Data protection for a restaurant guest list

A restaurant's guest list grows quietly. Every booking adds a name, a phone number and an email address. Every visit adds a little more: what the guest ordered, how much they spent, a note that they prefer a quiet table, an allergy, a birthday. After a few years, the list holds thousands of people and a great deal about them, and most owners have never asked whether they are allowed to keep it all, or for how long.

Data protection law asks exactly those questions. It does not stop a restaurant from remembering its guests; it asks that the venue keeps only what it needs, uses it only for the reasons it gave, keeps it safe and lets guests see it or have it removed. Done well, it protects the venue as much as the guests.

This guide covers what a restaurant may keep, the reasons that allow it, how long to keep it, the notes you should not keep at all and what to do when a guest asks for their record or asks for it to be deleted. It is a practical guide, not legal advice. Every venue and figure in it is an example.

Data protection covers any information about a person who can be identified: a name, an email address, a phone number, a booking history, a note about a preference, a feedback comment with a name attached. A guest list is personal data from the first entry.

In the UK and the European Union, the rules come mainly from the General Data Protection Regulation, in each place's own version, and many other countries, including the UAE, have their own laws built on similar ideas. The details differ, so check the rules where you trade, but the principles below apply almost everywhere.

Data protection rests on a few principles. Be open about what you collect and why. Use it only for those reasons. Keep only what you need. Keep it accurate. Do not keep it longer than necessary. Keep it secure. And be able to show that you do all of this.

For a restaurant, that means a clear privacy notice, a guest record that holds only useful information, a routine for removing old records, sensible limits on who can see what and a short written note of how the venue handles guest data.

The law lets a business hold personal data only when it has a lawful reason. For a restaurant, the common ones are a contract, such as a booking the guest asked you to make; a legal obligation, such as keeping financial records; consent, such as a guest agreeing to receive marketing emails; and legitimate interests, such as remembering a regular's preferences to serve them better.

Each piece of guest data should have a reason. A booking's name and phone number are needed to hold the table. A guest's email for marketing needs their consent. A note that a regular likes the corner table rests on legitimate interests, as long as the guest would reasonably expect it and it does them no harm.

A restaurant can reasonably keep the details needed to take and manage bookings, the history of visits and spend that helps it understand and serve its guests, preferences that make each visit better, allergies and dietary needs that keep guests safe and the consent records for marketing.

The test for anything else is whether it helps serve the guest and whether the guest would expect you to have it. Our guide to guest data: what to collect and what to leave covers the line in more detail.

Allergies and dietary needs linked to medical conditions are health information, which data protection law treats as especially sensitive. A venue can still record them, because they keep guests safe, but it should take more care: record only what is needed for the guest's safety, limit who can see it and never use it for anything else.

Never use an allergy to target a guest with marketing, and never share it beyond the people who need it to prepare and serve their food. An allergy recorded to protect a guest should only ever be used to protect them.

Some notes do not belong on a guest record at all: comments about appearance, guesses about a guest's health, religion, politics or relationships, opinions about their behaviour written in anger, or jokes the team would not want the guest to read. Under data protection law, a guest can ask to see their record, and every note on it.

A simple rule helps: write nothing on a guest's record that you would not be comfortable reading aloud to them. Our guide to notes you should not keep about a guest covers what to record and what to leave out.

Marketing emails usually need the guest's consent, freely given, specific and recorded. A box the guest ticks, unticked by default, with a clear description of what they will receive, is the usual way. Some places allow existing customers to be emailed about similar services without a separate tick, as long as they were offered a way to refuse when they gave their details.

Keep a record of when and how each guest agreed, and make unsubscribing easy and immediate. Our guide to marketing consent, collected so it holds up covers how to collect it.

Guest privacy depends on the team as much as the system. Staff who look up a guest out of curiosity, read their spending aloud at the pass or share a famous guest's booking on social media break the guest's trust and, in many cases, the law.

Limit who can see what, by role: the host needs names and booking details, the kitchen needs allergies, the manager may need history and spend. Our guide to guest privacy in a restaurant that remembers you covers how to remember guests without making them uneasy.

A privacy notice tells guests what you collect, why, how long you keep it, who you share it with and how to contact you about it. It belongs wherever guests give their details: on the booking page, on the website and, in short form, wherever guests are asked for an email address.

Write it plainly. A notice that a guest can read in two minutes, and that matches what the venue actually does, is worth far more than a long legal document copied from somewhere else.

Keep guest data only as long as you need it. Financial records must usually be kept for a set number of years for tax. Booking details may be needed for a while after the visit, for questions and complaints. A guest who has not visited in several years, and has not agreed to marketing, may no longer need to be on the list at all.

Set a retention period for each kind of data, write it down and follow it. A routine every few months, removing guests who have not visited for the period you set, keeps the list lean and lawful.

Keep guest data secure. Use a booking and guest system with proper access controls, give each member of staff their own login rather than a shared one, remove access when someone leaves and never keep guest lists in personal email accounts or on unprotected spreadsheets.

Paper counts too. A booking diary left open on the bar, or printed guest lists thrown in the general rubbish, can expose guests' details as easily as a hacked system.

Share guest data only when there is a reason and the guest would expect it. A booking system, an email service and a payment provider handle guest data on the venue's behalf, and each should have an agreement that sets out how they protect it.

Do not pass guest lists to other businesses, sponsors or partners without the guests' clear agreement. A guest who gave their email for a booking did not agree to hear from the wine merchant next door.

A guest has the right to ask for a copy of the personal data you hold about them. In many places, you must reply within a month, free of charge in most cases. The reply should include their details, their bookings, their history, any notes and how the data is used.

Check that the request comes from the guest, gather what you hold from every system and paper record, and send it in a clear form. This is the moment when notes written carelessly years ago are read by the person they describe.

A guest can also ask for their data to be deleted. In most cases, a restaurant should do so, except for data it must keep for a legal reason, such as financial records, or data it needs for a live complaint or claim.

Delete or anonymise the guest's details across every system and paper record, and confirm to the guest what was done and what, if anything, was kept and why. Keep a short note that the request was received and handled, without keeping the data itself.

A guest who asks to stop receiving marketing must be taken off the list at once, and kept off. Every marketing email should carry an unsubscribe link, and a guest who unsubscribes should not be added back by a later import or booking without their fresh agreement.

Unsubscribing from marketing does not mean deleting the guest. They can still book, and their booking confirmations and reminders are part of the service rather than marketing.

Guests can ask for inaccurate data to be corrected: a misspelled name, an old email address, an allergy recorded wrongly. Correct it promptly, especially anything that affects their safety.

Duplicate records are a common source of inaccuracy. A guest with three profiles, each partly out of date, is harder to serve and harder to answer when they ask for their record. Merging duplicates keeps the list accurate.

Data protection covers the team as well as the guests. Staff records, from contact details and bank details to sickness notes and disciplinary records, are personal data, and some of them, such as health information, are especially sensitive.

Keep them secure, limit who can see them and keep them only as long as needed. A personnel file left in an unlocked drawer, or staff details shared in a group chat, breaks the same rules as a guest list left on the bar.

Security cameras that record identifiable people collect personal data too. Put up clear signs telling guests and staff that cameras are in use and why, point them only where they are needed and keep the footage only as long as you need it.

Limit who can view the footage, and think carefully before sharing it. A guest can ask for footage of themselves, just as they can ask for their guest record.

If guest data is lost, stolen or shared by mistake, act quickly. Contain it, work out what was exposed and who is affected and, where the risk to guests is real, tell the regulator, in many places within seventy-two hours, and tell the guests affected.

Keep a simple record of every incident, even small ones, such as a guest list emailed to the wrong address. The record shows what happened, what was done and what changed to stop it happening again.

Children's details sometimes reach a guest list: a birthday party booking, a child's name on a family's profile, an allergy recorded for a child. Treat them with extra care, keep only what the booking or their safety needs and never use them for marketing.

Marketing should be aimed at adults who have agreed to it. A family that booked a birthday party has not agreed to marketing addressed to their child.

In some places, businesses that handle personal data must register with, or pay a fee to, the data protection regulator. In the UK, for example, most businesses that process personal data pay an annual data protection fee unless they are exempt.

Check whether this applies where you trade. It is usually a small, simple step, and missing it can bring a fine that is far larger than the fee.

In a group of venues, guest data is often shared between venues, so a guest recognised at one is recognised at another. That can be a good thing, as long as the privacy notice says so and guests would expect it.

Apply the same rules at every venue: the same retention, the same access limits, the same way of handling requests. A request to one venue for a guest's record should cover what every venue in the group holds.

Data protection law expects a business to be able to show how it handles personal data. For a restaurant, a short written note is usually enough: what you collect, why, where it is kept, who can see it, how long you keep it and how you handle requests and incidents.

Review it once a year, and whenever you change systems or start collecting something new. A note that matches what the venue actually does is the best evidence of good practice there is.

Data protection sits alongside food safety, licensing and health and safety in a venue's compliance: a set of duties that protect guests and the business, and that are far easier to keep up as part of the routine than to fix after a problem.

Our guide to food hygiene rating: earning the top score covers the food safety side, which follows the same pattern: simple routines, clear records and a team that knows its part.

An invented bistro has a guest list of eight thousand names built over six years, with notes from many different staff. A guest asks for a copy of their record and finds a note describing them as difficult. The owner apologises, removes the note and reviews the list.

The bistro sets a rule for notes, removes comments that are not about service or safety, sets a retention period of three years without a visit for guests who have not agreed to marketing, limits allergy details to the staff who need them and writes a short privacy notice for the booking page. Every few months, the manager removes guests past the retention period, and the next request for a record is answered within a week without embarrassment.

In servearound, who sees a guest's record follows each person's role: taking a booking needs only a name and number, while the full profile, with visits, spend, notes, allergies and feedback, is for the roles you give it to, and every note carries its author and date. Guests opt in to marketing with an unticked box as they book and confirm it by email, every campaign carries an unsubscribe link that lands on the guest's record at once, imported guests are never signed up and allergens can only leave guests out of an audience.

Guests giving feedback choose whether the venue may contact them, and if they do not, they are never identified to it. servearound has no export of guest records, no setting that clears old records on a schedule and no tool for permanent erasure: removing a guest takes them off the guest list. So a request for a copy is answered from the profile by hand, and your retention routine and your answer to an erasure request are worth settling before the first one arrives. See Guest CRM.

Yes, with a lawful reason for each kind of data, kept only as long as needed and kept secure.

No. Bookings rest on the contract, and preferences often on legitimate interests. Marketing usually needs consent.

Only as long as you need it. Set a retention period for each kind of data and follow it.

Allergies linked to health are treated as especially sensitive. Record only what safety needs, and limit who sees it.

Reply within the time your local law sets, often a month, with everything you hold about them.

Delete or anonymise their details everywhere, except what you must keep by law, and confirm what was done.

Anything you would not be comfortable reading aloud to the guest.

No. Check the rules where you trade, and take advice for anything unusual.

Data protection lets a restaurant remember its guests, as long as it keeps only what it needs, for reasons it can name, for no longer than necessary, securely, and lets guests see or remove what it holds. Bookings rest on the contract, marketing on recorded consent and preferences on what guests would reasonably expect, with allergies treated as the sensitive health information they are.

Write a plain privacy notice, set retention periods and follow them, limit guest privacy by role, keep the notes you should not keep off the record and handle requests for a copy or deletion promptly. Treat guest data and marketing consent with the same routine care as food safety, and the guest list stays an asset rather than a risk.