How long should a hotel keep guest records? Building a retention and destruction table

A retention and destruction policy is the hotel's written rule for how long each record is kept and how it is destroyed. Turkish law sets some periods: books and documents five years, lodging forms one year, lodging registers five years, social security records ten years. Everything else the hotel sets, destroying on a cycle no longer than six months.

The front office still holds the paper lodging form for a guest who left last week, and accounting still holds the invoice for the same stay. Both are records about the same person, both are lawful to keep, and the law gives them different lives. The hotel has to be able to show why. After reading this you will be able to list your record types, attach the correct legal period to each one, set the rest yourself with a written reason, and run the destruction routine that proves both duties were followed.

Why do hotels keep too much or delete too much?#

Because two duties pull in opposite directions: keep certain records because another law requires them, and stop holding personal data once the purpose is served. A hotel that picks only one of the two is wrong in one direction.

Keeping everything forever is a decision, and it needs a legal reason. "It might be useful one day" is not one, and a storage room full of old forms is a liability that grows quietly. Deleting everything at checkout breaches duties that have nothing to do with privacy: tax, identity notification and social security each require a record to exist for a set period.

The unit of decision is the record type, not the hotel and not the guest. One guest generates a folio, an invoice, a lodging form, a camera image and possibly a marketing permission, and each has its own life. A record at the end of its life can be deleted, destroyed or anonymized, and the choice matters: anonymized data can still be used for statistics, deleted data cannot.

The practical test for each record type is simple. Name the text that requires it, or the purpose that justifies it. If you can name neither, the record has no reason to exist. Write the answer down: a retention decision that lives only in the manager's head cannot be repeated by the next manager and cannot be shown to anyone. This test is the foundation of any hotel data retention schedule.

The wider privacy duties behind this test are covered in KVKK for hotels: notices, consent, staff access and retention.

Which records does a hotel actually hold?#

More than the property management system shows. A period can only attach to a record you have named, so the inventory comes before the table.

Group records by where they live: the hotel system, the accounting system, paper at the front desk, the camera recorder, the HR folder, the marketing tool. Then look for copies outside the system: spreadsheets, notebooks, a folder on the night manager's desktop, messages on a staff phone. A copy is a record too.

Include records held on your behalf. Your software provider, your accountant, your payroll bureau and your marketing agency all hold hotel data. And include the records nobody thinks of: lost-and-found logs, key-card issue logs, incident reports, guest request notes, lists of guests who asked not to be disturbed.

For each type, note what it contains, who sets the period, and where every copy sits. The last column is where most hotels discover a second copy they had forgotten.

What periods does Turkish law actually set?#

The texts cited here set periods for books and documents, for lodging forms and registers, and for social security records. Each period counts from its own starting point, and the starting point is where hotels misread them.

Tax Procedure Law No. 213, Article 253 requires those who must keep books to retain their books and documents for five years, counted from the start of the calendar year after the year they relate to, according to the consolidated law text on the Mevzuat Bilgi Sistemi (opens in a new tab). For example, a document from 2026 runs to the end of 2031. Article 240 of the same law requires lodging places to prepare daily customer lists with consecutive serial and sequence numbers, following the room and bed plan, showing each guest's name and surname with the room number and room rate. That daily list is a document, so the five-year rule reaches it.

The Identity Notification Regulation sets its own periods in Article 24. The lodging form (Form 8) is kept one year and the lodging register (Form 7) five years, both counted from the calendar year after the year the form was issued or the register filled, at the facility and under the responsible operator's responsibility, per the consolidated regulation text (opens in a new tab). The same article covers handovers: if the responsible operator changes within those periods, the forms and registers pass to the new operator; if the facility closes for good, they go at once to the nearest competent law-enforcement unit, which keeps them for the rest of the period.

Article 22 covers a narrower case: when a staff member or another person sheltering at the facility, notified on paper, leaves, the facility keeps its copy of the form together with the signed tear-off part for three years. Additional Article 1 says records notified electronically are kept in the law-enforcement system for five years and then deleted automatically. That is the authority's system, not a file the hotel holds, and it does not remove the hotel's own duties. Law No. 1774 itself sets no retention period for lodging records; its three-year period covers the location records of rented vehicles. Additional Article 3 of the regulation also reserves the retention duties under the Tax Procedure Law and the Turkish Commercial Code, so a privacy-based deletion never overrides a tax duty.

On the employment side, Law No. 5510, Article 86 requires employers and workplace owners to keep workplace books, records and documents for ten years from the start of the year after the year they relate to, and to produce them within fifteen days when Social Security Institution officials ask; public administrations keep theirs for thirty years, per the consolidated law texts (opens in a new tab). Labour Law No. 4857, Article 75 requires a personnel file for every worker but sets no retention period, so the period comes from another text or from the hotel's own policy.

Which periods does the hotel set itself?#

For every record no text covers, the hotel sets the period, and it must be able to explain the reason in one sentence. A period without a reason is a guess, and a guess is what an inspection tests.

Camera footage is the clearest case: no text cited here sets a period, so the hotel decides. Tie it to the purpose, for example how long an incident usually takes to surface, and to what the recorder can actually hold. The decision belongs in the policy, not in a conversation with the security contractor. The placement and notice duties that come with cameras are covered in CCTV in hotels under KVKK: a checklist for notices, placement and footage.

Marketing permissions need a split treatment. On withdrawal, stop using the contact for marketing, but keep the proof that permission once existed and the record of the withdrawal itself. Without that record you cannot show the earlier messages were lawful. Guest preference notes should each be tied to a purpose, such as service during the stay or recognizing a repeat guest; a note with no purpose is the easiest thing in the hotel to defend deleting.

Unsuccessful job applicants' CVs and enquiries that never became bookings are often overlooked, and are among the easiest to give a short, written period. Records created for a single event, such as a wedding list or a group rooming list, end with the event plus whatever the accounting duty requires, not with the hotel's general habit. Whatever period you choose, write the reason next to it in the table. The reason is what makes the period a decision rather than a preference.

Who has to write a retention and destruction policy, and what must it contain?#

Controllers that must register in VERBİS must prepare one, in line with their personal data processing inventory. Article 6 of the Deletion, Destruction or Anonymization Regulation (opens in a new tab) lists what it has to contain at a minimum.

Article 5 attaches the duty to controllers that must register with the Data Controllers' Registry (VERBİS) under Article 16 of Law No. 6698. Having a policy does not by itself mean data is kept and destroyed lawfully; the practice is what counts. Controllers that do not have to prepare a policy still carry their duties to keep, delete, destroy or anonymize personal data. The policy is a document, not the obligation itself.

Whether a given hotel must register depends on the Board's exemption criteria, which have been amended more than once. Board decision 2018/87 (19.07.2018) has been amended twice; decision 2023/1154 (06.07.2023) raised the balance-sheet limit to 100 million TL; decision 2025/1572 (04.09.2025) added a second group of exempt controllers; decision 2025/2393 (25.12.2025) set how the criteria are assessed together. As amended, the exemption covers controllers whose main activity is not processing special categories of data, with fewer than 50 employees a year and a balance sheet below 100 million TL, and a second group whose main activity is processing special categories of data, with fewer than 10 employees and a balance sheet below 10 million TL. The registration question is covered in VERBİS for hotels: when a hotel has to register.

The policy is built from the processing inventory, so the inventory comes first. A policy written without it describes a hotel that does not exist. The people named in the policy are as important as the periods: Article 6 asks for the titles, units and job descriptions of everyone involved in retention and destruction.

How does periodic destruction actually run?#

At the interval the policy sets, and that interval may never exceed six months. A controller with no policy duty acts within three months after the duty arises.

Article 11 says a controller with a policy deletes, destroys or anonymizes data at the first periodic destruction after the duty arises. The policy sets the interval; six months is the ceiling, not a target. Article 7 requires every deletion, destruction and anonymization operation to be recorded, and the records to be kept for at least three years. The record is what turns a routine into something you can prove.

Choose the method per record type: deletion in the system, physical destruction for paper, anonymization where the data still has analytic value. The regulation treats these as three different operations. A deletion that leaves the record in a backup is not finished: decide how backups are handled in the same cycle, and test that the restore path does not quietly bring the record back. The backup side of this is covered in Backups for hotel systems: what to copy, where to keep it and how to test it.

Give the routine a named owner and a second person who signs. The policy already names titles and units, so the routine should match those names. Keep the destruction record next to the policy, not in a folder only one person can find. It is the first thing anyone will ask for.

What does the table look like on one page?#

One row per record type, five columns, a named owner per row, and a reason in every row that the law does not already supply.

The table is the part of the policy a front office manager will actually use, so keep it to one page and keep the language plain. Sort rows by where the record lives, not alphabetically: people look for the record they are holding. Every row needs a counted-from column, because five years counted from the event and five years counted from the start of the following year are different dates. Every row needs an end action: delete, destroy, anonymize, or hand over. The handover rows are the ones hotels forget.

Review the table when a system changes. A new tool creates a new record type, and a record type with no row is a record type with no period.

What to do next#

Take one record type from the inventory this week, write its row with the text or the purpose beside it, and repeat until the page is full. The two duties fit together once they are written down: the law supplies the periods it cares about, the hotel supplies the rest with a reason, and the destruction cycle proves both were followed. For the software side, KVKK consent, data export and retention periods are built into the data model of the AI Otel hotel operating system, which is built and working ahead of launch; the policy and the destruction routine stay the hotel's own work. If you want to discuss how this fits your systems, request a briefing.