Few businesses collect as much personal data, from as many people, as a hotel. In a single check-in your team may handle an IC or passport, a phone number, an email address, a credit card, a car plate and notes about dietary needs or special occasions. Multiply that by every guest, every day, and data protection stops being an IT topic. It becomes an operations topic.
This article is general information, not legal advice. For specific obligations, refer to the Personal Data Protection Commissioner's guidance or your legal adviser.
The law in brief
Malaysia's Personal Data Protection Act 2010 (PDPA) governs how businesses collect, use, store and share personal data in commercial transactions. Hotels fall squarely within it.
The Act was amended in 2024. Among the changes, organisations are now expected to notify the Commissioner of personal data breaches, to appoint a data protection officer, and to make sure the vendors who process data on their behalf also keep it secure. Penalties for non-compliance were also raised. If your property has not reviewed its practices since the amendments, now is a good time.
Where the risks actually sit
Most data incidents in hotels are not sophisticated cyber attacks. They are everyday habits:
- Photocopies of ICs and passports left in trays, folders or recycling bins behind the front desk
- Guest lists shared on WhatsApp or personal phones for events, transfers or VIP arrivals
- Shared logins to the property management system, so nobody knows who accessed what
- Rooming lists and registration cards emailed to tour operators or vendors without a second thought
- Card details written down for a deposit or a phone booking
- CCTV footage kept indefinitely with no clear owner
- Lost and found logs with guest names and room numbers left in open view
Habits that reduce the risk
Collect only what you need. If a scan of the IC is required, store the scan securely and do not keep a paper copy as well.
Give everyone their own login. It protects the guest and it protects your staff when something needs to be traced.
Set retention periods. Decide how long registration cards, CCTV and booking records are kept, then actually delete them on schedule.
Check your vendors. Laundry, transport, booking engines and event partners may all receive guest data. Know what they get and how they protect it.
Have a breach plan. Who does a staff member tell if a guest list is sent to the wrong person? What happens next, and how fast? Decide this before it happens.
Train the front line. Most of the risks above sit with frontliners, not IT. A short, practical session changes daily behaviour faster than a policy document.
Building awareness in your team
Ernest Balansingam leads three programmes on this topic: The Trust Suite: A Hospitality Guide to the Personal Data Protection Act 2010, Personal Data Protection for Hoteliers: Safeguarding Guest Trust in a Digital Era, and Data Protection Excellence Program for Hotel Leaders.
They are HRD Corp claimable and suited to senior management, IT managers, supervisors and executives. Contact us to plan a session.