minimization principle requires deleting data once the purpose (verifying identity at check-in, often required by local tourism law) is fulfilled.
Ask: who touched this record, and could they justify it?
Check: pull access logs for a sample of 20 guest profiles across five properties. For each, verify that every staff member who opened the record had an operational reason (front desk agent processing that guest's stay, not a random staff member browsing a celebrity guest's file, a real pattern regulators look for, sometimes called "insider snooping").
A minimal log query looks like this:
SELECT staff_id, guest_id, access_timestamp, action_type
FROM access_logs
WHERE guest_id IN (sample_list)
AND access_timestamp BETWEEN '2026-01-01' AND '2026-03-31'
ORDER BY guest_id, access_timestamp;If this query cannot run because logs are not centralized or retained, that is itself the finding. GDPR Article 30 requires being able to demonstrate accountability, and you cannot demonstrate what you cannot query.
Ask: does every third party touching guest data have a contract that says what they can do with it?
Meridian shares data with: the OTA channel manager, a laundry vendor with app-based room-status access, a marketing agency running email campaigns, and a facial-recognition vendor for VIP lounge check-in.
Check: for each vendor, does a Data Processing Agreement (DPA) exist? Under GDPR Article 28, any processor acting on the controller's behalf must be bound by a written contract specifying purpose, duration, deletion obligations, and audit rights. No DPA, no lawful processing, regardless of how careful the vendor actually is.
Red flag at Meridian: the facial-recognition vendor's contract expired 14 months ago and was never renewed, meaning biometric data (a "special category" under GDPR Article 9, requiring explicit consent) has been processed with zero contractual basis since.
Ask: can we prove, for any given guest, what they agreed to and when?
Check: sample 15 loyalty program members and 15 marketing email recipients. For each, locate the timestamped consent record: what checkbox they ticked, what text they saw, whether it was bundled with other consents (bundling, like forcing marketing consent alongside a required booking, generally invalidates consent under GDPR).
Red flag at Meridian: the group's 2023 website redesign lost the consent timestamp field in a database migration. Marketing has been emailing 60,000 contacts with no retrievable proof of consent, a direct exposure under both GDPR and CCPA's "right to opt out of sale/sharing."
Ask: if a laptop with guest data walks out the door tomorrow, what happens in the next 72 hours?
GDPR requires notifying the relevant DPA within 72 hours of becoming aware of a breach affecting personal data, and notifying affected individuals "without undue delay" if the breach poses high risk.
Check: does Meridian have a documented incident response plan naming who decides, who notifies, and a pre-drafted guest notification template? Or does breach response currently mean "call the IT vendor and hope"?
For a useful, free baseline framework here, the NIST Cybersecurity Framework is widely used even outside the US as a structuring tool for incident response, though it is not itself a privacy law.
Vérification des acquis
1. In the Meridian Hotels scenario, why does a single incomplete access log carry such serious regulatory weight?
2. Why does a 40-property hotel group face significantly more governance risk than a single independent hotel, according to the lesson?
3. Meridian corporate is considered the 'controller' even when a single property or vendor mishandles guest data. What does this concept imply for how an audit should be scoped?
4. Select ALL correct answers about why data handoffs in a multi-property portfolio increase governance risk.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers describing what qualifies as 'personal data' under the governance concepts discussed in this lesson.
Sélectionnez toutes les réponses correctes.
Tally the five stops. Meridian fails on:
1. Data inventory (undocumented, over-retained passport scans)
2. Vendor agreements (expired biometric vendor DPA)
3. Consent records (lost timestamps, no proof for 60,000 contacts)
Passes marginally on access logs (logs exist, but querying across properties took three days instead of being immediate) and breach readiness (a plan exists but has never been tested).
A DPA inspection under GDPR typically escalates when multiple systemic failures appear together, not one isolated glitch. Three failed stops out of five suggests Meridian would face a formal investigation, likely resulting in a corrective order and a realistic risk of a fine. As of 2026, EU hotel-sector GDPR fines have ranged widely by case, from low-five-figure amounts for small breaches to multi-million-euro fines for large chains (Marriott's 2020 UK ICO fine, reduced on appeal to about £18.4 million, is the most cited hospitality precedent; treat the exact figure as historical record, not a current benchmark).
A one-time audit is a snapshot. Regulators and boards increasingly expect a cadence: