There is a version of hospitality security that looks entirely reasonable on paper. Physical access controls are in place. The network is protected. PCI-DSS compliance is current. The data protection policy was updated last year. A reasonable person reviewing the documentation would conclude the organization is managing its risks well.

And yet, in that same organization, a reservations agent’s credentials can unlock the personal details of 200,000 guests. A departing revenue manager walks out with an export of the loyalty database because nobody revoked her access. A channel management vendor has been processing guest data for three years under a contract that predates current data protection requirements. A facial recognition pilot is live at the check-in desk under a vendor agreement with no mention of biometric data governance. None of these triggers a security alert. None appears on a compliance checklist. All of them are far more common than most leadership teams are comfortable acknowledging.

This is the gap that conventional security thinking—divided between physical and cyber domains, managed through periodic compliance cycles—is not built to see. Risk in the modern hotel environment does not live at the perimeter. It lives inside the organization, accumulating through operational decisions made under pressure, vendor relationships managed for convenience, and technologies adopted faster than the governance frameworks designed to oversee them.

Data risk has become the defining enterprise security challenge in hospitality. Not because it is more dramatic than physical threats or more technical than cyberthreats, but because it is the dimension most organizations are managing least deliberately and where the consequences of that gap are compounding faster than most realize.

When Governance Fails Before the Attacker Arrives

In one of the most extensively documented hospitality data incidents of recent years, the UK Information Commissioner’s Office (ICO) found that Marriott International Inc. for years had failed to understand what personal data it held, where it resided, or who could access it. The breach stemmed from a 2014 cyberattack that affected the Starwood Hotels group, which Marriott acquired two years later. The breach was not discovered until 2018. While the ICO noted in its investigation that Marriott had significantly increased its IT systems since, the damage was done. The financial penalty was substantial—18.4 million pounds. The root cause was governance, not technology.

A ransomware attack targeting MGM Resorts in 2023 illustrated a different failure mode. Initial access was obtained through a single telephone call by someone impersonating a legitimate employee. The caller succeeded in gaining working credentials. Those credentials provided lateral access across interconnected hotel systems before anyone detected the breach. The personal information of 37 million people was compromised, and the ransomware attack caused immediate disruption across the company’s 30 properties for nine days. The failure was not a technical vulnerability. It was an identity verification process that trusted what it should have verified, combined with credentials whose access scope was far broader than any single role required.

These incidents share a defining characteristic: The conditions that made them possible accumulated over years unreviewed data stores, credentials never revoked, access scopes that drifted beyond their justification, and integrations never properly assessed. The failures were downstream consequences of governance failures that were building long before any attacker arrived.

Better intrusion detection does not address governance drift. PCI-DSS certification does not prevent credentials from accumulating unneeded access. An updated data protection policy does not govern what a vendor does under a contract that is never reviewed. These gaps are not closed by technology. They are closed by leadership attention and integrated governance.

The Data Life Cycle: Where Risk Builds Stage by Stage

Guest data accumulates risk from the moment it is collected. It then compounds at every stage until it is verifiably destroyed, including any residual copies such as backups, archives, logs, third-party systems, and legal retention records. In most hotel operations, it is never verifiably gone and duration is variable, defined by the organization’s retention schedule, legal or regulatory requirements, and business purpose. That challenge is sharpest during preopening, when systems are provisioned under time pressure, credentials distributed before operational norms exist, and artificial intelligence (AI) systems configured before governance frameworks are established. The data governance decisions made, or deferred, during preopening shape a property’s risk profile for years.

Collection: How data quietly outgrows its purpose.  Data collection rarely expands through deliberate policy. It expands through convenience. A supervisor captures dietary preferences in a shared spreadsheet because the property management system (PMS) is inconvenient. A front desk agent photographs a guest’s ID and sends it to a messaging group. A revenue analyst exports a complete guest history for a report that is never deleted. Each decision is understandable in isolation. Together, they produce an environment where sensitive personal data exists in dozens of undocumented, unprotected locations. The General Data Privacy Act’s (GDPR) purpose limitation under Article 5(1)(b) and data minimization under Article 5(1)(c) are direct regulatory responses to exactly this operational reality.

Storage: The data your audit never finds. Core systems are subject to baseline controls. PCI-DSS Requirement 3 mandates encryption of cardholder data and restricts post-authorization retention. Most security reviews start and stop there. The greater exposure sits in what practitioners call the secondary data environment: accumulated exports, email attachments, collaboration workspaces, and offline copies that fall entirely outside the governance framework. This is the data audits miss and attackers consistently find first.

The following locations are worth checking against your own environment. In most operational settings, at least three of the five will contain active guest data with no current security visibility.

Where Secondary Data Accumulates	Why It Creates Risk
Exported spreadsheets and reports	Typically unencrypted, emailed freely, retained indefinitely with no deletion schedule, and often forgotten entirely
Email inboxes and attachments	Guest ID scans and payment references sitting in personal inboxes, outside any governance framework or retention policy
Messaging and collaboration tools	Access controls often broader than the PMS; content rarely audited, rarely deleted, rarely acknowledged as a data store
Staff personal devices	Photographs of guest documents and operational notes entirely outside organizational control
Decommissioned system archives	Historical booking data from superseded platforms, often forgotten, never formally deleted, still fully accessible

The honest reality is that most hospitality organizations’ actual data footprint is significantly larger than their documented inventory suggests. Closing that gap is not a technology project. It requires operational policy, management enforcement, and the willingness to look at the data environment as it actually is, not as the core systems documentation implies it should be.

Access: How permissions grow beyond their justification. Access management failure is the most consistent finding across hospitality data incidents. It rarely results from a single decision but from dozens of individually defensible ones: access granted during a peak period and never reviewed, credentials retained by a vendor whose contract expired, a restructured role that kept its predecessor’s permissions. The aggregate effect is a significantly over-permissioned environment where a single compromised credential reaches data that no legitimate role should access in full. PCI-DSS Requirement 7 mandates least-privilege access. ISO/IEC 27001:2022 Annex A Controls 5.15 and 5.18 require formal authorization, regular review, and prompt revocation. Both controls identify access governance as foundational. In most operational environments, it is treated as administrative overhead.

Third-party relationships: Accountability without visibility. A hotel’s data environment does not end with its own systems. Guest data flows continuously to travel agents, payment gateways, channel managers, loyalty operators, point-of-sale vendors, and cloud-hosted property management providers. GDPR Article 28 requires formal data processing agreements with each, including documented instructions, security obligations, breach notification time frames, and audit rights. Many hospitality organizations have not reviewed these agreements in years.

For properties under franchise or management agreements, the complexity compounds. Brand-level data protection standards frequently fail to align with property-level operational reality. The gap between what the brand requires on paper and what the property implements is where significant risk accumulates invisibly until an incident makes it visible.

AI: The risk being built in real time. If the above risks represent challenges accumulated over years, AI represents the challenge the industry is actively creating right now. Hotels are deploying facial recognition, behavioral analytics, automated guest scoring, and loyalty personalization engines—mostly under commercial pressures that leave little room for the legal review these deployments require.

Biometric data: Where the legal stakes are highest. Facial recognition at check-in, lobby surveillance, or access control—all can process biometric data. Under GDPR Article 9, biometric data used to uniquely identify individuals is a special category of personal data subject to the regulation’s strictest processing restrictions. Processing it without explicit informed consent or another specified lawful basis is not a compliance gap. It is a fundamental breach of the legal framework.

In practice, most hospitality AI deployments involving biometrics have been initiated through procurement processes with no legal review of the data protection implications. The vendor offers a product. Operations sees a guest experience benefit. IT deploys the integration. No one formally assesses the lawful basis, the consent mechanism, or the guest disclosure obligations. The gap between deployment velocity and governance readiness is where the exposure sits.

As AI-enabled check-in, behavioral analytics, and loyalty personalization expand across the sector, the volume of biometric data being processed will grow significantly. Organizations deploying without a formal legal basis, a data protection impact assessment, and transparent guest disclosure are accumulating exposure that will eventually become visible through enforcement, a guest complaint, or a breach of the AI system’s underlying data store.

The question is not whether AI creates new data risk in hospitality. It demonstrably does. The question is whether governance is keeping pace with adoption. In most cases, it currently is not.

Automated decisions: The accountability gap guests cannot see. Beyond biometrics, AI systems are increasingly making decisions that affect guests materially: assigning loyalty tiers, flagging booking risks, and providing promotional offers at a speed no manual review can oversee. GDPR Article 22 establishes the right not to be subject to decisions based solely on automated processing that produces significant effects. Its application to hospitality AI—guest scoring systems, fraud detection algorithms, personalization engines—is not yet consistently understood or implemented. That gap will not remain invisible indefinitely.

The foundation problem: AI inherits what governance left behind. Every AI system runs on data whose governance determines the risk profile of everything built on top of it. Organizations that have not resolved their data life-cycle challenges—uncontrolled secondary stores, over-permissioned environments, ungoverned vendor integrations—are now layering AI systems on that unresolved foundation. Those systems inherit and amplify the governance failures beneath them. An AI personalization engine trained on years of unaudited guest data does not solve a governance problem. It scales it.

AI Application in Hospitality	Data Risk Implications
Facial recognition at check-in and access control	Special category biometric data under GDPR Article 9; requires explicit consent or lawful basis; strict processing restrictions apply
AI-enhanced video surveillance behavioral analytics	Continuous behavioral biometric data collection; retention, proportionality, and GDPR Article 22 automated decision-making obligations
Predictive guest personalization engines	Extensive personal data profiling; guest rights to object under GDPR Article 21; data minimization obligations
Automated fraud detection and booking screening	Automated decisions with significant guest effects; GDPR Article 22 rights apply; algorithmic accountability required
AI-powered chatbots and service automation	Natural language personal data; retention, purpose limitation, and processor contract obligations
Revenue management AI and demand forecasting	Aggregated personal data for commercial optimization; secondary use restrictions and minimization obligations apply

Where Physical, Digital, and Data Risk Intersect

The most consequential hospitality security failures do not respect domain boundaries. Physical access, digital credentials, data exposure, and AI systems are interconnected. The connections between them all are where conventional security thinking has its largest blind spots.

Convergence Pathway	How It Materializes in Practice
Physical access enables data theft	An unescorted contractor accesses a back-office terminal during a maintenance visit, exports a guest database using a shared service account, and departs. The breach is discovered weeks later during a reconciliation exercise.
Compromised credentials expose physical safety	A phishing email compromises a reservations agent’s login. The attacker identifies high-profile guests by arrival date and sells that information. Physical security consequences follow before any cyber alert fires.
Access retention enables insider misuse	A departing employee copies a guest database to a personal device, using access never revoked at exit. The data subsequently appears on a third-party forum.
Third-party breach reaches your guests	A channel management vendor is compromised. Guest reservation data shared through a commercial integration is exposed. The hotel has no contractual right to timely notification or audit.
AI system breach exposes sensitive inferences	An AI personalization platform is compromised. Attackers access inferred behavioral profiles, loyalty scoring models, and biometric templates that data guests never explicitly provided and whose collection they were never informed of.

No single security domain can close these pathways independently. Physical controls do not prevent credential misuse. Technical controls do not stop data being copied to a personal device. Cybersecurity frameworks do not govern vendor data processing contracts. And none of these domains govern how an AI system processes the inferences it draws from guest behavior. Effective risk management requires integrated governance, with physical security, information security, and data risk aligned under shared ownership. The ASIS ESRM Guideline articulates this precisely: Security exists to protect organizational value through ongoing, integrated, risk-based decision-making across all domains simultaneously. In hospitality, that is not an aspiration. It is a requirement.

Five Places to Start—Sequenced by Impact

These five priorities address the most common and consequential patterns. Begin with the first. Most organizations will find that completing priority one makes everything that follows significantly more tractable.

1. Map your real data environment—not the documented one. Identify where guest data has traveled beyond core systems: shared drives, email archives, exported reports, collaboration tools, and personal devices. Document third-party data flows and verify that current, compliant data processing agreements exist for each relationship. Establish a live record of processing activities as an operational tool, not a compliance artifact.

2. Revoke what should never have persisted. Cross-reference active system access against current roles, not last year’s chart. Revoke departing staff, contractor, and vendor access on the day the relationship ends. Apply the principle of least privilege to every new access grant. Implement multifactor authentication for all remote and personal-data-bearing accounts.

3. Delete what no longer earns its risk. Establish retention schedules aligned to legal requirements, and implement systematic deletion when data reaches its limit. Stop exporting full guest datasets where anonymized data would serve equally well. Data that does not exist cannot be breached, extorted, or misused.

4. Hold vendors to the same standard as internal systems. Audit all third-party data processing relationships and confirm current, compliant agreements for each. Incorporate contractual audit rights and remediation obligations. Review vendor security posture annually at minimum. Accountability to guests cannot be transferred through a vendor contract.

5. Govern AI at the point of procurement, not after deployment. Every AI deployment processing personal data requires a documented legal basis, a data protection impact assessment, and—where biometrics are involved—explicit guest disclosure and consent. Build AI governance into procurement. Audit the underlying data environment before AI systems go live on top of it.

Compliance Sets the Floor. Risk Management Builds Above It

The organizations that manage data risk most effectively have stopped treating compliance as the destination. PCI-DSS certification confirms controls were in place at the point of assessment, but it does not capture access drift accumulated since. ISO 27001 certification confirms that a management system was operating to a defined standard at audit time, but it does not govern what a vendor did with guest data last week.

One of the largest regulatory penalties issued against a hospitality organization—the 18.4 million pound fine against Marriott—was levied against a group with a recognized compliance program. The penalty reflected a failure of data governance that compliance frameworks were never designed to catch specifically: the inability to identify what personal data the organization held following a corporate acquisition, where it resided, and who could access it. Compliance and governance are not the same thing. Confusing the two is what creates the gap.

EU and UK GDPR apply to any processing of personal data belonging to individuals in those jurisdictions, regardless of where the hotel operates. The California Consumer Privacy Act applies to organizations collecting data from California residents above defined thresholds: annual gross revenues exceeding $25 million, data of 100,000 or more consumers, or the deriving of 50 percent or more of revenue from selling personal data. In 2026, Japan amended the Act on the Protection of Personal Information, accelerating enterprise AI innovation by removing consent roadblocks for statistical data processing, while strengthening protections for children’s privacy under age16 and tightening rules on biometric data processing. These frameworks overlap in scope but diverge in requirements.

For security professionals making this case to a board, the most effective framing is financial and reputational. Considerations are regulatory penalties and remediation costs that routinely exceed the annual security budget, booking volume and brand equity consequences that take years to recover from, and cyber insurance coverage that is becoming harder to maintain for organizations that cannot demonstrate active data governance. These are board-level concerns. Framing data risk as a financial and reputational imperative, not a compliance obligation, is what moves it from the security team’s agenda to the board’s.

The Guest Is Trusting You with More Than a Credit Card

The hospitality industry operates on trust. Guests hand over their identity, payment details, preferences, and, increasingly through AI-enabled systems, their behavioral patterns and biometric identifiers. They do so expecting this will be handled with the care that defines good hospitality in every other dimension.

The governance frameworks most organizations rely on were designed for a simpler data environment than the one they now operate in. Physical and cybersecurity programs were not built for an environment where a guest's facial geometry is processed at check-in, where loyalty algorithms draw inferences from years of behavioral data, and where that data simultaneously resides across vendor platforms whose data processing agreements have not been reviewed since the last contract renewal.

The question is not whether data risk is real. The incidents, regulatory penalties, and the pace of AI adoption answer that clearly. The question is whether the governance in place today is adequate for the data environment that already exists and for the one being built right now, through every AI integration, every vendor relationship, and every operational decision about whose credentials get revoked and whose do not. For most hospitality organizations, the honest answer to that question is where the work starts.

 

Dan Timilsina, CPP, is a security and risk management professional with more than 15 years of experience across luxury hospitality properties in the UAE, Nepal, and Japan, spanning high-density urban, full-service, and resort environments. His experience includes property security leadership, consulting, and preopening programs, with a focus on security governance, physical security systems and technologies, data protection, crisis management, and business continuity.

His perspective is shaped by the practical intersection of physical security, information security, and broader business risk—particularly in complex hospitality environments where these disciplines must work together to strengthen organizational resilience.

 

This article represents the author’s independent professional analysis, based on publicly available information, regulatory instruments, and practitioner observation. It is intended for informational and educational purposes only and does not constitute legal, compliance, regulatory, or technical security advice.

Regulatory frameworks referenced are subject to ongoing legislative development, judicial interpretation, and jurisdictional variation. Organizations should engage qualified legal, compliance, and security professionals for guidance specific to their circumstances. References to incident patterns are drawn from public record sources including regulatory decisions, corporate disclosures, and widely reported industry analysis. Threat actor attribution, where referenced, reflects publicly available reporting and has not been subject to final judicial determination.

© 2026, Dan Timilsina, CPP

MOST POPULAR ARTICLES

1. The Right Message: Aligning Communication, Relationships, and Timing During Crises

2. Without Alignment, Crisis Messaging Fails Before the Crisis Begins

3. Drone-as-First-Responder: Reducing Uncertainty Before Responders Arrive