Guest-grade connectivity, operationally controlled.

A hotel or visitor attraction is a public building with a payment estate inside it. PCI DSS, published by the PCI Security Standards Council, treats any system that stores, processes or transmits cardholder data as in scope, together with systems connected to it. That is why point-of-sale and property management traffic is normally separated from the guest network. Where segmentation is used to hold that scope down, the operator is expected to prove the boundary rather than assert it, through testing at defined intervals. Building systems on that infrastructure raise the same question, because connectivity, not function, decides scope.

Outdoor coverage is limited by spectrum rules as well as equipment. UK rules restrict the lower 5 GHz channels to indoor use, so grounds and terraces are served from a narrower set of channels than the rooms above them. Surveillance carries a separate duty: the UK GDPR requires a data protection impact assessment where a publicly accessible area is monitored systematically on a large scale, and retention periods should be set deliberately rather than left at the recorder default. With no closed hour, equipment has to fail without taking the service down, because remedial work waits for a planned window.