How should an Irish hotel retain financial records while deleting guest data it no longer needs?
A settled booking can leave an invoice, a payment reference, a guest profile and an identity document (ID) attachment in different systems. Managing hotel guest data retention in Ireland starts by separating these records and assigning each a clear purpose.
Keep the financial evidence required by Irish tax law in a restricted archive, while deleting guest information whose purpose has ended. Ordinary value-added tax (VAT) records generally require six years from their latest related transaction, with exceptions. The General Data Protection Regulation (GDPR) sets no single retention period for every guest record. A tax obligation does not justify retaining an entire guest profile.
Separate the financial record from the guest relationship
Revenue requires records that make transactions verifiable. Under section 84 of the VAT Consolidation Act 2010, the ordinary six-year clock runs from the latest transaction to which the records relate. Do not automatically start it at check-out.
The Data Protection Commission's retention guidance requires a purpose-based approach. Keep necessary invoice details intact, but assess optional preferences, correspondence and attachments separately.
- Map the property management system (PMS), accounting software, payment provider, marketing platform, inboxes and paper files.
- For each record, document its purpose, lawful basis, retention trigger, deletion date or review rule, and owner.
- Distinguish a restricted finance archive from a profile available for everyday guest service or marketing.
A practical hotel retention matrix
This working template assumes a VAT-registered hotel in the Republic of Ireland. Owners are suggested roles. Approve the rules for your property before configuring deletion; review dates below are operational choices, not statutory periods.
| Data type | Purpose | Lawful basis | Period or decision rule | Deletion action | Owner |
|---|---|---|---|---|---|
| Invoices and credit notes | Evidence sales, VAT and adjustments. | Legal obligation. | Normally six years from the latest related transaction for VAT records; check statutory exceptions and other applicable tax duties. | Preserve required fields and audit links; destroy securely after all applicable periods and holds end. | Finance lead with accountant. |
| Payment references and settlement evidence | Match deposits, payments and refunds to invoices. | Legal obligation for accounting evidence; assessed legitimate interests for dispute evidence. | Follow the related financial record where needed to prove the transaction. Separately document any dispute deadline and hold. | Retain the necessary transaction trail; remove redundant exports and payment attachments. | Finance lead. |
| Guest profile and service notes | Deliver the stay and resolve outstanding service matters. | Contract where necessary; assessed legitimate interests for justified follow-up. | Review at check-out and closure of outstanding matters. Delete fields when their purpose ends; document any continuing need. | Delete unnecessary contact details, preferences and notes without altering required invoices. | Front office manager. |
| Marketing consent evidence | Show who agreed, when, how and to which wording. | Consent for campaigns; legal accountability obligations for necessary proof. | Keep proof while relying on consent. After withdrawal, retain only evidence justified by a separately documented compliance or claims need. | End consent-based campaigns on withdrawal; minimise and restrict any retained proof, with a review date. | Marketing lead and privacy lead. |
| Marketing suppression record | Prevent an unsubscribed address being reimported. | Legal obligation to honour a marketing objection. | Keep a minimal block record while needed to prevent further unwanted marketing; review necessity separately. | Remove campaign profiles; retain only the identifier and opt-out evidence needed for suppression. | Marketing lead. |
| ID image or passport copy | Only a specifically justified identity-verification purpose. | A demonstrated legal obligation or assessed legitimate interests, where applicable; not a blanket policy. | If verification is the sole justified purpose, delete the image when verification ends. Assess statutory register fields separately. | Delete copies from uploads, inboxes and devices; retain only a justified verification record. | Front office manager and privacy lead. |
Legal bases depend on necessity: see the DPC's lawful processing guidance and consent and legitimate-interest checks. Marketing objections must be honoured under the DPC's direct marketing guidance.
Hypothetical example: a Galway hotel receives an erasure request after a €480 stay. Assume payment is settled, no dispute exists and the room-preference note has no remaining purpose. The hotel deletes that note and unnecessary profile fields, retains the required invoice and payment evidence with restricted access, and explains which records remain and why.
Make deletion controlled and repeatable
Use a monthly review as an operational backstop, alongside prompt deletion when a purpose ends or a valid request applies:
- Generate a due-for-review list using each record's trigger. Finance checks for outstanding refunds, tax enquiries, appeals and legal holds.
- Limit each hold to relevant records; record its reason, approver and next review date. Revenue identifies cases requiring longer retention.
- Delete approved data across live systems and copies. Agree backup expiry and restoration controls with providers so deleted data is not silently reintroduced.
- Log the category, action date, system and approver without copying deleted content. Sample-check that invoices remain readable and their payment trail still reconciles.
Keep statutory hotel-register information on its own schedule. Section 10 of the Immigration Act 2004 addresses hotel registers and provides for regulations on retention. Confirm the applicable guest scope, required fields and operative retention rules before setting that schedule; do not equate a register entry with a passport image.
Your privacy notice should explain retention periods or meaningful criteria, purposes and legal bases, following the DPC's transparency guidance.
Apply the policy to your RoomRaccoon workflow
RoomRaccoon's hotel property management software supports reservations, guest profiles and invoicing. Use a test booking to check what happens to linked invoices when profile fields are removed. Confirm deletion permissions, archive access, backup handling and connected-system responsibilities with the team. Agree which steps are manual and which your configuration supports.
Bring your retention matrix and a sample invoice to a demonstration of your property's workflow.
Book a demo for your propertyGuest data retention questions
Must an erasure request delete the invoice too?
Not while retaining it is necessary to meet a legal obligation. The DPC explains the erasure exceptions, including legal obligations and legal claims. Assess each record and explain any partial refusal; an invoice does not protect unrelated profile data from deletion.
Does keeping an invoice permit marketing to that guest?
No. Tax retention and marketing have different purposes. Email marketing normally requires consent, with a conditional existing-customer exception described in the DPC's electronic marketing guidance. An archived email address alone is not permission.
Can we keep anonymous booking statistics?
Use aggregate figures that cannot identify guests. Replacing names with booking references is insufficient where those references still link to identifiable records. Check small groups and unusual stays before treating a dataset as anonymous.
Can we scan paper invoices and destroy the originals?
Do not assume so. Revenue's guidance says to retain paper-issued invoices in paper form and applies separate rules to electronic records. Confirm the permitted format before destroying originals.
Sources and checks
Checked on 13 November 2026 for the Republic of Ireland. The matrix is an operational template; property-specific exceptions and system behaviour require confirmation.
- Revenue: keeping VAT records and retention exceptions and formats.
- VAT Consolidation Act 2010, section 84; Immigration Act 2004, section 10.
- DPC guidance linked above: retention, lawful processing, accountability, transparency, erasure and electronic marketing.
- RoomRaccoon PMS: published product scope.
