Why a guest list is personal data
The General Data Protection Regulation applies when you handle information about identifiable people in the European Union and the wider European Economic Area, and many organisers outside it work to the same standard because their guests or clients expect it. Every guest list is in scope: a name and an email address are enough. So is a door log that records who entered and when, and a photo gallery where guests can be recognised.
Some answers deserve extra care. A dietary note that reveals a religion, an allergy or an accessibility need can count as health or other special category data. Ask for it only when you will use it, and share it only with the people who must act on it.
Choose a lawful basis for each use
GDPR asks you to have a lawful basis for every purpose, not one for the whole event. Sending an invitation to employees for a company event, handling a guest’s reply and admitting them at the door usually rest on different grounds from adding them to a marketing list afterwards. Write each purpose down with its basis before the first invitation goes out.
- Contract or steps towards it: a guest registers or buys a place, and you need their details to deliver it.
- Legitimate interests: for example inviting existing business contacts, balanced against what guests would reasonably expect.
- Consent: for anything optional, such as marketing after the event or sharing details with a sponsor; freely given, specific and as easy to withdraw as to give.
- Legal obligation: where a law requires a record, for example certain security or tax records.
Collect only what the event needs
Data minimisation is the principle that saves the most trouble. Every field on a reply form is a field you must protect, explain and eventually delete. Before adding a question, ask what you will do with the answer and who will see it. Date of birth, home address and job title are often collected out of habit and never used.
Tell guests what you collect and why, in plain words, at the moment you collect it: a short notice next to the reply form, linked to your full privacy notice. Say who the organiser is, what the data is used for, who it is shared with and how long it is kept.
Consent that means something
Where you rely on consent, it must be a real choice. A box that is ticked in advance, or consent buried in general terms, does not count. Ask separately for each optional purpose, keep a record of who agreed to what and when, and make it easy to change one’s mind.
The same applies to photos and video. Tell guests at the invitation and at the entrance if the event is filmed or photographed, offer a way to opt out where you can, and think twice before publishing recognisable images of guests who did not expect it.
Sponsors, exhibitors and other recipients
Handing a sponsor the attendee list because they paid for a stand is one of the commonest event privacy mistakes. A sponsor is a separate organisation; giving them guests’ details normally needs the guest’s own, specific agreement. The safer pattern is that each visitor chooses, at the stand, whether to share their details with that sponsor, and that the choice is recorded.
Your suppliers are a different case. A registration platform, an email service or a badge printer that handles data on your behalf is a processor, and you need a written data processing agreement with each of them. Check where they store data and what happens to it when the contract ends.
Keep it safe, and keep it only as long as needed
Security is part of the regulation, not an extra. Limit who on the team can see the full list, avoid emailing spreadsheets of guests around, protect door devices and remove access when the event ends. If something goes wrong, such as a list sent to the wrong person, GDPR expects you to assess it quickly and, where the breach is likely to put people at risk, to notify the supervisory authority without undue delay and within 72 hours where feasible.
Set a retention period for each kind of data and stick to it. A door log may be needed for a few weeks, a list of people who agreed to hear about future events for longer, a dietary note not at all once the dinner is over.
Access and deletion requests from guests
Guests may ask what you hold about them, ask you to correct it or ask you to delete it. Under GDPR you normally have one month to answer. Agree in advance who handles these requests, how you confirm the person is who they say they are and where you will look, including spreadsheets on laptops and exports sent to suppliers.
- One named person or address for privacy requests.
- A list of every place guest data lives, including copies and suppliers.
- A short template answer for access, correction and deletion.
- A record of each request and when it was answered.
- A check that sponsors and suppliers delete their copies too, where relevant.