Can a hotel keep a guest blacklist? KVKK and shared lists

A hotel may keep its own internal note about a guest, but not a list shared with other hotels. The Personal Data Protection Board's principle decision 2021/1304 (23 December 2021), about car rental, allowed an in-house list only after a balancing test and rejected sharing through common software. No hotel-specific ruling exists: treat this as reasoning, not a rule.

A guest damages a room and leaves without paying. The front office manager writes a note in the profile, and by the evening the name is in a WhatsApp group of hoteliers in the same town. Both steps feel like common sense. Only one of them has any support in Turkish data protection law. After reading this you will know which one, what may sit in a guest profile, how long it may stay there, and what to do instead of the shared list.

What does the Board's 2021/1304 decision actually say?#

It is about car rental, not hotels, and it is the closest official text on blacklists in Türkiye. The Board allowed a firm's own internal list in principle, and rejected sharing entries between firms through common software.

The case: software sold to car rental firms included a blacklist feature. Firms entered customer data with their own comments on problems during the rental, such as damage or payment trouble, and the system opened those entries to other firms using the same software. Customers did not know (Kişisel Verileri Koruma Kurulu principle decision 2021/1304 (opens in a new tab), 23 December 2021, published in the Resmî Gazete of 20 January 2022, No. 31725).

On the internal list: a blacklist-type record kept only within the firm's own operations may be possible on the legitimate-interest condition in Article 5(2)(f) of Law No. 6698, but only if a balance test between the firm's legitimate interest and the person's fundamental rights and freedoms comes out in the firm's favour, and subject to a separate assessment of each case. On sharing: opening the record to other controllers cannot meet the requirement that the person's fundamental rights and freedoms are not harmed.

The Board also read the general principles. Sharing a customer's data through software with an unknown number of other firms breaches Article 4 of Law No. 6698, namely lawfulness and fairness, specified and legitimate purposes, and being relevant, limited and proportionate. On roles, the rental firms that use the blacklist records for their own interests and the software companies are joint controllers.

Two further points matter for hotels. First, such lists obstruct the rights in Article 11, including the right to object to an adverse result produced by automated analysis, because people cannot know which firms received their data and so cannot pursue those firms. Second, the decision required the technical and administrative measures under Article 12 of Law No. 6698, and warned that controllers running such blacklists in breach of the Law face action under Article 18.

Does a decision about car rental apply to hotels?#

Not directly. No Board decision on hotel blacklists was found, so this is reasoning you can borrow, not a rule that binds your front desk.

A principle decision states how the Board reads the Law on a set of facts. The facts are car rental; the reading of Articles 4, 5, 8, 11 and 12 travels to any sector that keeps the same kind of record. What carries over is the distinction between a record kept for your own operations and a record opened to other controllers, the balance test, and the joint-controller analysis when a software vendor enables the sharing.

What differs is the interest itself. A hotel's interest is usually room damage, an unpaid bill, or conduct that affects other guests; a rental firm's is vehicle damage and payment. How much each interest weighs is a question of fact, not a category. The balance test is not a form you complete once. It is per case: what you recorded, why, how long you keep it, who can see it, and what the guest was told.

Article 4 of Law No. 6698 sets the frame: personal data must be processed lawfully and fairly, accurately and where necessary kept up to date, for specified, explicit and legitimate purposes, in a way that is relevant, limited and proportionate, and kept only as long as the relevant legislation provides or the purpose requires (Law No. 6698, Articles 4 and 5 (opens in a new tab), Mevzuat Bilgi Sistemi, 2 November 2026). Where you rely on legitimate interest under Article 5(2)(f), the condition is the same one the Board applied: the processing must not harm the person's fundamental rights and freedoms.

Write in your internal policy that this is an analogy, and have a lawyer confirm your own case before the practice becomes routine.

What may a hotel record in its own guest profile?#

Record what happened on a specific stay, in neutral words, tied to a booking, with a review date, and let only the people who need it see it.

State the purpose before the note. "To recover an unpaid balance on booking 4471" is a purpose; "difficult guest" is a label with no purpose behind it. Write facts, not conclusions: date, booking reference, room, what was damaged or left unpaid, the amount, what was agreed, who handled it. Leave out adjectives about the person.

A criminal allegation is not a fact you hold. Record that a report was made and by whom, not a conclusion about what the guest did. Wording matters because the guest may read it: Article 11 of Law No. 6698 gives a person the right to learn whether their data is processed and to ask about it. A note written so that the guest could read it is written better. Give the front office a short procedure for that conversation: who answers, what they may confirm, and when the request goes to your data protection lead or legal adviser.

Set retention to the purpose, for example until the balance is settled or the claim is time-barred, then delete. Article 4 requires keeping data only as long as the purpose requires, and Article 4 also requires accuracy. Restrict the field to the front office manager and above, log who opens it, and keep it out of marketing segments, offer lists and the guest app. Do not fold the note into a general guest history that sales uses for offers: that quietly changes the purpose and breaks the balance you relied on. Confirm the periods and the access rules for your own case with a legal adviser.

Hotel groups: is one list across the properties allowed?#

Only if you can say who the controller is. Several legal entities in one group are separate controllers, and passing a note between them is a disclosure, not an internal note.

One company running several hotels is one controller, and can keep one internal record, provided the purpose and the access rules are identical across properties and guests are informed. Several companies under one brand are different: each is its own controller. Moving a guest note between them needs its own basis, and the basis must actually fit: a notice plus, where required, consent, or a contract or legal-obligation ground that genuinely covers the case.

If a central system lets properties see each other's notes, that approaches joint controllership: put the arrangement in writing and decide who answers a guest request. A group-wide flag such as "do not accommodate at any of our hotels" is the hardest case, because the guest's interest in access to accommodation weighs heavily against a general brand interest. The note must be specific enough to be answered.

Keep the flag narrow in time and scope: which properties, until when, and on what recorded facts. Tell the guest in plain words when the flag is set, and give a route to object; a silent flag is the fact pattern the Board criticised. Map the entities with a lawyer before switching the feature on, not after a complaint arrives.

Why can't hotels share a blacklist between them?#

Because that is the practice the Board rejected: names passed to an unknown number of other businesses, with no notice and no way for the guest to correct them.

A WhatsApp group, a shared spreadsheet and a blacklist module in common software are the same mechanism: data opened to other controllers, in each case without the guest knowing. Every hotel in that group is a separate controller. The guest cannot learn who holds the data, which is exactly the Article 11 problem the Board named. No Article 5 condition fits comfortably: it is not a legal obligation, it is not performance of a contract with a hotel the guest never booked, and legitimate interest fails the balance test once the data leaves your own operations.

Group admins and software vendors become joint controllers with the hotels that use the list, as the rental firms and their software providers did in the decision. The practical exposure is real: an inaccurate entry can cost a guest a booking, and the guest has a route to complain; you also carry the risk of repeating an allegation you cannot prove. The same analysis covers "do not rent" lists traded by email and shared lists inside a destination or association platform.

What are safer alternatives to a blacklist?#

Move the risk into money and written terms, which you can enforce without holding a judgment about a person.

A deposit or a card pre-authorization at check-in, sized to the room and the length of stay and released on departure, covers damage and minibar risk without any record about the guest. A payment guarantee for corporate and agency bookings, plus a written cancellation and no-show policy the guest accepts at the time of booking, handles the unpaid-bill case. House rules with stated consequences, shown before booking and again at check-in, give staff something to point to that is not a personal note. Write them as short, specific sentences, and show them where the guest actually looks: the booking page, the confirmation email and the check-in screen.

For groups and events, a signed contract covering damage and conduct, held by the organizer, is stronger than a name on a list. Where the risk is behavioral and recent, brief the front office manager verbally instead of writing a permanent entry. Keep an incident record tied to the booking, inside the retention period you set, and use it only for that booking's claim. Insurance and a documented damage procedure make the outcome a process rather than a decision about a person.

What to do next#

Write your guest-note rule this week: one sentence of purpose, the fields allowed, who may see them, how long they stay, and how you tell the guest. Then list every shared list your team belongs to and leave the ones that pass names to other hotels. The car rental decision is reasoning, not a hotel rule, so confirm your own case with a lawyer before the practice hardens.