"Is my husband staying with you?" Who may be told about a guest

A hotel may not confirm whether someone is staying with it unless the guest has consented or another condition in Law 6698 Article 5(2) applies. Personal data means any information tied to an identifiable person: the fact of the stay, the dates, the room, the companions and the bill. Hotel guest privacy disclosure is decided by conditions, not by sympathy.

It is 21:40 and the phone rings. A woman says her husband is not answering his phone and she knows he is in the city. His name is already on the receptionist's screen, with a room number next to it. What the receptionist says in the next ten seconds is either a lawful refusal or a disclosure, and it will still be on the record a year from now. This article gives you the rule, a caller-by-caller table, the procedure for official requests, and a script in Turkish and English to keep beside the phone.

Is the fact that someone is staying at your hotel personal data?#

Yes. The stay itself, the dates, the room, the names on the bill and the people sharing the room are all personal data, because each one is tied to a person who can be identified.

Personal data is any information relating to an identified or identifiable person. A guest's name plus a date is enough to identify; so is a room number plus a night. The hotel is the data controller (veri sorumlusu) for that data. A receptionist who answers a question is acting for the hotel, so "the system showed it, I did not volunteer it" is not a defence.

Under Law No. 6698, Article 8(1) (opens in a new tab), personal data may not be transferred without the data subject's explicit consent. Article 8(2) allows transfer without consent where an Article 5(2) condition exists, or, with adequate measures, an Article 6(3) condition; transfer rules in other laws are reserved (Article 8(3)). The Article 5(2) conditions, in plain words, are: the law expressly provides for it; it is necessary to protect someone's life or bodily integrity; it is directly related to performing a contract with the data subject; the hotel has a legal obligation; the data subject made the data public; it is necessary to establish, use or protect a right; or the hotel has a legitimate interest that does not harm the person's rights.

"Legitimate interest" is the condition staff reach for and the one that rarely works here. The hotel's interest in answering a caller does not outweigh the guest's interest in not being located. Consent, where it is relied on, has to be about this disclosure, informed and specific. A signature collected at check-in for the identity notification or for marketing is not consent to tell a caller anything.

A neutral refusal is not rudeness. It is the default position, and it is the one the hotel can defend a year later. For the wider consent and retention picture, see KVKK for hotels: notices, consent, staff access and retention.

Can you tell a spouse, a parent or a colleague that the guest is here?#

No. A family relationship, a shared surname or a shared employer is not one of the conditions in Article 5(2), so the desk cannot confirm the stay to any of them.

A marriage certificate does not make one spouse the other's representative in data protection terms. Two adults are two data subjects. The risk is concrete: confirming a stay to a person the guest is avoiding can end in harm, and the hotel is the party that disclosed.

Use the neutral form: "I can't confirm whether anyone is staying here. I can take a message and pass it on." Never say "there is no one by that name", which is also a disclosure, and which is simply wrong when the name was spelled differently. The surprise cuts both ways: if a partner calls to check a booking they made themselves, you may confirm the booking they made; you may not confirm that the guest is in the building.

A parent asking about an adult child is a third party. A parent asking about a minor in their custody is a different question, and it belongs with your legal adviser and the terms of the reservation, not with a decision taken at the desk at midnight. An assistant or colleague who made the booking holds the booking, not the stay; confirm only the details that caller themselves supplied. If the guest has told you in writing that a named person may be told, follow that instruction to the letter, keep the instruction on file, and note it on the reservation so the next shift does not undo it.

A caller asks for a room number: do you put the call through?#

No. A room number locates a person inside a building, so it is personal data, and the call is put through only when the guest has said so.

Take the caller's name, number and stated relationship, and say you will pass a message. Do not promise that the guest will call back. Reach the guest through the hotel's own channel: the room phone, the guest app, or a word at the desk when they pass. Let the guest decide whether to make contact.

Never read out a room number to anyone who is not the guest, including a caller who says they are family, and including a caller who already knows the number and only wants it confirmed. Messages, envelopes and parcels follow the same logic: accepting them is fine, handing them to someone who is not the guest is a disclosure. Hold them at the desk and record who left what.

Visitors in the lobby are ordinary business. Whether a visitor goes up is a policy the hotel sets in advance, in writing, and applies to everyone; see Visitors in hotel rooms: setting the policy and registering the guest who stays the night. If the guest says "tell them I am not here", that is an instruction from the data subject. Follow it, and write it on the reservation so the next shift does the same. Wake-up calls, taxi bookings, deliveries and restaurant reservations follow the same rule: the guest's own arrangement, confirmed to the guest.

Who pays for the room, and what does that entitle them to see?#

The payer sees what the contract requires and no more: the booking, not the guest's stay. Minibar, restaurant, spa and phone charges belong to the guest.

The contract condition in Article 5(2) covers data of the parties that is necessary to set up or perform that contract. For a corporate booking that means the name, dates, room type and agreed rate the company booked. It does not cover what the guest consumed during the stay. Those charges are the guest's own spending and the guest's own data.

Scope the corporate portal and the monthly report to the booking. If the company genuinely needs the folio, that needs the guest's consent or a clear contract term, and your legal adviser should see the wording before it is used. A tour leader needs the list of people on the coach and the rooming list they themselves supplied; they do not need passport numbers, dates of birth or bills. An agency holds the booking it made; it does not acquire the guest's stay data by having made it. The rule of thumb for any third party: share what they supplied or need in order to perform the contract, and nothing the guest generated after arrival.

A lawyer, a debt collector or an investigator calls: is that an order?#

No. A lawyer's letter is a request from a third party, unless the lawyer represents the guest and can show it, in which case it is the guest's own request and follows the guest-request procedure.

Ask for the power of attorney (vekaletname) and check that it covers this: representing the guest in a matter is not the same as being authorised to obtain their hotel records. A lawyer acting for the other side in a dispute is a third party like any other. The answer is the neutral one, plus an invitation to put the request in writing so it can go to your legal adviser.

Debt collectors and tracing agents have no basis for obtaining stay data. Do not confirm, do not deny, do not negotiate, and do not accept a payment against information. Private investigators get the same answer: obtaining personal data by deception is itself a data protection problem, and a stranger at the desk claiming to be a guest is a security matter before it is a privacy one. Journalists have no basis either; a public figure's stay is still personal data, and "everyone will find out anyway" is not a condition in Article 5(2).

Log the refusals as carefully as the disclosures. A pattern of requests about one guest is exactly what you need if that guest later complains, or if someone turns up in person. For the guest's own requests under the Law, see Guest data requests under KVKK: a front office procedure.

What do you do when the police, the gendarmerie or a prosecutor asks for records?#

You cooperate with a lawful written request, and you verify and record it. A phone call claiming authority is not a written request.

Under the Criminal Procedure Code, Law No. 5271 (opens in a new tab), the public prosecutor may conduct any inquiry directly or through the judicial police under its command and may request information from public officials; the judicial police carry out the prosecutor's orders without delay (Article 161). Information requested in writing by a prosecutor, judge or court during an investigation or prosecution must be answered within ten days. If that is impossible, the reason and the latest date for a reply must be stated within the same period, and the request itself states that failing to comply may amount to a breach of Article 257 of the Turkish Penal Code (Article 332).

So the desk procedure is: written request, identity and unit checked, file number noted, exactly what is named handed over and nothing beyond it, and a record of what left the building. On a phone call, ask the officer to send the request in writing or come to the desk with it. If you need to call back, use a number you looked up yourself, never one the caller gives you.

Law No. 6698 Article 28 narrows the picture. The Law does not apply to processing by public bodies authorised by law within preventive, protective and intelligence activities for national defence, national security, public security, public order or economic security (28(1)(ç)), nor to processing by judicial authorities or enforcement offices in investigation, prosecution, trial or enforcement (28(1)(d)). The information duty and most data subject rights also do not apply where processing is necessary to prevent crime or for a criminal investigation, provided it is proportionate (28(2)(a)).

Read that precisely: it describes the authorities' own processing. It is not a licence for the hotel to hand guest data to anyone who claims to be acting for them. The hotel still needs a legal basis, and it still records. The identity notification sent at check-in is a separate, standing flow that runs whether or not anyone asks (KBS, misafir kimlik bildirimi); see KBS explained: guest identity notification for hotels in Türkiye. Answering a request is a different act with a different record. Tell your legal adviser and your data protection lead the same day. If the document looks irregular, ask counsel before handing anything over, but do not obstruct a lawful written request.

What should the desk say, and what should it write down?#

Three sentences cover most calls, and one page covers the record: who called, what they asked, what was said, and who handled it.

The three moves: acknowledge the caller, decline to confirm, offer to pass a message. Nothing else is needed, and nothing else is safe. Write the script in both languages the desk actually uses and keep it next to the phone, not in a folder on the shared drive. Never improvise a reason. "I can't confirm" is a complete sentence; "the system is down" and "the manager is not here" invite a second call and a different story.

Log fields: date and time, caller's name and stated relationship, what was asked, what was said, who took the call, whether it was escalated, and the outcome. The log is itself personal data. Restrict who can read it, and keep it under the same retention rule as your other front office records. Review the log once a month with the front office manager: one caller, many times, is a security signal long before it is a privacy one. Train the night shift first. Most of these calls arrive when the manager is at home and the newest member of staff is on the desk.

What to do next#

Write the one-page rule today, put the script beside the phone, and start the request log tonight; then have your legal adviser read the caller table once, so that the answer at the desk is the same at 21:40 as it is at 09:00. The parts fit together as one chain: the stay is personal data, the caller is a third party, the condition decides the answer, and the log proves what you did. Confirm dates, penalties and your own case with a legal adviser or accountant before relying on any of it.