How Sabre and Amadeus Are Dealing with New EU Privacy Rules

by Daniel McCarthy
How Sabre and Amadeus Are Dealing with New EU Privacy Rules


The new European Union General Data Protection Regulation (GDPR), which will officially go into effect on May 25, two years after being adopted by European Parliament, will impact businesses both inside and outside of Europe, including travel agencies around the world.

Two of the largest distribution systems in the world, Sabre and Amadeus, spoke with Travel Market Report about what this means for them and what agents should know about the GDPR and how it impacts their GDS dealings going forward.

“Sabre takes privacy and data protection very seriously,” Sabre Data Privacy Officer David McKinney told Travel Market Report.

According to McKinney, Sabre has formed a “cross-functional project team and dedicated significant global resources” to deal with the implementation of the new rules. That includes adopting new legal requirements that will satisfy new GDPR requirements, and putting out new customer and supplier contracts to address the new rules.

“Where necessary, we have refined our system capabilities to accommodate new data subject rights request and revised in-scope policies," McKinney said. "We monitor the evolving regulatory landscape and will implement additional changes as appropriate.”

McKinney explained that Sabre has also put together a new website that will answer questions from customers about the new rules, including how Sabre is training its own employees on the GDPR, and a new dedicated email address to answer questions and concerns from customers.

Amadeus, which serves more than 195 countries on more than 948 million key billed travel transactions each year, said that it will comply with all GDPR rules on its hospitality website.

“Amadeus will comply with the contractual obligations it has with Customers and with direct responsibilities it may have as a Data Processor under the GDPR, this will include ensuring the appropriate organizational and technical measures in place to protect the Personal Data,” its website reads, though it says that it cannot confirm that any of its products or services are compliant.

Amadeus released an enhancement to its e-ticket and itinerary documents earlier this year that will enable its customers to be compliant with the IATA GDPR mandate (

Broad advice for travel agents
Sabre's McKinney said that the new rules are “a concern for North American travel agents who target customers who are EU residents,” though Sabre is “not in a position to provide legal advice or to advise what actions are required by our customers.”

He provided Travel Market Report with a brief overview of what the GDPR requires, which includes that “data considered ‘personal’ must be protected and processed only as permitted; access to this date is controlled and restricted contracts with third-party processors must contain certain specific terms,” and more.

He also pointed out that some larger agencies that have a lot of European clients, may need to look to outside help or add a member to their team, McKinney said.

“Because the GDPR is complex, some companies will require the appointment of a data protection officer … we recommend that companies review the requirements of the GDPR and decide if they need to speak with their legal counsel to determine its applicability to their business,” he said.

For agencies that do not have the ability to look to counsel or outside help, there is a one-hour presentation on the new rules available here that Sabre also recommends.

Amadeus told Travel Market Report that, “it is of crucial importance for travel agents to understand their role under GDRP, as it might have repercussions in the way they work or operate.

“The role that travel agencies have under GDPR will need to be determined by each of them depending on the services they provide. It is likely that travel agencies and other travel suppliers such as airlines, hotels and car rental companies (travel providers) will be considered as data controllers for the majority of processing activities.”

A data controller is the party that determines the means and purpose of the processing of the personal data.  

According to Amadeus, agents “need to consider how they want that personal data to be processed, especially when working with third-party providers.

“The travel agency should ensure there are written agreements – data processing agreements – with these data processors, to make sure their standards and security measures to protect the personal data and other requirements under the GDPR are met,” the spokesperson said.

Tip of the Day

“What really worked for me is experiencing the product and letting potential clients know I have been there and seen it. I travel every month to locations I sell and once a year to a new place I have never been.” - Roy Gal, Travel Advisor

Daily Top List

Best Things to Do in Tahiti

1. La Plage de Maui

2. Fautaua Waterfall

3. Papenoo Beach

4. Plage du Taharuu

5. Papeete

Source: USNews

TMR Recommendations
Top Stories
Here’s What Wi-Fi Costs on Major Airlines
Here’s What Wi-Fi Costs on Major Airlines

More and more airlines are making it easier and cheaper to connect to the internet while in flight, while others have been slow to update their services or prices.

Is Expedition Cruising the Next Big Travel Trend?
Is Expedition Cruising the Next Big Travel Trend?

New study reveals where clients want to go and provides insights into how travel advisors can sell more expedition cruises.

Canadian Advisors Can Win Trip to Thailand with G Adventures
Canadian Advisors Can Win Trip to Thailand with G Adventures

From May 14 – June 10, travelers save 15% and travel advisors get one entry for every traveler booked into a contest for a G Adventures' Thailand tour.

Six Ways to Get the Best ROI at Your Next Industry Conference
Six Ways to Get the Best ROI at Your Next Industry Conference

Whether the next travel conference is in your hometown, across the country, or across the globe, here are some ideas about how to make the most of your time there.

Warwick Paradise Island Offering Agents Cash Bonuses on Top of Commissions
Warwick Paradise Island Offering Agents Cash Bonuses on Top of Commissions

Travel agents must complete the WPIB Specialist training with the adults-only, all-inclusive resort’s sales team in order to get the added bonuses.

Travel Institute Adds New Destination Specialist Course
Travel Institute Adds New Destination Specialist Course

Travel advisors learn about Northern Europe’s vast cultural norms, culinary options, varying climates, rich history and architecture, inter-region travel methods, tipping, adventure travel options, and other nuances of the region.

News Briefs
TMR Report Cards & Outlooks