Limiting access to personal information: Hotels should limit access to guests' personal information to authorized personnel only. This can be achieved by implementing a role-based access-control system that grants access to sensitive information such as credit card data to only those employees who require it.