A Guest Just Asked for Their Data. Here's How to Answer in Minutes, Not Weeks.

You already collect guest details in familiar places: your guest WiFi login, email platform, booking system or till. But if someone asks, “What data do you hold about me, and can I take it with me?”, how quickly could you answer?

If the answer involves searching inboxes, chasing different suppliers and piecing together consent records, you’re not alone. But you can make this process far more straightforward.

A clear picture of where your guest data lives, and a practical way to export it, helps you respond confidently, protect trust and show that your customer data is managed responsibly.

A note on legal guidance: This article is for general information, not legal advice. GDPR obligations depend on your circumstances and how you process personal data. Check your approach with your own adviser.

Know what data portability means

Under Article 20 of the GDPR, a person may have the right to receive certain personal data they provided to an organisation in a structured, commonly used and machine-readable format. They may also ask for it to be sent directly to another organisation, where that is technically feasible.

In practical terms, that could mean an export such as a CSV file. XML and JSON are other machine-readable formats.

The right applies when the relevant processing is automated and based on the person’s consent or a contract. It is not a general right to receive every piece of information a business holds. Article 20 is also distinct from the right of access, which can cover a broader range of personal data and information about how it is used.

For a venue, a guest who gave you an email address through a guest WiFi splash page may be asking about data processed under these conditions. Whether a particular record qualifies depends on the purpose and lawful basis for processing it.

Make the consent record easy to find

An email address is only part of the story. You may also need to establish what the guest agreed to, when they agreed to it and which communication purpose they selected.

That is much easier when the choice was clear at the point of collection and the record was stored with a timestamp. If you’re searching for a screenshot, an old form or a message from a colleague, responding becomes slower, and it’s harder to demonstrate what happened.

A privacy-conscious guest WiFi sign-up should make each choice clear. Marketing consent should be separate from access to WiFi where appropriate, and the marketing checkbox should not be pre-ticked. Keep a record of the guest’s selection and the time it was made.

Fydelia’s GDPR compliance features are designed to support explicit consent and a timestamped audit trail. That gives your team a clearer starting point when a guest asks about their information.

Map every place guest data lives

Your WiFi platform may capture an email, but it might not be the only place that information ends up. It could also flow into your email marketing platform, booking system, CRM, POS or another connected service.

Before a request arrives, make a simple list:

• Which systems collect or store guest data?
• What information goes into each one?
• Which system holds the original consent record?
• Can you export the relevant data without asking a supplier to do it for you?
• Who in your team is responsible for coordinating a response?

This does not mean every request automatically requires a full export from every system. It means you know where to check, can understand the scope of the request and avoid starting from scratch.

For connected tools, Fydelia’s integrations page explains how guest data can flow to marketing, CRM, booking and analytics platforms. Knowing which connections you use is part of knowing where information goes.

Choose your export route before you need it

CSV is a practical, widely used format for many contact records. Decide in advance what you will use, and check whether your guest WiFi platform lets you export a guest record or list directly.

Fydelia’s email capture feature describes exporting captured email lists as CSV. Having a workable export route means your team can focus on checking the request and preparing the right information, rather than manually rebuilding a file from scattered records.

A portability request can also ask for a direct transfer to another organisation, where technically feasible. If that is requested, confirm what can be transferred, how it can be transferred securely and whether the other organisation can receive it in a compatible format.

Respond on time, and keep a simple log

The Irish Data Protection Commission says that valid access or portability requests should be answered without undue delay and, at the latest, within one month. An extension of up to two further months may be possible for complex requests or numerous requests from the same person, but the individual must be told within the first month and given the reason.

For UK organisations, check current ICO guidance on data portability. The ICO guidance also sets out the one-month timeframe and the conditions for an extension.

Put a basic request log in place. Record when the request arrived, who is handling it, which systems were checked, what was provided and when you responded. If you need clarification or identity checks, handle those proportionately and avoid letting them become a reason to delay unnecessarily.

The Data Protection Commission’s guidance on access and portability is a useful reference for distinguishing these rights and understanding response timelines.

Treat portability as a sign of good data management

A quick, organised response does more than help you meet a deadline. It shows guests that you take their information seriously. It also helps you see that the customer data you collect is not trapped in a supplier’s system: you can find it, understand its consent history and move it in a usable format when appropriate.

That matters to your marketing, too. A clean, properly consented guest list is more useful than a larger list with unclear permissions. When consent records are available and exports are straightforward, you can make better use of the information guests chose to share, without guessing how it was collected.

Fydelia’s platform is designed with privacy controls such as separate, unticked consent choices, timestamped audit records, UK hosting and encryption. These features can help make data handling more organised and support portability, but they do not remove your responsibility to decide how you use personal data and respond to requests.

Get ready before the next request arrives

You do not need a complicated policy or a long technical project to make a start. Identify the systems that hold guest data, confirm how to export it, keep consent timestamps accessible and assign someone to log incoming requests.

Then write down the steps your team will follow. The next time a guest asks for their data, you’ll have a clear process instead of a scramble.

Want to see how guest WiFi capture, consent records and exports could fit into your venue’s setup? Book a straightforward Fydelia tour.