GDPR compliance — event registration
Event registration involves processing personal data (names, emails, dietary, accessibility, sometimes passport for visa purposes). GDPR compliance is mandatory for any event with EU attendees regardless of organiser location. This guide covers lawful basis, consent, data minimisation, retention, and DPA requirements.
Lawful basis for processing event data
GDPR Article 6 requires a lawful basis for personal data processing. Event registration typically uses: (a) Contract — if attendee paid for ticket, processing is necessary for fulfilling the contract; (b) Legitimate interest — for free events or B2B/B2C marketing where you can demonstrate balanced interest; (c) Consent — for marketing communications post-event, dietary requirements, accessibility needs (sensitive personal data). Always document your lawful basis per data field.
Consent — when and how
Consent is required for: marketing communications (newsletter sign-up post-event); dietary requirements (sensitive data — food allergies = health data); accessibility accommodations (sensitive data — disability information); photography/video that identifies attendees (sensitive in some contexts); session recordings shared publicly; data sharing with sponsors/partners. Consent must be: freely given, specific, informed, unambiguous (Article 7). Pre-ticked checkboxes are NOT valid consent. Provide separate consent for each purpose — don't bundle marketing + dietary into one tick.
Data minimisation
GDPR Article 5(1)(c) requires collecting only data necessary for the stated purpose. For event registration, that typically means: (a) name + email — necessary for contract; (b) job title + company — legitimate interest for B2B events; (c) dietary requirements — only collect when F&B is provided; (d) accessibility — only collect when relevant accommodations exist; (e) passport number — only collect if you're issuing visa invitation letters. Avoid: 'optional' fields that aren't actually used. Every field you collect = data you're responsible for protecting and storing.
Retention periods
Set explicit retention periods per data category. Typical defaults: (a) Attendee contact data — 24 months post-event for follow-up + marketing if consented; (b) Dietary/accessibility data — delete within 30 days post-event (no longer relevant); (c) Payment data — 7 years for tax purposes (legally required, separate from GDPR retention); (d) Session attendance logs — 12 months for future event planning; (e) Marketing consent — until withdrawn or 3 years of inactivity. Document these periods in your privacy policy. Retention beyond these periods requires renewed legal basis.
DPA — data processing agreements with vendors
Any vendor processing your attendee data needs a Data Processing Agreement (DPA) under GDPR Article 28. Vendors needing DPAs: registration platform (Cvent, Eventbrite, Easy RFP), email marketing (Mailchimp, Resend, Brevo), survey tool (Typeform, SurveyMonkey), photographer/videographer (if they keep attendee imagery), speaker portal (if used). DPA must cover: processing scope, purpose, duration, sub-processors, security measures, data return/deletion, audit rights, breach notification. Most enterprise vendors provide standard DPA templates.
Breach notification + DSAR requests
Personal data breach affecting EU residents must be reported to the supervisory authority within 72 hours of discovery (Article 33). Affected attendees must be notified 'without undue delay' if the breach is high-risk to their rights. Have a documented breach response process. DSAR (Data Subject Access Request) — attendees can request access to their data, deletion (right to erasure Art. 17), or portability (Art. 20). You must respond within 1 month. Common DSARs at events: 'show me what data you have on me', 'delete me from your mailing list', 'remove my photo from the event recap video'.
Practical event compliance checklist
(1) Privacy notice on registration form — clear, accessible language. (2) Lawful basis documented per data field. (3) Granular consent for marketing/dietary/accessibility. (4) DPA with every vendor. (5) Retention periods documented + automated deletion where possible. (6) Breach response process documented. (7) DSAR process documented + tested. (8) GDPR training for event team. (9) Records of processing activities (Article 30) — required for orgs >250 employees, recommended for smaller. (10) DPIA (Data Protection Impact Assessment) for high-risk processing — large events with sensitive data may trigger this requirement.
Frequently asked questions
Do I need to comply with GDPR if my event is outside the EU?
Yes if any EU residents attend. GDPR applies based on data subject location, not organiser location. A US event with 5 EU attendees triggers GDPR for those 5 attendees' data.
What's the lawful basis for collecting attendee email?
Contract (if attendee paid) or legitimate interest (free B2B events). For marketing follow-up post-event, you need separate explicit consent.
How long can I keep attendee data after the event?
Typical retention: 24 months post-event for contact data with legitimate interest basis, 30 days for dietary/accessibility. Marketing consent until withdrawn. Payment data 7 years for tax. Document your specific periods in privacy policy.
Do I need a DPA with my registration vendor?
Yes — any vendor processing your attendee data needs a Data Processing Agreement under Article 28. Most enterprise vendors (Cvent, Eventbrite, Easy RFP) provide standard DPA templates.
What's a DSAR and how do I respond?
Data Subject Access Request — attendee asking to see, delete, or port their data. You must respond within 1 month. Common DSARs at events: 'show my data', 'delete me from mailing list', 'remove me from photos'. Have a documented process before the event.
Next steps
Combine this guide with our contract review checklist and universal RFP template for a complete compliance-aware sourcing workflow. If your event involves multiple EU jurisdictions, our multi-property pricing framework normalises VAT and city tier across countries.