GDPR and business travel: avoiding penalties in 2026

Managing travel programs involves handling vast amounts of personal data: bank details, passport numbers, dietary preferences, and medical information. Every booking generates data flows between internal systems, TMCs, airlines, hotels, and rental agencies. The GDPR imposes a strict framework on this processing, and non-compliance penalties can reach 4% of global annual turnover. For Travel Managers, understanding exactly what the regulation prohibits and how to secure the processing chain is no longer optional.

Traveler data: what the GDPR really prohibits

The GDPR does not prevent the collection of traveler data; it strictly regulates its use. Three major prohibitions define the legal framework.

Collection without a clear legal basis : Every piece of data collected must be based on a valid legal ground (performance of an employment contract, legal obligation, or documented legitimate interest). Requesting a passport number for a domestic booking or collecting unnecessary personal preferences can lead to penalties. The rule: collect only what is strictly necessary for the stated purpose.

Unlimited retention : The GDPR mandates proportionate retention periods. Keeping booking data beyond the mandatory fiscal period (generally 10 years for accounting) without a business justification is a violation. Traveler profiles must be purged after an employee leaves, unless there is a specific retention obligation (e.g., ongoing litigation or audits).

Unsecured transfers outside the EU : Transferring personal data to service providers located outside the European Union without adequate protection mechanisms (standard contractual clauses, certification) leads to immediate sanctions. Many travel management tools host their data in the United States or Asia, making this compliance aspect critical.

Sensitive data (health, religion via dietary preferences) requires explicit consent or a justification of public interest. Storing this data without encryption or sharing it without strict access controls increases legal exposure.

Common mistakes that expose your company

Certain practices, rooted in legacy processes, create major legal risks.

Uncontrolled sharing with TMCs : Transmitting your entire employee database to your TMC to facilitate bookings violates the principle of data minimization. Only the data strictly necessary for each trip should be shared. Many TMC contracts include overly broad processing clauses, granting the provider rights for secondary use (statistics, benchmarking) without explicit consent.

Lack of a record of processing activities : The GDPR requires documenting every data processing activity (purpose, data categories, recipients, retention periods, security measures). The absence of this record for travel activities makes it impossible to demonstrate compliance in the event of a regulatory audit.

Non-contractual management of sub-processors : Every service provider with access to traveler data (booking platforms, reporting tools, duty of care solutions) must sign a GDPR data processing agreement defining their obligations. Without this framework, the company remains liable for any violations committed by the provider.

Non-operational data subject rights : Employees have the right to access, rectify, erase, and port their travel data. Failing to implement a process to handle these requests within the legal timeframe (1 month) exposes the company to penalties. An employee must be able to obtain their full booking history and correct any inaccurate information.

Insufficient security : Storing traveler data in shared Excel files, unencrypted email inboxes, or consumer-grade cloud tools (personal Dropbox, non-business Google Drive) constitutes a major security flaw. The GDPR requires technical and organizational measures appropriate to the level of risk.

Map data flows across your travel chain

Compliance begins with visibility. Precisely identifying which data is circulating, between which systems, and for what purposes allows you to detect risk areas.

Step 1: Inventory collection points

List every instance where personal data is collected: travel request forms (internal tools, TMCs), traveler profiles (preferences, loyalty programs), payment data (corporate cards, reimbursements), and duty of care information (emergency contacts, allergies). Each collection point must be documented with its specific purpose.

Step 2: Trace flows between systems

Map out the data journey: from the employee to the booking tool, from the tool to the TMC, from the TMC to suppliers (airlines, hotels), and from suppliers to reporting or invoicing tools. Identify any transfers outside the EU and any intermediate storage.

Step 3: Qualify the stakeholders

For each flow, determine the GDPR role: the company is the data controller (decides the purposes), the TMC is the data processor (processes on behalf of the company), and airlines are joint or independent controllers depending on the case. This classification determines contractual obligations.

Step 4: Evaluate retention periods

For each data category, define a justified retention period: booking data (tax requirements), traveler profiles (duration of employment contract + statute of limitations), and payment data (banking regulations). Any deviation poses a risk.

This mapping feeds into the GDPR record of processing activities and serves as the foundation for your compliance audit.

Secure transfers to TMCs and service providers

The relationship with travel service providers is a primary source of non-compliance risk. Three levers help structure your security.

Strict GDPR contractualization : Every contract with a TMC, booking platform, or travel management tool must include a GDPR data processing addendum (Article 28) defining: the categories of data processed, authorized purposes, security obligations, breach notification procedures, conditions for sub-processing, and audit terms. Without this framework, the company cannot demonstrate compliance.

Mechanisms for transfers outside the EU : If a provider hosts or processes data outside the European Union, three legal mechanisms exist: Standard Contractual Clauses (SCCs) approved by the European Commission, Binding Corporate Rules (BCRs) for international groups, or an adequacy decision (countries recognized as offering a sufficient level of protection). Since the Privacy Shield was invalidated, transfers to the United States require SCCs reinforced by an impact assessment.

Access restriction and encryption : service providers must only access data strictly necessary for their mission. A TMC does not need access to all HR data. Sensitive data (health, emergency contacts) must be encrypted in transit and at rest. Access must be tracked and audited regularly.

Negotiate portability clauses that allow for the retrieval of all data in the event of a change in service provider, and secure deletion commitments at the end of the contract.

Compliance audit: the Travel Manager's checklist

A structured travel GDPR audit covers six critical dimensions.

Legal basis and purposes : verify that each piece of collected data is based on a documented legal basis and that the purposes are clearly defined and communicated to employees. Privacy notices (GDPR Articles 13 and 14) must be accessible at the time of collection.

Record of processing activities : ensure that all travel-related processing activities are documented in the register: bookings, profile management, reporting, duty of care, and invoicing. Each entry must specify data categories, recipients, retention periods, and security measures.

Sub-processing contracts : audit all contracts with travel service providers to verify the presence and compliance of GDPR clauses. Identify contracts to be renegotiated and non-compliant providers to be replaced.

Rights management : test procedures for handling requests to exercise rights (access, rectification, erasure, portability). Simulate an access request and measure the response time and the completeness of the information provided.

Technical security : evaluate data protection measures: encryption of data flows and storage, access and authorization management, operation traceability, backup and restoration procedures, and incident response plans. Identify vulnerabilities (unsecured files, overly broad access, lack of encryption).

International transfers : list all data flows outside the EU and verify the presence of adequate protection mechanisms (SCCs, BCRs, adequacy decisions). Document impact assessments for transfers to high-risk countries.

This audit must be conducted annually and after every major change (new provider, new solution, regulatory evolution).

Strategic Conclusion

GDPR compliance for travel programs is not an isolated legal exercise, but a structural operational requirement. Travel Managers must map data flows, secure transfers to service providers, and maintain an up-to-date record of processing activities. The financial and reputational risks of a breach justify investing in robust processes. The key: treat compliance as a provider selection criterion, integrate GDPR clauses into all contracts, and regularly audit practices. Companies that anticipate these requirements turn a regulatory constraint into a competitive advantage by strengthening employee trust and reducing their legal exposure.