SIBA: why your host asks for your details
Reviewed on 15 October 2026, against the law in force that day.
If you don't hold Portuguese nationality and you're staying in paid accommodation in Portugal, your host will ask for your name, your date of birth and your passport or ID card number. They aren't being nosy: the law requires it.
This page explains why, where the details go and when they are deleted. Every rule has the official source next to it.
Why does my host need this?
Portuguese law requires anyone who provides accommodation for payment to report each foreign guest's arrival and departure to the authorities (Lei n.º 23/2007, articles 15 and 16). They do it with an accommodation form (boletim de alojamento), sent through SIBA, the Sistema de Informação de Boletins de Alojamento.
The rule comes from article 45 of the Convention implementing the Schengen Agreement, and every Schengen country has a rule like it. A hotel in Spain, Italy or Germany asks you for much the same.
Foreign means anyone without Portuguese nationality, citizens of other EU countries included. Age doesn't matter: children get a form too, but for a couple with children under age, or a travel group, one adult can fill in and sign for everyone (article 15, no. 3).
What goes on the form?
What the official form asks for, which includes:
- surname and given names
- nationality
- place and date of birth
- ID card or passport number
- home address and country of residence
- dates of arrival and departure
The form doesn't ask why you're travelling, for payment details, or for a photo of your document.
Who receives my details?
The UCFE (Unidade de Coordenação de Fronteiras e Estrangeiros), part of Portugal's Internal Security System. It has run SIBA since SEF, the former immigration and borders service, was closed down in 2023. The purpose is the control of foreign citizens in the country.
According to the UCFE's data-protection notice, the details are not shared with anyone else unless a legal obligation requires it (judicial or administrative authorities), and they are not sent outside the European Union.
Your host only types the details into SIBA. They can't copy or change them there, and once the departure is sent they can see only what they typed themselves.
When are they deleted?
The UCFE keeps the forms for one year, counted from the day after your departure is reported. After that they are destroyed automatically (article 15, no. 5).
If your host uses stay’in, the details you enter in the online form are deleted from stay’in automatically, after a period your host sets.
What are my rights?
Those of the General Data Protection Regulation (GDPR): to access your data, correct it, restrict its processing and ask for it to be ported. You exercise them with the UCFE's Data Protection Officer, by email to UCFE.EPD@ssi.gov.pt or by letter to Av. Defensores de Chaves, 6, 1049-063 Lisboa, Portugal.
If you think your data has been mishandled, you can complain to the CNPD, Portugal's data protection authority.
What if I'd rather not give my details?
A host who doesn't report a guest commits an administrative offence. Fines run from €100 to €2,000, depending on how many forms are missing (article 203).
That's why SIBA's frequently asked questions tell hosts not to accept a guest who refuses to identify themselves. They also point out what's in it for you: in an emergency, the authorities can find you faster.
Where to check
- Lei n.º 23/2007, consolidated version, in the Diário da República (articles 15, 16 and 203, in Portuguese)
- Convention implementing the Schengen Agreement, on EUR-Lex (article 45)
- The UCFE's data-protection notice for accommodation forms (in Portuguese)
- SIBA's frequently asked questions (in Portuguese)
- CNPD, Portugal's data protection authority
This is a summary of the law as it stood on the date above, not legal advice. If anything here doesn't match the law, the law wins.