The typical GDPR problem at a B2B conference does not look dramatic. A sponsor emails 400 people from a "scanned leads" CSV, one of those 400 is a compliance officer at a Frankfurt bank, and the event team spends the following Monday on a call with legal trying to explain where consent came from. Nothing about this scenario is exotic. It happens several times a season across the European event calendar, and it is almost always caused by sloppy handoffs rather than hostile intent.
GDPR compliance for event organizers is mostly common sense applied with discipline. The lawful basis for most processing is contract performance (registration) and consent (marketing follow-up). The mistakes happen at the edges: sponsor data sharing, photography, and post-event retention. This guide walks through each, with the specific registration-form and operational choices that keep you out of trouble.
1. What GDPR requires at registration
The registration form is where most event data relationships begin, which makes it the highest-leverage place to get consent right. Five elements are non-negotiable:
- A plain-language privacy notice linked from the form itself, not buried in the footer.
- A stated lawful basis for each piece of data you collect. Email and name are "contract" (you need them to deliver the ticket). Marketing consent is "consent" and must be opt-in.
- Granular consent — separate unchecked checkboxes for marketing emails, sponsor data sharing, and photography. One "I agree" checkbox covering three purposes is a violation.
- An easy withdrawal mechanism. A working unsubscribe link satisfies marketing; a privacy email address covers the rest.
- Data minimization. If you are not going to use a field, do not collect it. Shoe size does not belong on a B2B registration form.
Pre-checked boxes are not consent under GDPR. Checkboxes must be affirmative opt-in. This has been settled case law since the Planet49 judgment in 2019 — there is no grey area left.
A specific pattern that works: a single "Register" button with two checkboxes below it, labeled something like "Email me updates about future events" and "Share my contact details with event sponsors." Neither is required for registration to succeed. Plan for 40-70% opt-in on the first and 15-35% on the second. Lower numbers usually indicate unclear copy, not hostile attendees.
2. Sponsor data sharing — the trickiest part
This is where most organizers get into trouble. You cannot share attendee data with sponsors unless attendees explicitly opted in. Three patterns are compliant:
- Badge scans at sponsor booths. The attendee physically hands the badge to the booth staff and allows it to be scanned. That is implicit consent for data capture at that booth — but only at that booth, and only for that sponsor.
- Pre-event opt-in. "Share my profile with event sponsors" as a separate checkbox at registration. Attendees who check it go onto a shared list.
- App-mediated connection. The attendee initiates a chat or profile view through the event app. Each side sees only what the other has agreed to expose.
Sponsor lead lists shared post-event without opt-in are a violation. Full stop. Most sponsor disputes about lead quality stem from organizers who promised data they could not legally deliver, then scrambled to deliver something anyway. The clean alternative is a lead retrieval app where every scan is an explicit attendee action, with consent logs attached.
If a sponsor asks for "the full attendee list," the correct answer is no. The acceptable alternative is "we will include your branded email in the pre-event attendee comms on your behalf" — you send, you control the list, sponsor never touches it.
3. Photography and recordings
Photography in public areas of the event is generally permitted under "legitimate interest," but three operational controls are expected:
- Notify attendees at registration that photography and recording will happen, with examples of how the footage will be used (marketing, recaps, social).
- Provide a visible opt-out indicator. A colored lanyard, a "no photo" sticker on the badge, or a lanyard pattern signaling "please do not photograph."
- Train the photographer to honor opt-outs. This is the step most organizers skip, and it is the one that causes complaints.
Session recordings where attendees are visible in the frame (not just the speaker) require consent. The practical path is a verbal announcement at session start ("this session is being recorded — if you do not want to be on camera, please move to the back rows on the left") combined with a printed note on each seat. Q&A cameras pointed at the audience need the same treatment — or simpler, only record the speaker and the mic-holder.
4. Data retention — set it deliberately
GDPR does not specify retention periods. You set them based on purpose and document the reasoning. A working policy that holds up under audit:
- Registration data (name, email, ticket type): 2 years post-event. Rationale: audit, refund disputes, renewal eligibility.
- Marketing consent data: retained until withdrawal. The consent log (when they opted in, from which form) stays even after they unsubscribe, for legal defensibility.
- Photography and video: 5 years for public-facing event photos on your site. 1 year for unused raw footage.
- Sponsor lead lists: once handed to the sponsor, delete from your systems within 90 days. You are no longer the controller.
- Payment data: never store full card details. Your processor does that. You keep the last 4 digits and the transaction ID for reconciliation.
Write this down as a one-page retention policy and keep it linked from your privacy notice. If a supervisory authority comes calling, showing a deliberate policy is worth far more than demonstrating a clean database.
5. The pre-event compliance checklist
Run through this two weeks before registration opens:
- Privacy notice drafted, reviewed by counsel or a qualified privacy advisor, linked from the registration form.
- Consent checkboxes split by purpose: marketing, sponsor sharing, photography.
- Retention policy written and internally published.
- Data processing agreements (DPAs) signed with every vendor touching attendee data — registration platform, email tool, check-in hardware, recording partner, event app.
- Standard Contractual Clauses (SCCs) in place for any vendor processing data outside the EU/EEA.
- Photographer briefed on opt-out signals.
- Sponsor data-sharing boundaries documented in sponsor contracts.
- Named privacy contact listed in the privacy notice — a real email someone reads.
- Attendee data subject request process defined (how will you handle a "delete my data" request in under 30 days?).
- Breach response plan — who gets called, in what order, within the 72-hour notification window.
A first-time event can work through this list in two focused afternoons. A recurring event should revisit it annually.
Common mistakes that trigger complaints
- Single "I agree to terms" checkbox covering registration + marketing + sponsor sharing.
- Verbal-only "by attending you consent" announcements. Courts have rejected these repeatedly.
- Storing credit card data beyond the transaction. Let your payment processor hold it.
- Cookies on the registration page without a consent banner for EU visitors.
- International data transfers (US-based email tools, for example) without SCCs.
- Sending "you registered for last year's event, here's this year" to people who never opted into marketing. Last year's registration is not this year's consent.
FAQ
Does GDPR apply if I am a US event with a few EU attendees? Yes, for those EU attendees. The regulation is extraterritorial. Build one compliant system for everyone; it is cheaper than segmenting.
What about CCPA, Brazil's LGPD, and similar laws? The principles overlap substantially. Build for GDPR and you cover 80-90% of the obligations under the others. The remaining gaps (CCPA's specific "Do Not Sell" link, for example) are add-ons, not rewrites.
Do I need a Data Protection Officer? Formally required only for large-scale processing or certain categories of sensitive data. Most event organizers do not. A named privacy contact — an actual person with an email address — is a best practice regardless.
What happens if a sponsor breaches our sharing rules? You are jointly liable if your contract was sloppy. Your sponsor contract should require the sponsor to use the data only for the purposes the attendee consented to, delete it within a stated period, and notify you of any breach within 48 hours.
Can I share attendee names for a printed attendee list handed out at the event? Only if attendees opted in to that specific use. The safer pattern is a digital attendee directory inside the event app, visible only to other opted-in attendees.
Related guides
For event management software with built-in consent logging, granular permissions, and GDPR-aware data retention: Create your event on WebMobi →