A child protection policy for hotels: what to write, train and report

A hotel child protection policy is a written procedure, not a statement: it sets the scope, the signs staff watch for, conduct rules, a named reporting line, the record and the training. The GSTC Hotel Standard v4.01 (30 December 2025) and Türkiye's TR-I criteria (20 January 2026) both ask for one.

The sustainability file is complete: a page of commitments on children's rights, signed, dated and filed. Then a night-shift receptionist sees an adult and a distressed child in the lobby at two in the morning, and has nothing to open. This article shows what a working policy holds: what staff watch for, how a concern travels inside the hotel and to the authorities, rules for people who work with children, and how to train and keep proof.

Why a page of commitments is not a child protection policy#

A statement says what the hotel believes. A policy tells a person what to do, in what order, and who to call, on the night it matters.

The practical test is simple. Pick any staff member at random and ask who they call at 02:00 if they are worried about a child. If the answer is vague, the document in the sustainability file is decoration.

Three populations reach children on your property, and the policy must cover all three: guests (adults and children), your own and contracted staff, and suppliers who enter the building, such as transfer drivers, tour guides, animation teams and maintenance contractors. A policy that covers only guests misses the animation team. A policy that covers only staff misses the transfer driver.

Do not copy another hotel's text. Copied policies name roles that do not exist in your building, a reporting line nobody recognizes, and a committee that has never met. Staff follow a procedure they have rehearsed, not one they have read. A statement of zero tolerance alone also fails the criteria test, which asks for procedures to identify, monitor, report, disclose confidentially and respond, not for a sentence about values.

Write the policy in the languages your team actually reads, and check comprehension in training rather than assuming it. A procedure understood by the front office and not by housekeeping is half a procedure. Keep it short enough to be read in one sitting: scope, signs, conduct rules, reporting line, record, review. Length is not protection.

What do the sustainable tourism criteria ask on child protection?#

Both texts ask for a documented policy, measures to communicate it, and records of employee ages. GSTC B7 alone adds training, monitoring of implementation and supplier compliance. Neither prescribes a text.

The current international standard is the GSTC Hotel Standard v4.01 with performance indicators, dated 30 December 2025 (opens in a new tab). Its transition guidance sets a transition period ending 30 December 2028, during which version 3.0 certificates remain valid.

Criterion B7, "Exploitation, Harassment, and Human Trafficking", requires a comprehensive zero-tolerance policy against all forms of exploitation, harassment and human trafficking, including forced labour, with enhanced protection for vulnerable groups such as children (minors), adolescents, women, Indigenous peoples, minorities and people with disabilities. The B7 indicators are the checklist most hotels are missing: a written policy with procedures for identifying, monitoring, reporting, confidential disclosure and responding, and for preventing child labour; communication internally and externally to staff, guests and suppliers; monitoring of implementation; guidance and training for staff on recognising and reporting incidents; records showing no child labour or illegal labour; and a requirement that suppliers comply.

Criterion B6, "Code of Conduct", asks for a written code covering staff, suppliers and guests, with zero tolerance and clear safeguards against inappropriate interactions with minors, communicated to all staff with regular training and records. Its guidelines say the hotel verifies the identity of all guests at check-in, including children and the adults with them.

Türkiye's criteria are the TR-I industry criteria of the Türkiye Environmental and Cultural Sustainability Programme, published by the Türkiye Tourism Promotion and Development Agency (TGA) and dated 20 January 2026. Criterion B5, "İstismar ve taciz", asks for a documented policy, measures to disclose, announce and implement it, work with the local community against exploitation and abuse, employee-age records showing no child labour as defined by the ILO, and support for measures against child abuse. Criterion C1 adds special measures to avoid inappropriate interaction with children.

Hotels still certified under the earlier Industry Criteria for Hotels v3 (21 December 2016) meet the matching criterion B5, "Exploitation and harassment", which asks for a policy, communication and implementation, community work, employee-age records and support for action against child sex tourism. The B7 guidelines also cite The Code (Code of Conduct for the Protection of Children from Sexual Exploitation in Travel and Tourism) as a voluntary initiative offering child-protection tools. Voluntary means voluntary: it is a source of templates and training material, not a certificate you must hold. If you are new to certification itself, read about the stages and duties of sustainable tourism certification in Türkiye.

Where the two texts line up#

What the criteria do not ask for#

Neither text prescribes wording, a committee structure or a named external organisation. They ask for a procedure that exists, is communicated, is trained, is monitored and leaves records. That is the bar your document has to clear.

What should a hotel child protection policy contain?#

Six parts: scope, the signs staff are asked to notice, conduct rules, the reporting line, the record, and the review. Each part fits on one page.

Scope: who and where. Guests, staff, contractors and suppliers; all premises including rooms, corridors, pools, beach, spa, kids club, restaurants, transfer vehicles and off-site excursions run in the hotel's name.

Signs. Describe categories of concern in plain, non-graphic language, so a housekeeper knows what to write down. For example: a child left alone in a corridor or lobby late at night; an adult who cannot give a child's date of birth or the name of the child's school; an adult who asks for a room far from other guests while travelling with a child; a child who is consistently silent or fearful in the presence of one particular adult. The list is illustrative, not a diagnosis, and staff are not asked to conclude anything.

Conduct rules. No staff member alone with a child behind a closed door; personal phones never used to photograph guests' children; no private contact with a guest's child outside the property, including social media; no gifts; no unsupervised transport of a child in a staff vehicle.

The reporting line. A named role rather than a name (duty manager, with a deputy), a phone that is answered at night, and the rule that the first person who sees something reports it, not the most senior person available.

Confidential disclosure. Who may know, where the written record is kept, who may read it, and how long it is retained. Access is a list of roles, not a folder everyone can open.

The record. Time, place, what was seen and heard, who was told, what was done. Never opinions, conclusions or guesses about what happened.

Review. Once a year, after any incident, and whenever the criteria version or the reporting line changes.

The conduct rules staff actually remember#

Staff remember rules that are concrete and rehearsed, not rules about values. "Doors open or glazed when with a child" survives a season; "act professionally at all times" does not. Test each rule by asking whether a new seasonal hire could follow it on their first night without asking a question. Where children are registered and collected, such as a kids club, the collection rules belong in the policy too: see registration and collection rules for a hotel kids club.

What does a staff member do with a concern, and who do they call?#

They keep the child safe, report immediately to the named duty manager, and write down only what they saw and heard. The hotel does not investigate; where the law requires notification, the authorities are notified.

The first ten minutes: stay with the child or make sure another staff member is present, do not question the child beyond what is needed to keep them safe, do not confront the adult, and do not promise the child secrecy.

Write it down while it is fresh: time, place, exact words, who else was present. Memory reshapes detail within hours, and the written record is what the hotel will rely on later.

Inside the hotel, the route is duty manager, then general manager. The person who reported is protected from blame, and the policy should say so in writing, because fear of being wrong is the main reason concerns go unreported.

The legal frame in Türkiye is set by the Child Protection Law (No. 5395, Official Gazette 15 July 2005, No. 25876) (opens in a new tab). Article 3 defines a child in need of protection as a person under 18 who is neglected, abused or a victim of crime, or whose physical, mental, moral, social or emotional development or personal safety is in danger. Article 6 lists the judicial and administrative authorities, law-enforcement officers, health and education institutions and civil society organizations that must notify the Social Services and Child Protection Agency, as the Law's text names it. Articles 5 and 7 describe the protective and supportive measures and the child judge who orders them.

The penalty for silence: Turkish criminal law sets a duty to report certain crimes to the competent authorities, and Article 278 of the Turkish Penal Code (No. 5237) is the provision usually cited for it. Whether it applies to a given situation depends on the nature and seriousness of the suspected crime, on whether the law requires reporting for that offense, and on the reporter's relationship to the suspect: people who may refuse to testify are treated differently. The same article provides for a heavier penalty in some cases where the victim is a child under 15, a person with a physical or mental disability, or someone unable to defend herself because of pregnancy, but the exact conditions are for a legal adviser to confirm. Do not treat this paragraph as legal advice: ask your legal adviser what your reporting duty is for the specific scenario in front of you.

Separately, guest identity notification (KBS) is a legal duty of every lodging facility in Türkiye, and the GSTC B6 guideline expects identity to be verified at check-in for children and the adults with them. Identity is checked in person at the desk; the policy should say who does it and what happens when an adult cannot or will not identify a child.

This article states the text, not your case. Confirm the current competent authority, the notification route, the record you must keep and the deadlines that apply to you with a legal adviser, because institutional names and procedures change faster than statutes.

What the written record should never contain#

No opinions about what happened, no guesses about relationships, no diagnosis, and no name shared beyond the roles listed in the policy. The record holds observations: time, place, words heard, actions seen, who was told, what was done. Conclusions belong to the authorities.

What rules apply to the people who work with children?#

Hiring checks, a signed code of conduct, a two-adult rule and a named supervisor for every role that brings an adult into contact with children.

Name the roles first: kids club, animation and mini disco, babysitting, pool and beach lifeguards, spa, guest relations, housekeeping for family floors. Rules written for the front office rarely reach the animation team unless someone maps them. If you plan the team as part of how an animation program and its team are planned, the child protection rules belong in that same plan.

At hiring: identity and age records, references taken and checked, a signed code of conduct on day one, and a written statement that a concern about a colleague goes to the duty manager and never to the colleague.

The two-adult rule: no single adult alone with a group of children, doors open or glazed, and a second adult within sight. It protects children and it protects staff against false accusation, which is why it is written as a rule and not left to judgment.

Drop-off and collection: who may collect a child, how identity is confirmed, what happens when a different adult arrives. The kids club register is the enforcement point, and it belongs in the policy, not only in the kids club folder.

Contracted teams are suppliers: the animation operator, the kids club outsourcer and the transfer company sign the same code, accept the same reporting duty, and are named in the supplier clause the criteria ask for.

Photographs and phones: staff never use personal phones to photograph guests' children, and the hotel's own marketing photography of children needs parental consent recorded. Discretion: staff do not discuss a concern with colleagues outside the reporting line, and the policy says what to do if the person they are worried about is a manager.

What about under-18 workers and interns?#

The Child Protection Law's Article 3 protects a person under 18 where they are neglected, abused, a victim of crime, or their development or safety is in danger. Confirm the definition with a legal adviser, then treat your young workers with the same seriousness as your guests' children, and keep the age records the criteria ask for.

Article 3 of Law No. 5395 treats a person under 18 as a child in need of protection where they are neglected, abused, a victim of crime, or their development or safety is in danger; the Law draws no line at the hotel door. Anyone on your payroll or internship list below that age is inside the policy's scope. Confirm the exact definition with a legal adviser.

The criteria ask for evidence, not intention: GSTC B7 requires records showing no child labour or illegal labour, and TR-I B5 asks for employee-age records showing no child labour as defined by the ILO. A date of birth on file for every employee and intern is what an auditor will ask to see.

The practical rule: an under-18 worker is never alone with guest children, is paired with an adult, and is not given responsibility for a kids club group, a pool shift or a collection point. The policy should also say what an under-18 worker does if they are worried about an adult colleague, because the usual route, speak to your supervisor, may be the route that is blocked.

Working hours, permits, school-term arrangements and vocational school agreements for minors are outside this article. Confirm them with an HR adviser against the legislation in force, and keep the confirmation with the policy. Seasonal intake is where this goes wrong: the hire is urgent, the paperwork is thin, and the age record is the first thing missing. See contracts and social security entry for seasonal hotel staff for the wider hiring picture.

How do you train once a season and keep proof?#

One session before the season opens, a short refresher mid-season, a five-minute briefing for every new starter in their first week, and a signed record for each person.

Content: the signs, the reporting line with the night number, what to write and what never to write, the two-adult rule, the supplier rule, and the fact that reporting in good faith is protected.

Format: 60 to 90 minutes, in the languages staff read, built around two or three scenarios walked through out loud. For example: a guest asks a housekeeper where the parents of the child in room 214 are. What does she say, who does she call, what does she write?

Who attends: every department including night shift and the back of house, contracted animation and kids club teams, and managers first, because a manager who has not been trained cannot credibly enforce a rule.

Proof: an attendance record with name, date, role, trainer and a short comprehension check, kept with the policy and produced on request. The criteria ask for training and records, not for a slide deck.

Refresh triggers: any incident, any change to the reporting line or the duty phone, and any change in the criteria version. The GSTC transition period for version 4.0 runs to 30 December 2028, so a hotel certified under version 3.0 has a date to work towards.

Monitoring: the criteria ask how the policy is implemented, so check quarterly that the duty phone is answered, that the record form is being used, and that new starters were briefed in their first week. A policy with no checks is a document nobody has tested. Families also notice these things: what parents check before and during a stay overlaps with what families check before and during a hotel stay.

What the training record should hold#

What to do next#

Take the two criteria texts, GSTC criterion B7 and B6 and TR-I criterion B5, and write your own six-part procedure against them this week, then test it with one night-shift scenario before the season opens. The parts fit together in one order: the criteria set the requirements, the policy turns them into a procedure, the training makes the procedure real, and the record proves it happened.