What do vacation rental hosts need to know about GDPR?

If you host EU guests or you're based in the EU, GDPR applies to you, and not just to the big platforms but to you personally, because you're the one deciding what to do with guest data. In GDPR terms you're a "data controller," and that comes with a handful of concrete obligations rather than a vague sense of being careful.

You're holding more guest data than you probably think: names, emails, and phone numbers from the booking, the whole message history, any codes and documents exchanged, sometimes photos, plus website logs if you run your own site. You need a lawful reason to process each bit of it (running the booking they asked for covers most of it), and guests have real rights over it: to see it, correct it, and have it deleted.

Practically, that's five things. Have a plain privacy policy that says what you collect and why. Don't hoard data forever; delete it a set time after checkout (many hosts land around 90 days). Store it somewhere encrypted, not in a shared spreadsheet or your texts. If a guest asks you to delete their data, do it within a month. And make sure the tools you use (your PMS, your messaging, even your cleaner's app) carry GDPR-compliant terms, because their handling of the data is on you too.

On the messaging side specifically, the questions to ask a provider are where the data lives, whether your guests' conversations get used to train models (they shouldn't), whether it's encrypted in transit and at rest, and whether you can pull or delete one guest's data on request. Most reputable software handles its own side of compliance; the part that's genuinely yours is what you do with guest information outside those tools.