Data protection (GDPR) for travel and TravelTech companies

It is mandatory, among other cases, when the core activities require regular and systematic monitoring of individuals on a large scale or large-scale processing of special categories of data. Even where it is not mandatory, many travel companies appoint one because of the volume of traveller data they handle.

A prior analysis that is mandatory when processing is likely to result in a high risk to individuals’ rights, for example because it uses new technologies, involves large-scale profiling or covers sensitive data. It identifies the risks and the measures to mitigate them.

Yes, with safeguards: a European Commission adequacy decision, standard contractual clauses or another mechanism provided for in the GDPR, as well as informing travellers. This needs to be checked supplier by supplier.

It must notify the supervisory authority, in Spain the AEPD, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals (article 33 GDPR). If the risk is high, it must also inform the affected individuals without undue delay (article 34). All breaches must be documented internally.

Yes, provided you have a lawful basis, you inform your customers, you sign a data processing agreement with the provider and, where the processing is high-risk, you carry out an impact assessment. Also check whether the provider uses the data to train its models and where it processes it.