By the Unity Stays directors, Marcus Chong & Gadir Al-Khatib · Last updated 12 August 2026
In short: Hold only the guest data you need, for a stated purpose, deleted on a schedule — UK data protection law applies to names, ID and messages. Never install cameras or recording devices inside the property; outdoor cameras covering an entrance and decibel-only noise sensors are permitted, but only if declared in the listing and pointed away from private areas.
You are handling personal data
Names, contact details, ID documents, payment references, booking history and messages are all personal data, and UK data protection law applies to how you collect, store and use them.
The practical duties are proportionate rather than onerous for a small operator: hold what you actually need, for a reason you can state, for no longer than you need it, and keep it reasonably secure.
Where a management company processes guest data on your behalf, that relationship should be documented. Our agreements address it, and guest data is processed through the platforms and the tools we use rather than held loosely.
ID documents deserve particular care
Collecting ID for guest verification is normal and defensible. Keeping a passport scan in an email inbox for three years is not.
Decide before you start: what you collect, why, where it is stored, who can see it, and when it is deleted. A short retention period is easier to justify than a long one, and deleting on a schedule is easier than deciding case by case.
If you use a platform's own verification, prefer it — the data stays with them rather than accumulating with you, which is less to hold and less to lose.
Cameras inside a property: don't
Indoor cameras and recording devices in a short-let property are prohibited by the major booking platforms and are a serious privacy breach. This includes devices in living areas, and it includes anything with a microphone.
Undisclosed indoor recording is the most damaging thing an operator can be found doing. It ends listings, and it is the kind of story that travels.
Outdoor cameras covering an entrance are a different question and are generally permitted where they are declared in the listing and do not cover private areas — but declare them, always, and never point one at a garden or a window.
Noise sensors are permitted, if declared
A decibel-based noise sensor measures volume only. It does not record audio and cannot capture conversation, and it is standard equipment in the industry for spotting a gathering before neighbours do.
It must be declared in the listing and in the house rules. Guests are entitled to know what is monitoring them, and an undeclared device converts a legitimate tool into a privacy problem.
The distinction is worth stating plainly to guests, because "noise monitoring" sounds like listening to people unless you explain that it is not. Any device we install is declared, and it remains our property.
The short version
Collect the minimum. Say why. Delete on a schedule. Never record inside the property. Declare anything that monitors, including outdoor cameras and noise sensors.
That covers the great majority of what a short-let operator needs to get right, and it is considerably less work than the subject's reputation suggests.
The ICO publishes guidance aimed at small organisations, and it is the right source for anything beyond this outline.
A plain summary of common obligations, not legal advice. Data protection duties depend on what you collect and why. Take advice if you are unsure, and consult the ICO's published guidance.