UK GDPR
The UK GDPR is the United Kingdom’s version of the General Data Protection Regulation; with the Data Protection Act 2018, it governs how personal data is handled in the UK.
What it covers for a hotel
The guest data the hotel keeps (names, contact details, passport scans, preferences, messages) and the staff data behind it. Its core ideas match the EU text: a lawful basis for each use of the data, no more data than needed and for no longer than needed, security, and guests’ rights to see, correct and erase what is held on them. The UK regulator is the ICO: since 30 September 2026, the Information Commission, which took over from the Information Commissioner. The Data (Use and Access) Act 2025 does not replace either text; it amends them, in stages.
A group with properties in the UK and in the EU answers to both texts. When personal data leaves the UK, to a supplier’s servers elsewhere for instance, the transfer has its own rules, so ask each supplier where the data is stored and processed.
Where to read about Wizorks
This entry explains the law; it is not a statement about Wizorks. What Wizorks publishes is on its security page (servers in Frankfurt, inside the EU), its legal page (the main providers, and the data processing agreement on request) and its privacy policy.