On 4 June 2026 the European Commission opened an infringement procedure against Spain over its guest registration system. It did so by sending a letter of formal notice, case INFR(2026)4005, as part of its June infringements package. The target: the system created by Royal Decree 933/2021, the rule that obliges every Spanish lodging to report traveller data through SES.HOSPEDAJES.
If you own or manage a holiday rental in Spain, you have probably seen headlines suggesting the obligation has fallen. It has not. Your duties today are exactly what they were on 3 June. Here is what Brussels actually said, what timeline it opens, how Spain’s Interior Ministry reacted, and what you should do.
What the Commission actually said
The objection is not based on the GDPR, as some coverage suggests, but on Directive (EU) 2016/680, the EU rule governing personal data processing for law enforcement. The Commission raises three concrete problems with the Spanish system:
- Too many categories of data are collected. The decree makes lodgings, platforms and car-hire companies collect and transmit data to a centralised government database accessible to law enforcement, in sets the Commission considers excessive, with express mention of payment and GPS data.
- Police access is not sufficiently limited. The directive requires access restricted to specific, explicit purposes; the Commission considers Spain’s system fails that test.
- Three years of retention is disproportionate. That is the retention period Royal Decree 933/2021 sets for all collected data.
Spain has two months to respond and address the shortcomings. If the answer does not satisfy the Commission, the next step is a reasoned opinion, the stage before a referral to the EU Court of Justice.
What a letter of formal notice is (and is not)
A letter of formal notice is the first step of an infringement procedure, not a ruling. It does not annul Royal Decree 933/2021, does not suspend SES.HOSPEDAJES, and does not change the penalty regime by a single euro. It is the formal way Brussels says “we believe this breaches EU law; explain yourselves or fix it”.
| Stage | What happens | Indicative timing |
|---|---|---|
| Letter of formal notice (4 June 2026) | Spain must respond | 2 months, to early August |
| Reasoned opinion | The Commission specifies the breach and demands changes | Another 2-month response window |
| Referral to the EU Court of Justice | The Court decides whether Spain is in breach | Typically years |
Many procedures end along the way, with the State adjusting the rule before trial. Others sleep for years. The one certainty is that the calendar belongs to Brussels and the Spanish government, not to the sector.
What does not change today: your guest reports
The consolidated text of Royal Decree 933/2021 remains in force, unmodified and unsuspended. In practice:
- You must still collect each guest’s data and report it through SES.HOSPEDAJES within 24 hours of the stay beginning.
- The penalties are unchanged, and inspections have not stopped.
- The three-year data retention duty still applies, even though it is precisely one of the points Brussels questions.
One Interior Ministry move is worth knowing: in late June it told travel-agency associations that the ministerial order developing Royal Decree 933/2021 is on hold until the European procedure is resolved. In other words, the ministry froze the system’s expansion but kept everything already in force intact. Spain’s trade press summed it up: guest registration remains in force.
If this sounds like a rerun of the NRUA story, the plots differ: Spain’s Supreme Court annulled the short-term rental registry (Royal Decree 1312/2024, Housing Ministry) over an internal competence problem. The Brussels case targets guest registration (Royal Decree 933/2021, Interior Ministry) over data protection. Neither touched your guest reports; this one has not either, yet.
What the Spanish industry is demanding
The hotel confederation CEHAT reacted the next day demanding the immediate repeal of Royal Decree 933/2021 and a working group to design an alternative system. It has warned since 2022 that the rule turns hosts into custodians of highly sensitive data, from card details to geolocation, and argues, citing EU case law on PNR data, that mass transfers of personal data to security authorities cannot be systematic or generalised.
The complaint that triggered the case came from the travel-agency association FETAVE, filed in January 2023. And the welcome was European-wide: ECTAA, HOTREC, ETOA and other industry bodies applauded the Commission’s move on 8 June.
What to do as an owner or manager
- Keep filing guest reports as always. The sanction risk has not dropped, and a favourable outcome would take years to become enforceable change.
- Distrust anyone telling you “it’s no longer required”. It happened after the NRUA annulment and it is happening again: imprecise headlines that end in very real penalty files.
- Mark early August 2026. That is Spain’s response deadline, the first date that matters. We will update this piece when there is news.
- Collect only what the rule requires. The case is a reminder that this data is sensitive. Over-collecting (ID photocopies included) also exposes you to Spain’s data protection authority.
While the framework stands, the daily obligation is the same as ever: correct data, report filed on time, receipt kept. That routine is what RegistroViajero automates today, digital check-in and SES.HOSPEDAJES submission included; if the state system changes along the way, adapting the submission is our job, not yours.
Frequently asked questions
Do I still have to file traveller reports for my Spanish rental? Yes. Royal Decree 933/2021 remains fully in force, penalties included. The European procedure suspends nothing.
Has Brussels annulled Spain’s guest registration? No. It opened the first stage of an infringement procedure: a letter of formal notice giving Spain two months to respond. An annulment, if it ever came, would need years and an EU Court ruling, or a reform by the Spanish government itself.
Which EU rule does Spain allegedly breach? Directive (EU) 2016/680 on police data. Three objections: excessive data categories (payments and GPS included), insufficiently limited police access, and a disproportionate three-year retention.
Is this the same as the NRUA annulment? No. The Supreme Court struck down the Housing Ministry’s rental registry over regional competences. This case questions the Interior Ministry’s guest registration over data protection. Different rules, ministries and procedures.
When will we know more? Spain’s response window closes in early August 2026. The Commission then decides whether to close the case, ask for more, or escalate to a reasoned opinion.
Sources and disclaimer
Sources: European Commission, June 2026 infringements package (INFR(2026)4005); Royal Decree 933/2021, consolidated text (BOE); CEHAT press release, 5 June 2026; European industry joint statement (ETOA), 8 June 2026; Hosteltur, 26 June 2026.
This article is informational and is not legal advice. The infringement procedure is ongoing: check the cited official sources for the current status.
