Guide · guests and the law

Guest data and UK GDPR for restaurants: what you may keep, and for how long

A restaurant collects more about its guests than it thinks: names and numbers for bookings, years of visits, notes on who sits where, allergies, and sometimes a yes to the newsletter. Each of those has its own rule under UK GDPR. Sort them, and the rules become short.

Published 4 November 2026 · A practical guide for UK restaurants, from the Information Commissioner's Office's guidance. Not legal advice.

Four kinds of guest data, four rules

What the booking needs

Name, party size, date and time, and a way to reach the guest if something changes. You collect it to run the booking, so use it for that, and do not let it quietly become a mailing list.

What you learn over time

Visits, the favourite table, the guest who always arrives late, the regular who never shows on a Friday. Useful for service, and personal data all the same: keep it accurate and keep it only as long as it helps.

What tells you about health

Allergies, intolerances, a wheelchair, a pregnancy mentioned at booking. This is the data with the strictest rule, covered below.

What the guest agreed to receive

A yes to offers by e-mail or text. It belongs to the guest who gave it, can be withdrawn at any time, and decides who may receive your newsletter.

How long you may keep it

UK GDPR's storage limitation principle says personal data is kept no longer than is necessary for the purposes it is processed for (Article 5(1)(e)). The ICO is clear that the law sets no specific time limits for different kinds of data: the periods are yours to set, based on why you hold the data.

So write the periods down. A short retention policy can say, for example, that booking contact details are kept for a set time after the visit, that visit history is kept while the guest keeps coming, and that a guest who has not visited for a set period is erased or anonymised. The ICO asks for standard retention periods wherever possible, a regular look at what you hold, and erasure or anonymisation when you no longer need it. The right period for your restaurant is a judgement; having one, and keeping to it, is the requirement.

Allergy notes are the sensitive part

Data concerning health is special category data under UK GDPR, and the ICO's test is whether the information reveals something about a person's health status. A note that a guest has a nut allergy or coeliac disease is likely to do that; a preference for no onions probably does not. Treat allergy and medical notes as health data unless you have a clear reason not to.

Special category data needs two things: a lawful basis under Article 6, like any personal data, and a separate condition under Article 9. Explicit consent is one of the Article 9 conditions, and for a guest telling you about an allergy so that the kitchen can cook safely it is a natural fit: ask, record that the guest told you and agreed, and use the note for their meal. The ICO also asks for a data protection impact assessment before processing that is likely to be high risk, and says that if in doubt you should carry one out.

Keep allergy notes where the people who cook and serve will see them, and nowhere else: on the guest's card, on the booking and in the pre-service briefing, rather than in a shared spreadsheet or a group chat. Our guide to recording allergies at booking covers the service side.

Marketing e-mails and texts

Sending offers by e-mail or text is governed by the Privacy and Electronic Communications Regulations as well as UK GDPR. The ICO's guidance says you may send electronic marketing to an individual only if they specifically consented to it from you, or if the "soft opt-in" applies: they are an existing customer who bought, or negotiated to buy, a similar product or service from you, and you gave them a simple way to opt out both when you collected their details and in every message since.

The safest practice for a restaurant is a separate, unticked box at booking — "send me news and offers" — recorded with the date, and an unsubscribe link in every message. If you rely on the soft opt-in instead, check that the opt-out really was offered when the details were collected. The ICO says its PECR guidance is being revised after the Data (Use and Access) Act 2025, so check the current page before you plan a mailing.

When a guest asks for their data

Recognise the request
A subject access request can be made verbally or in writing, including on social media, and needs no special words. The member of staff who takes the call should know to pass it on.
Answer within a month
Respond without undue delay and within one month of receiving it. The ICO allows up to two further months where a request is complex or a person has made several.
Search sensibly, and send it all
Make a reasonable and proportionate search: the booking system, the guest card, e-mails about the booking. In most cases you cannot charge a fee.
Erase when asked, where you can
A guest may also ask you to erase their data, again verbally or in writing, with the same one-month clock. The right applies when, for example, you no longer need the data or the guest withdraws consent; it gives way where you must keep something by law. Note what you erased and when.

Two pieces of housekeeping

Organisations and sole traders that use personal information pay the ICO's data protection fee unless they are exempt, under the Data Protection (Charges and Information) Regulations 2018. Check whether you have paid it and whether it has been renewed.

And publish a privacy notice your guests can read: what you collect at booking, why, how long you keep it, and how to ask for it or have it deleted. It is the document that makes every other part of this guide visible to the people it is about.

How Slotina keeps the four apart

The guest book lists every guest and filters by tag, visits, last visit, no-shows and marketing consent; the mailing export holds only the guests who said yes to marketing.
Slotina itself sends no marketing: the guest book is a list you export, and what you send stays your decision.
Allergies and access notes sit on the guest's card, show as an alert on their booking and appear in the pre-service briefing, where the kitchen and floor need them.
From the guest's card the owner or a manager downloads one guest's data for an access request, or erases the guest; below that level the card does not show the guest's e-mail or phone.
Every change is recorded with who made it and kept for two years, so you can show what happened to a guest's data and when.

Join the early-access list

Restaurant guest data: short answers

How long can a restaurant keep guest details under UK GDPR?

No longer than it needs them. UK GDPR sets no fixed period, so write your own retention periods down, keep to them, and erase or anonymise data you no longer need.

Is a guest's allergy information special category data?

Often, yes: health data is special category data when it reveals something about a person's health status, and an allergy or medical condition usually does. It needs an Article 9 condition, such as explicit consent, as well as a lawful basis.

Can I e-mail offers to everyone who has booked?

Only if they consented, or the soft opt-in applies: an existing customer, a similar product, and a simple opt-out offered when you collected their details and in every message. A separate tick box at booking is the clearest route.

How quickly must I answer a guest who asks for their data?

Without undue delay and within one month, extendable by up to two more months for complex requests. In most cases you cannot charge for it.

Sources (Information Commissioner's Office, checked 4 November 2026; not legal advice)

The guest book, and the GDPR request answered in a minute · Guest profiles · Pricing

Recording allergies at booking · All guides