GDPR for Restaurants: The Essentials Explained Simply

Personal data is any information relating to an identifiable person – a name, phone number, email address or even an IP address. In hospitality, such data comes together in many places, often without anyone consciously noticing. Even a phone reservation with a name noted down counts as processing under the GDPR.

• Reservations with name, phone number, party size and sometimes special requests or allergy notes.
• Online orders with delivery or pickup address, contact details and payment information.
• Newsletter sign-ups with an email address and possibly a first name for personal address.
• Guest Wi-Fi access, where depending on the solution device or login data may be recorded.
• Contact forms on the website as well as enquiries via messenger or social networks.
• Video surveillance (CCTV) in the dining area or at the entrance, plus job applications from staff.

The more digital channels you use, the more data sources arise. A sensible first step is therefore to get an overview: which data do we collect, where is it stored and who has access to it? This inventory forms the basis for everything else.

The GDPR is built on a few clear principles. You do not need to memorise them, but their logic helps you act correctly in everyday life. At its heart it is about collecting only the data you really need and handling it transparently. Anyone who internalises this logic usually makes the right call when in doubt.

The most important principles

• Lawful basis: every processing needs a permitted reason, such as consent, a contract (e.g. an order) or a legitimate interest.
• Purpose limitation: data may only be used for the purpose it was collected for – reservation data not for advertising without asking.
• Data minimisation: collect only what is truly necessary and avoid mandatory fields that serve no purpose.
• Transparency: guests must understand in plain terms which data you process and how – this is what the privacy policy is for.
• Storage limitation: data may not be kept longer than the purpose or statutory periods require.
• Security: personal data must be protected against loss and unauthorised access with appropriate technical and organisational measures.

These principles apply across the EU because the GDPR is a European regulation. In Germany it is supplemented in places by the Federal Data Protection Act (BDSG). Which lawful basis fits in a given case cannot be answered in a blanket way – when in doubt, clarify it with the competent supervisory authority or qualified legal counsel.

As soon as you process personal data, you need a privacy policy – usually on your website, easy to find and in understandable language. Among other things, it explains which data you collect for which purpose, how long you store it and which rights guests have. If you use external service providers that process data on your behalf for specific tasks, a data-processing agreement (in German: Auftragsverarbeitungsvertrag, AVV) is added.

1. 1Get an overview of all tools and providers that process guest data on your behalf – such as reservation, ordering, newsletter or hosting providers.
2. 2Check for each of these services whether a data-processing agreement (AVV) is in place; reputable providers offer one and conclude it with you.
3. 3Create or update a privacy policy that truthfully reflects all the services and data types you use.
4. 4Document which processing activities take place in your business – this belongs in your record of processing activities.
5. 5Review the details regularly and adjust them as soon as you introduce new tools or change procedures.

An AVV governs the provider's obligations and ensures that data is processed only on your instructions. Responsibility for complying with the GDPR remains with you as the business – even when the data sits technically with a third party. A legally sound privacy policy should therefore be tailored individually to your business, with qualified support when in doubt.

The GDPR gives guests a range of rights you should be prepared for. If someone makes a request – for access or deletion, for example – you generally have to respond within one month. It helps to have a clear internal process so such requests do not get lost in day-to-day operations.

• Right of access: guests may learn whether and which data you have stored about them.
• Right to rectification: incorrect or outdated data must be corrected on request.
• Right to erasure: if data is no longer needed or the basis is missing, it must be deleted, unless a retention obligation prevents it.
• Right to restriction and to data portability, as well as the right to object to certain processing.
• Withdrawal of consent: a granted consent, for instance for the newsletter, must be easy to withdraw at any time.

Recommended first steps are: an inventory of all data sources, an up-to-date privacy policy, AVV with all providers, sparing data collection and a regulated way of handling requests. Also briefly train your team on how to deal with guest data. This way a solid level of data protection emerges step by step, without everything having to be perfect at once.

A practical part of data protection is order: the more clearly your guest data is organised, the easier responsible handling becomes. gastronomx brings reservations and online orders together in one place, so you no longer have to switch between scattered lists, notes and inboxes. This central overview makes it easier to keep track and respond to requests in an orderly way.

Order creates the foundation

Within the product, reservation and order data is processed in a structured way instead of being spread uncontrolled across many places. That does not relieve you of legal responsibility – the GDPR duties remain with you as the business – but a tidy data basis is a good starting point for clean data protection. Dedicated topics on the privacy policy and on data security go deeper into the individual aspects.

What remains important: gastronomx is a tool, not a substitute for an individual data-protection review. Which lawful bases, periods and wordings apply to your business should, when in doubt, be clarified with the competent supervisory authority or qualified legal counsel. This article offers general orientation and is not legal advice.