Sending rooming lists and guest lists by e-mail or Excel: a safe-sharing checklist

A rooming list is the room-by-room list of names a group booking is built from. Sharing rooming list guest data safely means sending only the columns the receiver needs, naming the file without personal data, protecting it and sending the password by a separate channel, checking the recipient, and agreeing a deletion date.

A group of forty rooms leaves the hotel as one Excel attachment: names, passport numbers, mobile numbers, room assignments. From that moment nobody in the building can say exactly how many copies of it exist, or where. After reading this you will be able to decide which columns leave the hotel, protect and send the file so the protection is real, check the recipient before pressing send, agree a deletion date, and know the first hour after a list reaches the wrong inbox.

What does a rooming list contain, and who actually needs which column?#

A rooming list is the room-by-room list of names a group booking is built from: who sleeps in which room, when they arrive and leave, and whatever the receiving party must act on. Most hotels build one file and send it to everyone, which is where the risk starts.

The list is born at the block stage, when a group or agency contract fixes rooms, dates and names. The block, the list and the master folio are one chain of work, not three separate documents; if you want that chain explained end to end, read group bookings: block, rooming list and master folio. Typical columns include guest name, room number or type, single or double sharing, arrival and departure dates, flight number and time, mobile number, e-mail, passport or identity number, nationality, date of birth, special requests, payment instructions and transfer pickup time.

Each receiver acts on a different subset. Housekeeping needs name and room. The transfer company needs name, flight, arrival time and pickup. The restaurant needs name, room and a dietary note. The agency that owns the booking needs the contracted set and nothing more.

In Türkiye, every stay involves a payment, a fiscal document, a guest identity notification (KBS, misafir kimlik bildirimi) and personal data (KVKK, kişisel verilerin korunması kanunu). The KBS notification is prepared inside the check-in flow, so a passport number sitting in an Excel file is not that notification. Passport and identity numbers are the highest-risk column and the one least often needed downstream. Free-text request boxes collect health and accessibility information by accident, and that is a more sensitive category than a phone number.

The question to ask about every column is not whether it exists, but which person outside the hotel will do something different because of it.

Which columns can you remove before sending?#

Remove every column the receiver will not act on. If a column does not change what the receiver does, it does not need to travel.

Apply the action test column by column: name the action the column triggers. No action, no column. Where the receiver only needs a headcount or a room assignment, replace names with a running label (Guest 1, Guest 2) and keep the mapping inside the hotel. Replace passport and identity numbers with a single flag such as "identity checked at arrival" when the receiver only needs to know the guest is verified. For the reasoning behind pseudonyms and what still identifies a guest, see removing guest details before sharing: masking, pseudonyms and what still identifies a guest.

Trim special requests to the operational sentence: dietary requirement, accessibility need, late arrival. Cut everything that reads like a medical or personal note. Keep a short record of what you sent, to whom and on what date, so a later question has an answer.

Trimming is not a one-time job. The template drifts back to full columns every time someone adds a field for their own convenience, so review it whenever a new partner appears.

How should you name, protect and send the file?#

Name the file so it carries no personal data, protect it with a password, and send the password through a different channel than the file.

For the file name, use the words rooming list, the group or agency code, and the date. Never a guest surname, never the word passport, never the hotel's internal guest number. The password never goes in the same e-mail, the same thread or the covering text. A phone call or a separate message on a different channel is the point of the exercise. Password length and complexity are a policy decision for the hotel and its IT provider; this article recommends no product and no vendor.

A protected attachment protects the file, not the message. Ordinary e-mail is not a secure channel, and the attachment still sits in two inboxes. A download link with an expiry date and named access is easier to withdraw than an attachment, but only if the receiver can actually open it; test once with each new partner. If the receiver is in another country, whether the data leaves Türkiye is a separate question from how the file is protected, and it deserves its own answer before the first send; see sending guest data abroad: tour operators, foreign software and cross-border transfers. Keep the password out of the file name and out of any auto-signature.

How do you check the recipient before you press send?#

Check the address against a written contact record, not against autocomplete. Autocomplete offers old contacts, personal addresses and similar names, which is how a file reaches the wrong inbox.

Autocomplete offers old contacts, personal addresses and colleagues who left: similar names are enough to send a group's passports to the wrong company. Keep one approved contact record per partner: company, named person, role, e-mail address, phone number, agreed channel and agreed deletion date. Use a saved template with the recipient already in it instead of typing an address into a fresh message at the end of a shift.

Forwarding carries the whole thread, including earlier files and earlier passwords; reply-all can add recipients nobody intended. Never put two agencies in copy on a file that contains another agency's guests; each partner gets its own message. For files that still contain identity numbers, use a second pair of eyes: one person prepares, another checks recipient and columns before sending. Log the send: date, file name, recipient, columns included. It takes twenty seconds and answers the first question after an incident.

Where do copies of the list end up, and when do you delete them?#

Every copy lives somewhere: your sent folder, the receiver's inbox, a downloads folder, a shared drive, a phone gallery, a printout at the desk. Deletion is a plan across all of them, not one action.

Write a deletion date into the covering message and into the partner contact record, for example seven days after the group departs, and ask for a written confirmation when it is done. Clean the places people forget: sent items, downloads, the desktop, the reservations shared drive, group chats on phones, and the printout beside the printer. A file that was downloaded to a phone to answer a question at 23:00 is still there in the morning.

How long your hotel keeps group files is your hotel's own decision, written down and applied the same way every time. A rule that lives only in one person's memory is not a rule. Give one person per shift the job of the weekly sweep, otherwise it belongs to everybody and happens to nobody. When a partner stops working with the hotel, close the contact record and confirm that the files held by them are gone.

What do you do in the first hour after a list goes to the wrong address?#

Treat it as a possible personal data breach: contain it first, then assess it, then record it. Do not wait until you are certain before you act.

In the first ten minutes, ask the recipient to delete the message and confirm in writing. A recall function helps but is unreliable, so the written confirmation matters more. Establish whether the password travelled with the file; if it went by a separate channel and was never shared, the exposure is narrower, and that fact belongs in the record.

Do not delete your own copies or the thread: you need them to describe what was in the file and who received it. Write down what was in the file, which columns, whose data, how many people, who received it, when, what you asked them to do and what they answered. Follow the hotel's breach routine rather than improvising; the notification duties and their timing come from the law and from the procedure your hotel has agreed, not from this article, and the full routine is described in personal data breach at a hotel: the notification routine. Whether and when a notification is required in your specific case is a question for your legal adviser.

Then fix the cause, not just the symptom: the template, the contact record and the second pair of eyes are what stop the next one.

How do you train the desk with a five-minute card?#

Turn the checklist into one page at the reservations desk and rehearse it once a month with a fictional group file.

The card has five lines: remove the columns nobody acts on, name the file without personal data, protect it and split the password, check the recipient against the record, agree the deletion date. Rehearse with a fictional file: let a new starter prepare a send, then run a wrong-recipient drill and see whether the first-hour steps come back without prompting.

Put the card where the work happens, next to the reservations printer or on the desk screen, not in a policy folder nobody opens. Name one owner per shift, so the weekly sweep and the contact records have a person attached. Review the card after every incident and every new partner; a card that never changes is a card nobody reads. New staff confirm in writing that they have read it, and the confirmation goes in the file, not in a conversation.

What to do next#

Take today's rooming list template, delete the columns no receiver acts on, and save it as the hotel's standard before the next group arrives. The rest follows from that one file: a contact record for each partner, a password that travels separately, a deletion date written into the message, and a first-hour routine that everyone at the desk has rehearsed once.