Guest data in a guesthouse: what the law requires, what to keep and for how long

Every provider of accommodation (rooms, apartments, holiday homes, rural tourism households) collects guests' personal data. Part of that is required by law and part is your own choice. Both parts fall under the new state-level Law on Personal Data Protection (Službeni glasnik BiH 12/25). This text concerns accommodation owners in Republika Srpska.

In short

• The BiH Law on Personal Data Protection (Zakon o zaštiti ličnih podataka) was published on 28 February 2025, entered into force on 8 March 2025 and has applied since October 2025, after 210 days from entry into force (Article 120). The 2006 law no longer applies. Existing processing must be brought into line within two years of entry into force (Article 116), that is by 8 March 2027.
• Guest data that the RS Law on Hospitality (Zakon o ugostiteljstvu) requires (guest book, entry into the central information system) has a legal basis: a duty set by law. Anything beyond that, for example photocopying the whole ID card, you must be able to justify.
• A foreign guest must be reported to the competent police or the Service for Foreigners (Služba za poslove sa strancima) within 12 hours of check-in. The book of foreigners must be kept at least three years from the day the book is closed (Law on Foreigners, Article 103).
• A data breach (a lost phone with the guest list, a hacked account) must be reported to the Agency for Personal Data Protection of BiH within 72 hours when it is likely to put guests' rights at risk (Article 35).
• For other guest data the law sets no single retention period. The general rule is not to keep data longer than needed for its purpose (Article 7), so set your own deletion period.

Who it applies to

Every host who receives guests and records their data: sole trader, company or private person providing accommodation. The Law on Personal Data Protection does not cover purely personal household activities (Article 5), but taking paying guests is not that.

What to do

1. Keep the guest book. A host must keep an accurate, up-to-date guest book in every facility. Data on domestic guests goes into the guest book, and data on foreign guests into the book of foreign guests, under the foreigners rules. The guest book also records the personal ID number (JMB), in line with the personal data protection law. The book may be kept electronically (Law on Hospitality of RS, Article 31).
2. Enter guests into the central information system immediately after check-in, and tourist tax data immediately after check-out. Changes are entered within three days. Access to the system is free (Article 12a) and you provide the internet connection. If there is no internet, record the data by hand, in writing, and enter it later (Article 12b).
3. Report a foreign guest to the competent police or the Service for Foreigners within 12 hours and keep the book of foreigners. You have the book certified only at the competent unit of the Service for your place of residence or business seat (for East Herzegovina, the Trebinje field centre), not at the police. Keep it at least three years from closing and show it on request to an authorised officer of the Service, the Border Police or the police (Law on Foreigners, Article 103, paragraph 2).
4. Collect only what is needed. The law limits data to what is necessary for the purpose (Article 7). The Law on Hospitality and the Law on Foreigners require entering data in the book and the system, not a copy of the document. The type of data for the central system is set by a ministerial rulebook (Article 12a, paragraph 4). If you still scan or photocopy an ID card or passport, decide why, keep the copy locked or password-protected, and delete it when the purpose ends. If in doubt, ask the Agency.
5. Tell the guest what you do with the data at the time of collection: who you are, why you collect it, the legal basis, the retention period or the criteria for it, and the guest's rights, including the right to complain to the Agency (Article 15). A short notice at reception or in the booking confirmation is enough.
6. Ask for consent for marketing. Using a guest's e-mail or photo for a newsletter or social media is a separate purpose. Consent must be clear and you must be able to prove you got it (Article 9).
7. Secure the data: guest book in a locked drawer, passwords on phone and computer, access only for people who work with guests (Article 34).
8. Keep a written record of processing (who, which data, purpose, deletion period, safeguards, Article 32). The exemption for organisations under 250 employees does not apply if processing is not occasional. Recording guest data is an ongoing activity, so you should keep the record. A one-page electronic file is enough.
9. Document every data breach and report it to the Agency within 72 hours, with reasons if you are late (Article 35).

Deadlines and amounts

• Reporting a foreign guest: 12 hours from check-in.
• Book of foreigners: keep at least three years from the day the book is closed.
• Entering a guest into the central information system: immediately on check-in, changes within three days.
• Reporting a data breach to the Agency: up to 72 hours.
• Fines under the Law on Foreigners, Article 134 (no report or late report of a foreigner, book not kept or kept untidily or not kept for the required period, officer denied access): natural person 200 to 800 KM, legal entity 500 to 2,500 KM, responsible person in a legal entity 200 to 800 KM.
• Fines under the RS Law on Hospitality for failing to enter or for entering false data in the central information system: for not entering the required data (Article 12a), company 1,500 to 6,000 KM and sole trader 1,000 to 4,000 KM (Article 45); for late entry, no manual record or false data (Article 12b), company 800 to 3,200 KM and sole trader 600 to 2,400 KM (Article 47); natural person 500 to 2,000 KM (Article 49). The amounts come from the integral (unofficial) text of the law, so verify them in the Službeni glasnik RS before relying on them.
• The BiH Law on Personal Data Protection itself sets no fines, and refers to criminal codes for serious violations (Article 115).

Where to go

• Agencija za zaštitu ličnih podataka u BiH (Agency for Personal Data Protection of BiH, Sarajevo), for questions on processing and for breach reports. Find contact details on the Agency's official website.
• Your municipal administration or tourist organisation, for access to the central information system and tourist tax questions.
• Služba za poslove sa strancima (Service for Foreigners), Terenski centar Trebinje (Trebinje field centre, Sokolska 2a, Trebinje), competent for Berkovići, Bileća, Gacko, Istočni Mostar, Ljubinje, Nevesinje and Trebinje, for reporting a foreigner and certifying the book of foreigners. A foreigner can also be reported at the local police station.
• Ministarstvo trgovine i turizma Republike Srpske (Ministry of Trade and Tourism of RS), responsible for the central information system.

Laws and sources

• Zakon o zaštiti ličnih podataka (Službeni glasnik BiH, broj 12/25)
• Zakon o strancima (Službeni glasnik BiH, nos. 88/15, 34/21 and 63/23), Articles 103 and 134, base text from issue 88/15. Article 103 was amended by the Zakon o izmjenama i dopunama Zakona o strancima (Službeni glasnik BiH, no. 63/23).
• Zakon o ugostiteljstvu Republike Srpske (Službeni glasnik RS, nos. 45/17 and 1/24), Articles 12a, 12b, 31, 45, 47 and 49, in the RS electronic register of regulations. Articles are cited from the integral, unofficial text of the law.