Can I ask my guest for their ID? What Portuguese law actually says

Mar 23, 2026

Verified against Lei n.º 23/2007 (consolidated to Lei n.º 61/2025) and the official SIBA guidance, September 2026.

The Short answer

Yes, you can. For foreign guests you must.

Reporting your guests' identification details is not a preference, a house rule, or something your booking platform invented. It is an obligation created by articles 15 and 16 of Lei n.º 23/2007, and it falls on anyone who provides paid accommodation to foreign citizens. That includes Alojamento Local, a single room, and an apartment let for a weekend.

This matters more than it sounds, because it changes the conversation with a difficult guest. You are not asking permission. You are discharging a legal duty, and the guest cannot waive it for you.

Who should I report?

Foreign guests only, including EU citizens.

The wording of article 15 is specific: a boletim is completed for each foreign citizen, "incluindo os nacionais dos outros Estados membros da União Europeia". A French, German or Spanish guest is reportable exactly like a Brazilian or American one.

Portuguese nationals are not reportable to SIBA. This is the single most common mistake in guides written for hosts, and it works in both directions: hosts who report Portuguese guests are collecting data they have no legal basis to collect, and hosts who assume EU citizens are exempt are missing most of their bookings.

Children are reported too. The obligation applies regardless of age. A minor does not have to sign their own boletim: article 15(3) allows one spouse, a parent, or a representative of the travel group to complete and sign on behalf of accompanying minors and family members.

What should you collect from a guest or their group

Less than most hosts think. The electronic submission requires these fields per guest, and nothing more:

Surname
Given names (optional for guests with a single name)
Nationality
Date of birth
Place of birth (optional)
Identification document number
Document type (passport, ID card, other)
Country that issued the document
Date of entry
Date of departure
Country of residence
Place of residence

Notice what is not on this list. No photograph. No image of the document. No signature scan. No home street address. If you are collecting more than the fields above, you are collecting more than the law asks for, and you are carrying the risk for the difference.

When should the above list be collected?

Three working days after check-in. Then, separately, three working days after check-out.

The departure notification is the one hosts forget. It is a distinct obligation under article 16(2), with its own deadline, and forgetting it is just as reportable as forgetting the arrival.

The clock counts in whole days from the date of accommodation or departure, not from the hour. A guest who arrives at 23:00 does not consume a day of your deadline.

One inconsistency worth knowing about: the official paper form still prints an instruction saying "3 dias", plain days, while the statute says "três dias úteis", working days. The statute governs. Work to working days, but do not be surprised by the government's own form contradicting it.

Who recieves or checks the guest details after sending?

This is where almost every commercial guide is now wrong.

The boletim is communicated to the GNR or the PSP. The SIBA system itself is operated by the UCFE, the Unidade de Coordenação de Fronteiras e Estrangeiros, which sits within the Sistema de Segurança Interna. AIMA's only role is to apply the fines.

Since SEF was extinguished in October 2023, many articles and several software vendors have told hosts that AIMA inherited SIBA. It did not. If a guide tells you that you are submitting data to AIMA, that guide has not been updated since 2023, and you should treat the rest of it with the same suspicion.

What not to do

Do not keep a copy of the document.

This is the part hosts get wrong most often, usually with good intentions, and it is the part that gives a privacy-conscious guest a genuine reason to object.

For a Portuguese Cartão de Cidadão, the rule is explicit. Lei n.º 7/2007 prohibits retaining the card and separately prohibits reproducing it by photocopy or any other means without the holder's consent. Breaching this is punishable by a fine of 250 to 750 euros, enforced by the IRN. Consent is a route through it, but only real consent: the guest must have a genuine alternative, which means you offering to read the fields from the card and hand it straight back.

For passports and foreign ID cards there is no equivalent Portuguese prohibition. The constraint there is data minimisation. Since SIBA needs only the transcribed fields listed above, an image of the document is by definition more data than your legal obligation requires, which makes it very hard to justify keeping.

You also cannot hold on to the physical document. Only police and judicial authorities have the power to retain someone's identification.

The safe practice, for every nationality, is the same: read the fields, transcribe them, hand the document back, keep no image.

What happens if a guest refuses to give ID or Passport

The official position is blunt: a guest who refuses to identify themselves should not be accommodated.

That is easy to say and hard to do at 23:00 with a booking already paid. So here is the sequence that actually works.

First, remove yourself from the argument. The single most useful sentence you can say is that the request does not come from you. Most resistance is not about privacy in the abstract, it is about a stranger asking for a passport. Naming the law changes what the guest thinks they are refusing.

Second, be specific. "It's the law" invites an argument. "Article 16 of Lei 23/2007 requires me to send your name, nationality, document number and dates to the GNR within three working days" ends one. Specificity reads as competence.

Third, say what you are not doing. Tell them you will not photograph or keep the document, that the data goes only to the police, and that nothing is used commercially. This answers the fear underneath the objection, which is almost never about the police and almost always about what a random host does with a passport scan.

Fourth, do it in writing, before arrival. A request that lands three days early, in the guest's own language, reads as procedure. The same request at the door reads as suspicion. This is also why automating it matters: not to save the typing, but to stop the ask coming from you personally at the worst possible moment.

How to handle when guests refuse, 4 situations with resolutions:

"You cannot ask for this under GDPR."

The opposite is true. GDPR expressly permits processing that is necessary to comply with a legal obligation, at article 6(1)(c). That is the basis here. GDPR is not a rule against collecting data, it is a rule about having a reason. This is a reason.

"I do not consent."

Consent is not the basis, so there is nothing to withdraw. Where a statute requires the processing, a guest declining does not remove your duty, and there is no right to object to processing carried out under a legal obligation.

"No other country asks for this."

Most of Europe does. The obligation traces back to article 45 of the Schengen Implementing Convention, which is why you will meet the same request in Spain, Italy and France.

"Why do you need my passport if I already gave everything to Booking.com?"

Because the platform is not the accommodation provider. The duty in article 16 falls on the person providing the accommodation, and platforms do not transmit boletins to the GNR on your behalf.

What happens if I dont report a guest?

Failure to communicate is an administrative offence under article 203, fined by volume:

1 to 10 missing boletins: 100 to 500 euros

11 to 50 missing boletins: 200 to 900 euros

More than 51: 400 to 2000 euros

Where the failure is negligent lateness rather than outright omission, the minimum and maximum are reduced to one quarter. Fines are applied by AIMA.

It is worth seeing the asymmetry clearly. The exposure for failing to collect and report is far more likely to land than any penalty for over-collecting. That is not an argument for keeping passport scans, but it does tell you where to put your attention first.