GDPR for Restaurants: What Staff and Guest Data Requires
What personal data a restaurant actually holds, the lawful bases that apply, retention periods, and what staff access should look like.
Last reviewed .
Restaurant data is usually modest in volume and unusually sensitive in kind. Staff records hold health and demographic information; guest records hold dietary and allergy data. It is not a high-target breach category, but it is one where the compliance failures are obvious and easy to fix.
What you actually hold
- Staff — identity, contact, contract, payroll, bank, right-to-work documents, and often health information such as allergies or disabilities.
- Guests — contact details, booking history, spend, and dietary or allergy notes captured at the table.
- Supplier staff — delivery contacts and vehicle details.
- Surveillance — CCTV in public areas, and increasingly in kitchen pass areas.
Lawful basis: choose per purpose, not once
The common mistake is picking one basis for everything. Most operations need three or four, and they are not interchangeable:
| Purpose | Likely lawful basis | Note |
|---|---|---|
| Payroll and employment | Contract / legal obligation | Statutory retention periods apply |
| Right-to-work checks | Legal obligation | Must be retained as specified |
| Accident and incident records | Legal obligation | Can be retained beyond employment |
| Allergen information about a guest | Consent | Must be voluntary and specific |
| Staff dietary requirements | Consent or contract | Never make it a condition of employment |
| Marketing email | Consent | Must be opt-in, with a working unsubscribe |
| CCTV | Legitimate interests | Requires signage and a retention period |
Allergen data is special
Dietary and allergy information about a guest is some of the most sensitive data a restaurant holds. A serious allergy can be fatal, and disclosure implies a high level of trust.
Practical requirements:
- Collect it voluntarily and specifically. Do not make a guest disclose an allergy to be seated.
- Explain what happens to it — in practice, 'we use it to inform the kitchen and flag the table'.
- Store the minimum: an allergy note on a booking, not a full dietary profile retained indefinitely.
- Restrict access to staff who need it for service. It does not belong on a shared screen visible to the whole team.
- Delete it when it is no longer needed. A five-year-old allergy note has no ongoing purpose.
Access control
Most restaurant data breaches are not hackers — they are a tablet left on a pass, a shared login, or a spreadsheet emailed around.
- Individual accounts. No shared logins, ever — shared logins make the access logs meaningless.
- Role-based access: a server sees the tables they are serving, not the whole guest database.
- Lock or sign out devices left unattended.
- Do not put guest data into personal messaging apps. It ends up in backups you cannot delete.
- Review access on a schedule and on every role change.
Subject access requests
A guest or former staff member can ask for everything you hold about them. You have one calendar month, and it usually means exporting from whatever system holds it. Know where your data lives — booking platform, payroll provider, POS, spreadsheets — before you need to.
Retention
- Guest booking data — delete when no longer needed. Generally not indefinite.
- Invoices and tax records — the statutory period, whatever that is in your jurisdiction.
- CCTV — typically 14 to 30 days unless an incident justifies more.
- Accident records — longer than employment; they outlive the relationship.
- Staff records — statutory period after employment ends.
- Marketing consent records — keep the evidence of consent, not just the fact of it.
Breach response
If personal data is lost or exposed, you may have to notify the supervisory authority within 72 hours. The practical requirements are a written record of what happened, when, what data, and what you did — which means the decision does not need to be made instantly, only recorded quickly.
Know in advance who decides whether a breach is reportable. In a small operation this is often unclear until the moment it matters.
The practical minimum
You do not need a large compliance programme. You need individual accounts, role-based access, a written retention schedule, a current privacy notice, and a named person who can answer a subject access request. That covers the majority of real findings.