Yunnan's New Hotel Security Rules Take Effect on October 1: Four Checks General Managers Should Complete First

Yunnan Province has issued revised rules on public-security administration for lodging businesses, effective October 1, 2026. The rules apply within Yunnan to businesses that receive overnight guests, including hotels, guesthouses, inns and other covered lodging operations.

The easiest mistake is to treat the change as a front-desk registration update. Guest identity checks and accommodation records are important, but the rules also cover licensing information, visitor registration, the protection of minors, security patrols, public-area video systems, prevention of hidden recording devices, personal-information controls, staff training, incident reporting and preservation of the scene after an incident.

This is therefore not a front-office-only project. Before October 1, a general manager should review four connected lines of responsibility: guests and visitors, systems and privacy, premises and security, and management and training. The purpose is not merely to complete a checklist. It is to confirm that every critical scenario has a person responsible for making the judgement, carrying out the action, escalating the issue and verifying closure.

1. Check whether guest, visitor and minor registration covers real scenarios

The rules require lodging businesses to verify guest identity, accurately register the required information and upload accommodation data through the designated public-security information system in real time. Additional information is required for guests from outside mainland China. If a special circumstance prevents timely upload, the business must report it immediately, keep the information on record and upload it after the problem has been resolved.

A front-office review should therefore test more than a normal check-in. At minimum, it should cover a guest with valid identification, a temporary system outage, a visitor entering a guestroom and a minor checking in.

Before a visitor enters a guestroom, the hotel must obtain the registered guest's consent, verify the visitor's identification and record the visitor's identity information. Two control failures are common in practice: consent is obtained verbally but not recorded, or night shifts, executive-floor arrangements and group movements bypass the standard process. The hotel should define who confirms consent, who records the visitor, where the record is retained and who decides when a situation is abnormal.

For a minor checking in, registration alone is not enough. The hotel must ask for the contact details of a parent or other guardian and record the relationship between the people staying. The rules also identify circumstances that require immediate reporting to the local public-security authority, protective action and contact with the minor's guardian.

Staff should not be left to make these decisions from instinct. Hotels should distinguish normal registration, supervisor review and immediate reporting, then train employees with realistic scenarios rather than requiring them only to memorise the rule.

1. Check whether system-outage and privacy procedures can actually be executed

Real-time upload is the normal requirement, but management capability is tested when the system is unavailable. The hotel should decide in advance who confirms the outage, who reports it, how temporary records are created, where they are stored, who may access them, who uploads the information after recovery and who verifies that the upload is complete.

Without a defined process, employees may photograph identification documents with personal phones, share guest details in open chat groups or leave paper records unsecured at reception. These actions may appear to keep check-in moving, but they create a separate personal-information risk.

The rules prohibit misuse or disclosure of guest personal information and video data. Hotels should therefore review both access rights and audit trails. Which roles genuinely need access? Are permissions removed after transfer or departure? Are exports and printouts controlled? Can unusual searches be traced? Are visitor and minor records retained only to the extent necessary?

The general manager does not need to design the technology personally. The manager does need the front office, information-system or data owner, security team and human resources team to confirm one access matrix and test one outage scenario.

1. Check whether on-site security actions produce evidence

The rules require daily security patrols covering floors, entrances and video monitoring, together with records of inspections and corrective actions. They also require appropriate maintenance of public-security video systems, measures to prevent voyeuristic, covert recording or listening devices in guestrooms and other areas, and preservation of the scene when an incident occurs.

The real test is not whether a patrol form exists. A general manager can select one night shift and follow the route employees actually use. Are blind spots included? Would an equipment failure be noticed? If a suspicious device is found, do employees know not to disturb it, to protect the scene and to report immediately? Does every corrective item have an owner and evidence of closure?

Security records should also support one another. Maintenance, patrol, corrective-action and training records may all exist, yet still fail to show how a single issue was detected, handled and verified. In that case, the control chain remains incomplete.

Fire safety, building safety, food safety and other regulated areas remain subject to their own laws, standards and technical requirements. A public-security review does not replace professional fire, structural or other specialist inspections.

1. Check whether licences, training and accountability withstand questioning

The revised rules require a special-industry licence for covered lodging operations and identify supporting materials including the business licence, identity documentation for the legal representative or principal, proof of ownership or use of the premises, information on necessary safety facilities, a location map and an internal plan showing entrances, passages and safety exits.

Existing hotels should check whether their records still match their actual operation. Changes such as closure, conversion, merger, relocation or a change of name may trigger filing obligations. Management should know who holds each record, who monitors its status and who decides whether a business, name, layout or right-of-use change requires a filing or other action.

Training cannot be completed by circulating a document for signature. Front-office staff need to understand registration and abnormal-situation recognition. Security staff need to understand patrols, scene protection and reporting. The system or data owner needs to understand access and outage controls. Human resources must include new employees, night shifts and outsourced roles. The general manager must verify that escalation works across departments.

Scenario questions are more useful than asking whether everyone has read the policy. Who is the first person called when information cannot be uploaded? What happens when a visitor wants to enter a room but the guest cannot confirm consent? Can an employee move a suspected hidden camera? Who reports when an adult cannot reasonably explain a relationship with a minor? Different answers across shifts show that the policy has not yet become an operating control.

A seven-day minimum test

On day one, appoint one owner for the four workstreams and name the responsible people in front office, security, systems or data, human resources and the general manager's office.

On days two and three, sample ten recent guest, visitor or minor-related records. The purpose is not to declare perfect compliance. It is to find breaks between registration, consent, reporting and retention.

On day four, simulate a temporary outage of the accommodation information system. Record the sequence from detection and reporting to temporary recording, protection of information, recovery, upload and verification.

On day five, test three scenarios across different shifts: a suspicious visitor, an abnormal minor-related situation and a suspected hidden recording device in a guestroom. Compare whether employees reach the same escalation decision.

On day six, cross-check licensing records, layout plans, safety facilities, patrol records and training records against the actual operation.

On day seven, produce one red-amber-green list. Red items require the practice to stop and the issue to be confirmed with the competent authority or a qualified professional. Amber items have a policy but insufficient execution evidence. Green items require a policy, a named owner, a record and a verified sample result.

The four-line review

Guests and visitors: guest identification, overseas-guest information, visitor consent and registration, records concerning minors, abnormal-situation recognition and reporting.

Systems and privacy: real-time upload, outage reporting and later upload, temporary-record protection, access rights, exports, printing and traceability of unusual access.

Premises and security: floor, entrance and video patrols, equipment maintenance, prevention of covert recording, corrective actions, incident-scene protection and matters requiring immediate reporting.

Management and training: licences and supporting records, change-filing decisions, accountability, new-employee and night-shift training, outsourced roles, cross-department escalation and general-manager verification.

Scope and limitations

This article is based on the regulation issued by the People's Government of Yunnan Province and effective October 1, 2026. It is intended to help lodging operators in Yunnan organise an internal review. Hotels outside Yunnan should verify the rules in their own jurisdiction. Questions concerning licences, enforcement, personal information, minors, fire safety, building safety or other legal matters should be confirmed with the competent local authority or qualified legal counsel.

A hotel cannot promise that risk will never occur. It can make sure that when a risk appears, employees know what to do, who decides, when to report and how to preserve evidence. Before October 1, the most important action for a general manager is not to circulate another notice. It is to test whether the four lines of responsibility are genuinely connected.