Protecting Guests' Personal Data in a Rural Household: LPPD, Guest Book, Residence Registration and Retention Rules

If you welcome overnight guests to your rural household in Trebinje, Bileća, Nevesinje, Gacko, Ljubinje, Berkovići or Istočni Mostar, then in legal terms you are a processor of personal data. Every time you write down a name, an ID card or passport number and an arrival date, you are collecting information that the law protects. This is not a box to tick and forget; it is an ongoing responsibility that protects both your guests and you.

This guide explains how to align the everyday work of a small household with Bosnia and Herzegovina's Law on Protection of Personal Data, as well as with tourism and residence-registration rules. The goal is simple: keep tidy records, meet your obligations toward the authorities, and hold on to no more data than you genuinely need.

The new legal framework: LPPD and alignment with the GDPR

In 2025, Bosnia and Herzegovina adopted a new Law on Protection of Personal Data (published in the "Official Gazette of BiH", No. 12/25). The law is aligned with the EU's General Data Protection Regulation (GDPR, EU Regulation 2016/679), and its full application began in late 2025. The Agency for Personal Data Protection in BiH is responsible for supervision and enforcement.

As a host, the three concepts you most need to understand are:

• Data subject — your guest, the individual whose data you collect.
• Controller — you (the household), because you decide why and how the data is processed.
• Processor — any third party that processes the data on your behalf (for example a booking platform or an accountant).

The new law strengthens the principles of transparency, accountability and security, and it foresees noticeably higher fines for serious breaches than before. For a small household the message is clear: handling data properly is now part of running the business, just like hygiene or guest safety.

Golden rule: collect only the data you genuinely need, use it solely for the purpose you collected it for, and keep it only as long as necessary.

The legal basis for processing guest data

Processing personal data is lawful only if there is a clear legal basis. The law recognises several bases, and in rural tourism the following usually overlap:

1. Performance of a contract. When a guest books and comes to stay, you enter into a contract to provide accommodation. The data needed for that service (name, contact, dates of stay) is processed on the basis of the contract — no separate consent is required.
2. Compliance with a legal obligation. Keeping the guest book, registering residence and calculating the residence tax are prescribed by law. You process the data you enter there because the law requires it.
3. Consent. This is needed only for processing that is not necessary for the service or a legal duty — for example, sending a promotional newsletter, posting a guest's photo on social media, or adding them to a marketing list. Consent must be freely given, clear, and always withdrawable.
4. Legitimate interest. In limited cases (for example basic security of the premises) processing may rest on a legitimate interest, subject to a careful assessment that it does not override the guest's rights.

Asking for "consent for everything" is a mistake. For the guest book and residence registration the basis is a legal obligation, not consent — a guest cannot refuse that processing if they want to use the service. Reserve consent for what is genuinely voluntary.

The guest book: what to record and why

The guest book is the basic record of any accommodation establishment, including a rural tourism household. In the Republic of Srpska its form, content and manner of keeping are set out in a regulation under the Tourism Law, and it may be kept on paper or electronically.

The data typically recorded is:

• the registration serial number,
• the guest's first and last name,
• the ID card or passport number (and nationality for foreign guests),
• the date of arrival and the date of departure,
• a remarks field.

This data serves precisely defined purposes: recording the stay, calculating the residence tax, and meeting the duty to register with the authorities. The principle of data minimisation means you should not ask for anything beyond that — do not record a personal identification number, occupation, vehicle plates or similar details unless you have a clear legal basis and purpose.

Residence registration and duties toward the authorities

Beyond the guest book, as an accommodation provider you also have a duty to register guests' stays with the competent authorities. For foreign nationals this duty is especially strict: registered accommodation providers are, as a rule, required to report a foreigner's stay to the competent Service for Foreigners' Affairs or the police within a very short window after providing accommodation (indicatively within 12 hours). Domestic guests are recorded through the ordinary evidence and residence-tax system.

In practice this means you need a reliable way to capture the required data as soon as a guest arrives and to forward it promptly. Many municipalities and tourist boards encourage electronic registration, which speeds up the process and reduces errors. Before your first season, check the exact deadlines and reporting channels with the competent municipal office, the RS Ministry of Trade and Tourism, and your local tourist organisation, because the details can vary and change.

It is important to separate the two roles the same data plays: one piece of data (say, a passport number) serves both the tourism record and the report to the authorities. That does not mean you may use it for any purpose — each purpose must have its own legal basis.

Data storage and retention periods

The storage-limitation principle is one of the most important: you must not keep data longer than is necessary for the purpose for which it was collected. For records such as the guest book and residence-tax data, the retention period flows from tourism and tax rules — such records are, indicatively, kept for a number of years in case of checks and inspections. Data you collected on the basis of consent alone (marketing) must be deleted as soon as the guest withdraws consent or the purpose ends.

Alongside the period, security of storage matters just as much:

• keep the paper guest book locked away, out of reach of other guests and unauthorised persons;
• protect electronic data with a password and regular backups;
• do not share guest data through open messages or unsecured spreadsheets;
• once the retention period ends, destroy the data permanently and securely (shred paper, delete electronic records).

Guests' rights and your duties as controller

A guest has the right to know what data you collect, why, and on what legal basis. It is therefore good practice to have a short data-processing notice — a few sentences at reception or in the room (in Bosnian and English) explaining the purpose, the basis and the retention period. A guest also has the right to access their data, to correct inaccurate data, and, in cases foreseen by law, to have it erased.

If processing involves higher risk or new technologies, the law provides for a data protection impact assessment. For a typical small household this is usually not required, but if you introduce video surveillance or a larger reservation system, consult the Agency for Personal Data Protection or a qualified professional.

A practical checklist for the host

1. List which guest data you collect and assign a legal basis to each (contract, legal obligation, or consent).
2. Keep a tidy guest book with exactly the prescribed fields — no more, no less.
3. Set up a reliable procedure for reporting residence to the authorities and respect the short deadlines, especially for foreign guests.
4. Write a short bilingual data-processing notice and display it for guests.
5. Lock away paper records, password-protect electronic data, and keep backups.
6. Set retention periods and regularly delete data whose purpose has expired.
7. Ask for consent only for marketing and similar voluntary processing, and make it easy to withdraw.
8. Before the season, verify the current obligations with the municipality, the RS Ministry of Trade and Tourism, and your local tourist organisation.

Handling guest data properly is not an obstacle to hospitality — on the contrary, it is the mark of a serious, trustworthy host that guests can rely on. For more information, consult the Government of Republika Srpska and the Agency for Personal Data Protection of BiH, and for the European framework the official EU pages.