Guest information can spread across booking platforms, email, payment services, spreadsheets, and staff phones. A small hospitality business should know where that information is and who can access it.
Map the guest journey
List the names, phone numbers, email addresses, booking details, and payment information you collect. Identify which suppliers process them and how information moves between systems. Record where it is retained and when it can be deleted.
Make everyday access clearer
Use individual accounts where possible and review access when staff change. Make sure website and booking notices describe what actually happens. Assign someone to handle privacy requests and incidents. A manageable routine is easier to maintain than a policy that does not fit the way bookings are handled.