Is it safe to send my ID to a hotel or an Airbnb host?
Only if you limit the visible data and mark the copy. Accommodation in Spain is required to register guest details, but that doesn't mean handing over a clean photo of your DNI (Spanish national ID): a copy with the unneeded data covered and the property's name across the image gets the job done without giving away your identity.
- Published:
- Reviewed:
- Editorial responsibility:
- Ofuska
- Jurisdiction:
- Spain
Why they ask for it
Hotels, tourist apartments and hosts must report their guests' details under Spain's traveller registration rules. Many handle it by asking for a photo of your ID over WhatsApp or email before check-in.
The problem isn't the registration — it's the copy. That photo ends up on a receptionist's phone, in an unencrypted email or in a shared folder, and nobody guarantees when it gets deleted.
The real risk
A leaked clean copy of your ID can be used to open accounts, take out payday loans or sign up to betting sites in your name. Accommodation providers handle thousands of copies and are a frequent target for leaks.
How to send it with Ofuska
- 1
Store
Your DNI stays encrypted on your phone, ready to generate copies in seconds.
- 2
Redact
Use the brush, rectangles or a reusable mask to cover the signature, support number and MRZ. The What to hide guide lists what the register needs.
- 3
Trace
Generate the copy with a "Hotel X, date" mosaic. If the required pixels and local history survive, Verify Copy can link it to that send.
Verify Copy can link a PNG or JPEG to a copy stored on this phone if the image still contains the watermark. The app tells you whether it found a current watermark, an older one or none it can verify. PDFs cannot be checked directly.
Safer sharing guide →
What to show and what to hide at check-in
First, what the law says: they can ask for your details, not a copy of the document. The Spanish Data Protection Agency (AEPD) stated in June 2025 that accommodation providers cannot demand a copy of your DNI or passport; a visual check or the traveller registration form is enough.
If remote check-in requires an image anyway, send a copy with only what Royal Decree 933/2021 (RD 933/2021) obliges them to register:
Show
- Full name
- Sex
- Date of birth
- Nationality
- Document type and number
- Support number
Hide
- Photo
- Signature
- CAN
- Expiry date
- Printed address*
- Place of birth and parents' names
- Full MRZ
*Your address, phone and email go in the traveller registration form; they do not need to be readable on the image. With a passport: show your name, number, nationality, date of birth and sex; hide the photo, signature, place of birth, issuing authority, expiry date and MRZ.
Glossary: MRZ, CAN, CIP and other terms →Frequently asked questions
- Can a hotel demand a photocopy of my ID?
- They must register your details, and they can take them from the document at the front desk. If they ask for a copy in advance, nothing stops you sending it with the unneeded data covered and a mark with the property's name and the date.
- What if the hotel rejects the redacted copy?
- It's rare: the registration data is still visible. If they insist on a clean copy, at least send it with the recipient mosaic — and your history will record who received it and when.