8. THE DATA PROTECTION PLAYBOOK

The Professional Hospitality Business's Complete Guide to UK GDPR, the 2026 Reforms & ICO Compliance

Every hospitality business is quietly a data business, a booking system, a loyalty scheme, CCTV over the till, and an allergy note attached to a reservation, which is legally health data whether anyone realises it or not. This guide covers UK GDPR and the significant 2026 reforms landing through the Data (Use and Access) Act in plain language, then gets specific about the decisions every hospitality business actually has to make: choosing a lawful basis, handling marketing consent properly, running CCTV without overreach, and treating allergy data with the extra care the law requires. It covers the 72-hour breach response clock, working safely with third-party booking and marketing platforms, and responding to a subject access request under the new rules. The toolkit includes a privacy notice template, a data breach response log, and a subject access request log.