Every hotel in Spain, Italy and Germany has to record who sleeps in its rooms. The three countries ask for different fields, on different deadlines, through different channels, and keep the records for different periods. A check-in form built for one of them is wrong for the other two.
This post reads the primary texts for each country and splits the fields into two groups: those printed on the guest's passport or ID card, and those only the guest can tell you. Every requirement below is quoted from the linked source. Where a source could not be read in full, the gap is named rather than filled.
This is the blog of doc.cheap, a Passport and ID OCR API that reads passports and ID cards from a photo and re-checks their MRZ check digits on the server. Nothing below depends on it.
Spain: Real Decreto 933/2021
Spain's rules are in Real Decreto 933/2021, published in the BOE. The consolidated text shows "Última actualización, publicada el 27/10/2021", and its communication duties apply "a partir del 2 de enero de 2023" (Disposición final tercera).
What the decree requires of a hotel:
| Requirement | What the text says | Where |
|---|---|---|
| Who signs | Entry forms "deberán ser firmados por toda persona mayor de catorce años" | Art. 4.2 |
| Accuracy | The establishment answers for the data matching the identity documents "que habrán de ser exhibidos o facilitados por los usuarios" | Art. 4.3 |
| Record | A "registro informático" holding the data of annexes I and II | Art. 5.1 |
| Deadline | Send the data "de manera inmediata" and in any case within 24 hours at most, counted from the booking and from "Al inicio de los servicios contratados" | Art. 6.3 |
| Channel | "por procedimientos telemáticos"; non-professional hosts may use other means | Art. 6.4 |
| Retention | "Los datos del registro informático deberán conservarse durante un plazo de tres años a contar desde la finalización del servicio o prestación contratada." | Art. 5.3 |
The guest fields are Anexo I, section A.3, "Datos de los viajeros". Here is the list, sorted by where the value comes from:
| Anexo I A.3 field | Source at check-in |
|---|---|
| a) Nombre | Document |
| b) Primer apellido | Document |
| c) Segundo apellido | Document, when the holder has one |
| d) Sexo | Document |
| e) Número de documento de identidad | Document |
| f) Número de soporte del documento | Document (Spanish cards); not one of the passport MRZ fields |
| g) Tipo de documento (DNI, pasaporte, TIE) | Document |
| h) Nacionalidad | Document |
| i) Fecha de nacimiento | Document |
| j) Lugar de residencia habitual (Dirección completa, Localidad, País) | Guest |
| k) Teléfono fijo, l) Teléfono móvil, m) Correo electrónico | Guest |
| n) Número de viajeros | Guest or booking |
| o) Relación de parentesco entre los viajeros (when one is a minor) | Guest |
Section A.4, "Datos de la transacción", adds the booking side: the contract reference, date and signatures; the date and time of entry and exit; the property's address, number of rooms and whether it has Internet; and the payment: type, identification of the means of payment, its holder, the card's expiry date and the date of payment. None of that is on a passport. It comes from your booking and payment systems.
One trap for parsers: a passport carries one surname field. Spanish names often have two surnames, and the decree asks for them separately, so the form should show the split and let the guest correct it.
Germany: Bundesmeldegesetz §§ 29 and 30
Germany's rules are in the Federal Registration Act, the Bundesmeldegesetz (BMG). § 29 BMG says who must register:
"Beherbergte ausländische Personen haben am Tag der Ankunft einen besonderen Meldeschein handschriftlich zu unterschreiben, der die in § 30 Absatz 2 aufgeführten Daten enthält." (§ 29(2))
So the duty in the current text is on foreign guests, and it falls on the day of arrival. Accompanying foreign spouses, partners and minor children are given only as a number, and for tour groups of more than 10 people only the tour leader signs. Under § 29(3) foreign guests identify themselves "durch die Vorlage eines gültigen Identitätsdokumentes (anerkannter und gültiger Pass oder Passersatz)".
The form need not be paper. Under § 29(5), with the guest's consent, the data may be collected electronically, and the guest confirms on the day of arrival by one of three routes: a card payment with strong customer authentication, the electronic ID function of an ID card or residence title, or reading that card's electronic ID on site.
§ 30 BMG sets the content. The form holds "ausschließlich folgende Daten", meaning only these:
| § 30(2) field | Source at check-in |
|---|---|
| 1. Datum der Ankunft und der voraussichtlichen Abreise | Guest or booking |
| 2. Familiennamen | Document |
| 3. Vornamen | Document |
| 4. Geburtsdatum | Document |
| 5. Staatsangehörigkeiten | Document; the field is plural, so ask for any other nationality |
| 6. Anschrift | Guest |
| 7. Zahl der ausländischen Mitreisenden und ihre Staatsangehörigkeit | Guest |
| 8. Seriennummer des anerkannten und gültigen Passes oder Passersatzpapiers | Document |
The operator must also compare the form with the identity document and note any difference, or a missing or invalid document (§ 30(2)). The states may add fields for tourist and spa taxes (§ 30(3)).
Retention is in § 30(4): keep the forms "vom Tag der Abreise der beherbergten Person an ein Jahr", then destroy them "innerhalb von drei Monaten nach Ablauf der Aufbewahrungsfrist". The same periods apply to electronic data, which the operator must hand to the authorities in machine-readable form on request. Unlike Spain and Italy, the BMG sets no routine sending deadline: the forms are kept on site and shown when asked for. Electronic processing has to meet Art. 24, 25 and 32 of Reg. (EU) 2016/679, the GDPR (§ 30(5)).
Italy: art. 109 TULPS and Alloggiati Web
Italy's duty comes from art. 109 of the TULPS, the consolidated public-security law, and the decrees of 7 January 2013 and 16 September 2021. The official text of the article on Normattiva loads by script, so the quotes here come from the State Police portal that receives the data, Alloggiati Web. Its home page says:
"I gestori di esercizi alberghieri e di tutte le altre strutture ricettive, ENTRO LE 24 ORE successive all'arrivo, devono comunicare alle questure territorialmente competenti, ESCLUSIVAMENTE per il tramite del Servizio Alloggiati, le generalità delle persone alloggiate. Se il soggiorno è inferiore alle 24 ore le generalità vanno inviate all'arrivo stesso."
In short: within 24 hours of arrival, only through Alloggiati Web, send the guests' personal details to the local police headquarters; for a stay under 24 hours, send them on arrival.
The portal's FAQ adds three points:
| Point | What the FAQ says |
|---|---|
| Identity | Art. 109 says "si può dare alloggio esclusivamente a persone munite di un documento idoneo ad attestarne l'identità", communicated through Alloggiati Web as set by the 2013 decree, as amended in 2021 |
| Short lets | The art. 109 duties extend to rentals of under 30 days (art. 19-bis of Decree-Law 113/2018) |
| Receipts | "Le ricevute vanno conservate per cinque anni in formato digitale." |
Note that the five years are for the portal's receipts, the proof that you sent the data. The FAQ says nothing about keeping the guest data itself.
The exact field list is in the technical annex of the 2013 decree. The portal publishes it only as PDF files, which could not be read verbatim for this post, so the field-by-field split is left out. Before you build the Italian form, take the list from the portal's own manuals and code tables (the "Manuali" and "Scarica tabelle" pages). What the quoted text confirms is that the guest's "generalità" are sent and that every guest needs an identity document.
The three countries side by side
| Spain | Italy | Germany | |
|---|---|---|---|
| Source | Real Decreto 933/2021 | Art. 109 TULPS, DM 7/01/2013 as amended by DM 16/09/2021 | BMG §§ 29, 30 |
| Who registers | Every guest; forms signed by everyone over 14 | Every guest, with an identity document | Foreign guests; companions as a number |
| Name, date of birth, nationality | Yes | "Generalità" (exact list in the 2013 annex) | Yes |
| Sex | Yes | In the 2013 annex | No |
| Document number | Number and, for Spanish cards, the support number | In the 2013 annex | Passport serial number |
| Address | Full address of usual residence | In the 2013 annex | Yes |
| Phone and email | Yes | In the 2013 annex | No |
| Payment data | Yes | No mention in the quoted text | No |
| Deadline | 24 hours | 24 hours; on arrival for stays under 24 hours | None for sending; form signed on arrival day |
| Channel | Telematic | Alloggiati Web only | Kept on site, shown on request |
| Retention | 3 years from end of service | Receipts 5 years | 1 year from departure, destroyed within 3 months |
This is a reading of the quoted texts, not legal advice. Local tax rules can add fields on top, as § 30(3) BMG allows in Germany.
What a check-in form can prefill from the document
The overlap is clear in the tables. In all three countries, the fields that come off the document are the same core: given names, surname, date of birth, nationality, document number and document type. Spain also wants sex. The rest, such as address, phone, email, dates of stay, companions and payment, is for the guest or your booking system.
That gives a simple form design:
- Prefill the document fields from a photo of the data page. The guest checks them instead of typing them. Because the values are read from the document, this supports the accuracy duty of art. 4.3 of the Spanish decree and the comparison duty of § 30(2) BMG; staff still look at the document.
- Use the MRZ check digits. A passport's machine-readable zone carries check digits over the document number, date of birth and expiry. A misread or mistyped digit fails the check, so the form can flag it before the record is sent. The MRZ checker shows how each digit is computed.
- Show the surname split for Spanish guests. One surname field on the passport, two on the form.
- Ask only for what the country needs. A German form holds "ausschließlich" the § 30(2) fields, so do not carry over Spain's phone and email fields.
- Keep the deadlines in the workflow. Spain and Italy count 24 hours; Germany counts the day of arrival.
How doc.cheap fits in
doc.cheap reads one image per call with POST /v1/scans and returns the document fields as JSON: holder.given_names, holder.surname, holder.birth_date, holder.sex and holder.nationality, and document.kind, document.number, document.expiry_date and document.issuing_state. The mrz.status field says whether the check digits passed or failed, and mrz.reason names what failed. The guide Recognize a passport walks through the call.
A sketch of the mapping into a check-in form, with the sandbox key from the docs:
const response = await fetch("https://api.doc.cheap/v1/scans", {
method: "POST",
headers: {
Authorization: "Bearer sk_sandbox_public",
"Content-Type": "application/json",
},
body: JSON.stringify({ image: base64Photo, reference: bookingId }),
});
const scan = await response.json();
const prefill = {
firstName: scan.holder?.given_names,
surname: scan.holder?.surname,
sex: scan.holder?.sex,
birthDate: scan.holder?.birth_date,
nationality: scan.holder?.nationality,
documentType: scan.document?.kind,
documentNumber: scan.document?.number,
documentExpiry: scan.document?.expiry_date,
issuingState: scan.document?.issuing_state,
mrzOk: scan.mrz?.status === "passed",
};
// Address, phone, email, dates of stay and companions stay with the guest.
The API fills form fields. It does not send anything to the police, the Spanish authorities or Alloggiati Web: sending stays with your property system. The document image itself is never stored, and setting retain_hours: 0 in the scan options keeps no stored result at all.
You can try it with no account using the public sandbox key. doc.cheap includes 100 free recognitions every month, and the passport OCR API comparison lists other hosted services with their published prices.
Every legal statement above is quoted from the linked BOE, gesetze-im-internet.de and Alloggiati Web pages; every statement about doc.cheap was checked against its code.
A question for you: does your check-in flow serve more than one of these countries, and how do you handle the fields that differ? Tell us in the comments below.