Digital check-in for short-term rentals in Romania: guest forms and GDPR

With a smart lock and a message sent the day before, you can host guests without ever meeting them. Your obligations regarding their identity, however, stay the same. In 2026, a short-term rental host in Romania keeps records of the people who sleep in the apartment for three different reasons: the accommodation occupancy form required by ANAF, the tax authority; the arrival and departure registration form set out in the rules on tourist records; and, for guests who are not citizens of the European Union, the European Economic Area or Switzerland, reporting their data to the police within 24 hours. All of this information is personal data, so GDPR applies too. This guide shows you which form to fill in, what data to ask for, how long to keep it and how to set up a digital check-in that collects no more than the law requires.

Three different records for the same guest

All three obligations start from the same question, who slept in the apartment and when, so they are easy to confuse. But the legal basis, the authority that checks them and the data required all differ.

The two forms do not replace each other: the registration form has no field for the CNP, and the ANAF form does not ask for date of birth or home address. The ANAF form must be completed both by those who rent out between 1 and 7 rooms in homes they own and by those with more than 7 rooms or who provide accommodation services as a self-employed activity. Its instructions define short-term renting as renting a room continuously to the same person for no more than 30 days in a calendar year, and part of a day counts as a full day. How income tax and health contributions (CASS) are calculated on this income is explained in our guide to income tax and CASS in 2026.

The registration form: what the rules say

The rules approved by HG No. 237/2001 apply to tourist accommodation establishments: hotels, motels, chalets, guesthouses and “other units with a tourist accommodation function”, and therefore also to classified apartments and rooms. The only exception concerns tourist and agritourism guesthouses, which use the building register (cartea de imobil) instead of the form. The basic rules are as follows:

• All tourists are registered on arrival. Each tourist fills in the form based on their ID document: for Romanian citizens, usually the identity card or passport; for foreigners, usually the passport or identity card.
• No ID, no stay. The rules prohibit accommodating anyone who does not have an identity document.
• The data is checked on arrival. The person receiving the tourist compares the data on the form with the ID document, signs the form and returns the ID immediately. That person is also responsible for the form being filled in correctly.
• Standard forms, in duplicate. The forms are serially numbered, on carbonless paper and printed through the state printing house, Regia Autonomă “Monitorul Oficial”. It is up to whoever runs the establishment to obtain them.
• The original for the police, the copy for you. The originals, sorted alphabetically, are made available to the police daily, while the copies stay at the establishment and are archived for 5 years. The hand-over arrangements are agreed with the local police.
• Visitors and minors. A visitor who stays overnight must also fill in the form. Children under 14 may only be accommodated together with their parents or legal guardians, except for organised groups accompanied by teachers, coaches or guides.
• Confidentiality. You may not disclose information about a tourist’s stay without their consent, except for data on the lawfulness of their stay requested by police officers with that remit. The accommodation is the tourist’s temporary residence and is inviolable, except in situations that endanger the life, safety or property of tourists or the establishment’s facilities.

What this means for self check-in

The rules were written for establishments with a reception desk: the tourist fills in a paper form on arrival, and a person acting for the establishment checks their ID and signs. They provide neither for an electronic form nor for remote verification. An online form sent before arrival helps you get the data right and speeds up check-in, but for now it does not replace the standard form signed by the tourist.

That is why, before your first booking, it is worth settling three things:

• Who checks the ID on arrival. You, your co-host, your property manager or whoever hands over the keys. The rules assume that the person receiving the tourist holds the ID document, compares the data and returns it immediately; a photo received on a phone is not the same thing.
• How the forms reach the police. Ask your local police station how it wants to receive them; the rules leave this arrangement to the police and the accommodation provider.
• What to do about guests from outside the EU. Their data must reach the police within 24 hours. Agree in advance, again with the local police, how this reporting is done.

GDPR: what data to ask for and on what legal basis

As a host, you are a data controller: you decide what data to ask guests for and what to do with it. GDPR requires a legal basis for each purpose, and in short-term rentals three usually apply:

• Legal obligation (Article 6(1)(c)). The data on the occupancy form, on the registration form and the data reported to the police for foreign guests. You do not ask for consent for this data: the basis is the law, and the guest cannot refuse to provide it without giving up the stay.
• Performance of a contract (point (b)). Contact details, arrival time, the access code and messages about the stay.
• Consent (point (a)). Newsletters, offers for future stays or photos of guests on social media. You ask for it separately, through an option the guest ticks themselves, and they can withdraw it at any time.

The CNP and copies of ID documents. Law No. 190/2018 treats as a national identification number the CNP, the series and number of an identity document, and passport and driving licence numbers. Processing them, including collecting or disclosing documents that contain them, is allowed only on one of the legal bases in Article 6(1) GDPR. If you process them on the basis of legitimate interest, the law requires additional safeguards, including a data protection officer, retention periods and regular training for those who have access to them. The practical conclusion: record the CNP or the ID series and number because the forms require them, but do not keep photos or scans of ID documents “to be safe”.

What Airbnb says about guests’ ID documents. Airbnb does not share guests’ government IDs with hosts. You can ask for an ID after booking only if your listing description stated, before the booking, what information you require and why, and only if you need it for legal or compliance reasons. So state in your description that Romanian law requires you to complete the registration form and the occupancy form, and what data they involve.

Online check-in via Booking.com. Booking.com offers an online check-in solution that collects passport or ID details before arrival and shares key collection instructions. It works only for properties connected through a connectivity provider and for eligible single-room reservations. In this process, Booking.com acts only as a data processor, so you remain the data controller.

Informing guests. When you collect the data, you tell guests who you are and how to contact you, why you need the data and on what basis, who you pass it on to (the police, ANAF), how long you keep it, what rights they have, that they can complain to ANSPDCP, and that providing the data is a legal requirement without which you cannot accommodate them. A short notice in your online check-in form and in your house guide covers this information.

Security and retention. GDPR requires technical and organisational measures appropriate to the risk, and you must ensure that anyone with access to the data, including your co-host or cleaning team, uses it only on your instructions. Keep copies of the registration forms for 5 years, as the rules require, and the occupancy form together with your tax records; ANAF’s instructions set no separate period, so agree one with your accountant. Delete the rest of the data, such as online forms or messages containing ID details, once you no longer need it.

You will find the other digital obligations for hosts, from e-invoicing (e-Factura) to DAC7 reporting, in our guide to digital reporting.

What can go wrong: the fine over a breakfast list

On 2 July 2019, ANSPDCP, Romania’s data protection authority, completed an investigation into World Trade Center Bucharest S.A. and fined the company 71,028 lei, the equivalent of €15,000. A printed list used to check guests at breakfast, containing the data of 46 guests staying at the company’s hotel, was photographed by unauthorised people outside the company, and some guests’ data was published online. The authority found that the controller had not ensured that its employees processed data only on its instructions and had not implemented technical and organisational measures appropriate to the risk. The investigation started from the data breach notification sent by the company itself.

For a host, the equivalent of the breakfast list is a photo of a form sent to the cleaning team’s WhatsApp group, a folder of forms left in the apartment or a shared spreadsheet open to anyone with the link. Under GDPR, breaches of security obligations carry fines of up to €10 million or 2% of annual worldwide turnover, and breaches of the basic principles up to €20 million or 4%. The amount is set case by case, based on the seriousness of the breach, the number of people affected and the steps taken to limit the damage.

What to display in the apartment and what you may not monitor

Order No. 948/2026 requires those running classified tourist accommodation to display the classification certificate and its annex, together with the phone number of the inspection unit of the ministry responsible for tourism. The order also requires information materials for tourists, printed or digital, for example via QR codes, in Romanian and one international language for 1–2 stars, or in two languages for 3–5 stars. Establishments rated 3–5 stars must also have an email address and a website. The 2001 rules, in turn, require you to state the daily rate before the stay. The classification steps and the new conditions for apartments are explained in our guide to Order No. 948/2026, and the risks of operating without a certificate in our analysis of the fines for operating without classification.

Cameras. Since 30 April 2024, Airbnb has banned security cameras inside listings, regardless of their location, purpose or prior disclosure. Outdoor cameras must be disclosed before booking, may not monitor indoor spaces and are not allowed in areas where guests expect privacy, such as an enclosed outdoor shower or a sauna. Noise monitors must also be disclosed, are allowed only in common spaces and measure only sound levels, without recording conversations. Reported violations can lead to the removal of the listing or the account.

Compliant digital check-in in 7 steps

1. In your listing description. State that Romanian law requires the registration form and the occupancy form, and what data they involve. On Airbnb, this is the condition for being able to ask for an ID after booking.
2. After booking. Send an online form with exactly the fields of the two forms and the privacy notice. Do not ask for a photo of the ID if you do not need it; if you ask for one for verification, delete it once you have completed the forms.
3. On arrival. A person you designate checks the ID face to face, the tourist signs the standard form and the ID is returned immediately.
4. On the same day. You complete the occupancy form for the room and prepare the original registration form for the police, as agreed with the local police.
5. Within 24 hours at most, for foreigners. The data of guests from outside the EU, the EEA and Switzerland reaches the police.
6. While you keep the records. Paper forms stay in a locked cabinet, not in the apartment. Digital documents stay in an account with a strong password and two-step verification, accessible only to those who genuinely need it.
7. At the end. Copies of the registration forms are archived for 5 years, and the rest of the data is deleted once it is no longer needed. Set yourself a calendar reminder for deletion.

If a property manager handles check-in for you, set out in the contract who fills in the forms, who keeps them, who hands them over to the police and who is responsible for data security.

Common mistakes

• “I have self check-in, so I don’t need a form.” The rules require all tourists to be registered on arrival, however they get the keys.
• Mixing up the two forms. The occupancy form is for ANAF and contains the CNP; the registration form is for the police and is signed by the tourist.
• Asking for ID photos on WhatsApp and keeping them on your phone. The copies contain more data than the forms require and remain exposed if you lose your phone.
• Asking for consent for data required by law. The basis is a legal obligation; ask for consent only for optional purposes, such as marketing.
• Using data from the forms for a newsletter. Data collected for ANAF and the police may not be used later for a purpose incompatible with the original one.
• Leaving the forms in the apartment or sending them to the cleaning team. This is exactly the kind of exposure that led to the 2019 fine.
• Installing a camera that films indoors. Airbnb has banned indoor cameras since 30 April 2024, wherever they are placed.
• Dropping paper forms because you have heard of an electronic system. The digitalisation draft does not appear to have been adopted; until a decision is published in the Official Gazette, the standard form remains mandatory.

Frequently asked questions

Do I have to fill in the registration form if the guest booked through Airbnb or Booking.com?

Yes. The rules approved by HG No. 237/2001 require all tourists to be registered on arrival, whatever channel they booked through. The platform’s identity verification does not replace the form, which the tourist fills in and signs on arrival.

Can I ask guests for a photo of their identity card or passport?

You can ask for the data you need for the forms: name, date and place of birth, citizenship, home address, ID series and number and, for the ANAF form, the CNP. A photo of the document contains more than that, and Law No. 190/2018 also treats collecting documents that contain the CNP as processing it. If you still ask for a photo for verification, explain why, keep it for as short a time as possible and delete it once you have completed the forms. On Airbnb, you can only ask for an ID if you stated this in your listing description.

Do I need guests’ consent for the data on the forms?

No. For the data required by ANAF and the police, the legal basis is a legal obligation under Article 6(1)(c) GDPR. You must, however, tell guests when you collect the data who you are, why you need it, who you pass it on to, how long you keep it and what rights they have. Ask for consent separately, only for optional purposes such as a newsletter.

What do I do differently for foreign guests?

The registration form is filled in for all tourists, Romanian or foreign. For citizens from outside the EU, the EEA and Switzerland, OUG No. 194/2002 additionally requires the accommodation provider to report their data to the police within 24 hours; the ordinance does not treat citizens of the EU, the EEA and Switzerland as foreigners. On the ANAF form, if the guest has no CNP, enter the series and number of their ID document.