Why event marketing data protection needs a written rulebook

What to take away

The ICO's direct marketing guidance, updated on 9 October 2024, explains how consent and legitimate interests apply to attendee data.
Data protection law covers badge scans, lead capture and follow-up emails, not just bought lists.
Health and safety duties sit with the organiser, so agree who holds the risk assessment.
Event claims fall under the CAP Code, and the ASA can act on one complaint.
This is general guidance, and individual cases need a qualified adviser.

The written sources: ICO guidance, UK GDPR and PECR

The ICO and direct marketing

The Information Commissioner's Office regulates data protection in England. Its direct marketing guidance covers consent, legitimate interests and the soft opt-in, including when regulatory communications sit outside the usual consent rules. Read the ICO's direct marketing and regulatory communications page before you draft your follow-up sequence.

Consent vs legitimate interests vs soft opt-in

Consent

When it applies: freely given, specific
What to record: recorded consent
Channel note: PECR and UK GDPR

Legitimate interests

When it applies: some B2B contact
What to record: balancing test
Channel note: PECR and UK GDPR

Soft opt-in

When it applies: details collected in sale
What to record: opt-out at every message
Channel note: PECR and UK GDPR

Consent, legitimate interests and the soft opt-in

Consent must be freely given, specific and recorded, and a tick box buried in a registration form rarely meets that test. Legitimate interests can cover some business-to-business contact, but record your balancing test. Consent sits in UK GDPR Article 6(1)(a) and is defined in Article 4(11), and legitimate interests sit in Article 6(1)(f).

The soft opt-in applies only where you collected the details during a sale and you offer an opt-out at every message. PECR regulation 22 governs electronic mail, and the soft opt-in sits in regulation 22(3). Agree in writing who is the controller for each list.

The channel matters as well. Electronic marketing falls under the Privacy and Electronic Communications Regulations as well as the UK GDPR, so a text message and a printed flyer carry different rules. Note the basis for each channel separately.

What this means at the event

Badge scans and lead capture

A badge scan collects data, so attendees should know what happens to their details first. Put a short notice on the stand naming the client, purpose and retention period.

Model clause: "We scan your badge to share your details with [named exhibitor] for [stated purpose]. We keep scan data for 12 months after the event and then delete it, unless you ask us to stop sooner."

Special category data, such as accessibility needs or dietary requirements, needs its own condition and tighter access controls. Our guide to the event marketing disclosure policy in England shows how to word those notices.

Health and safety duties

The Health and Safety Executive publishes guidance for the entertainment and leisure industry on crowd management, temporary structures and audience safety. The duty holder is usually the organiser, but agencies that design activations can inherit practical responsibility.

Agree who writes the risk assessment and who holds public liability cover. Keep the paperwork as long as your insurer requires, and treat incident records as personal data. Injuries that meet the reporting threshold must be recorded under RIDDOR, and those records count as personal data too.

Claims, contracts and records

Advertising claims and the CAP Code

The Advertising Standards Authority regulates UK advertising through the CAP Code. Its about regulation page explains the scope and how complaints are handled.

If your campaign claims a certain footfall, a celebrity appearance or a prize, you need evidence before the ad runs. Paid partnerships with creators must be labelled clearly as ads, and the same evidence rules apply. One complaint can trigger an investigation, so keep substantiation for every claim.

Contracts and retention

Put data protection terms in the agency contract: lawful basis, retention period and deletion process. Lead lists often stay on file because nobody owns deletion; set a default review date of 12 months after the event unless a documented reason requires longer, and record the decision.

Where a platform stores leads outside the UK, check the transfer mechanism before the campaign starts. For a wider view of how these duties fit together, read our UK rules and compliance guide for 2027.

Checklist

Identify the controller and processor for every data flow.
Show a short privacy notice at every scan point.
Brief stand staff on data use.
Agree who writes the risk assessment and holds insurance.
Keep substantiation for every advertising claim.
Set a retention date and a named owner.
Log consent, opt-outs and complaints in one place.

Common questions

Does data protection law apply to a free event?

Yes. The rules apply whenever you collect personal data, whether attendees pay or not. A free registration form still needs a lawful basis and a privacy notice.

Can we rely on legitimate interests for follow-up emails?

Sometimes. You must complete a balancing test and offer an opt-out. For consumer marketing, consent is usually the safer route.

Who is responsible for health and safety at a brand activation?

The organiser normally holds the primary duty, but the agency can share practical responsibility. Put the split in the contract and review it.

Do we need to register with the ICO?

Most organisations that process personal data must pay a data protection fee unless an exemption applies. The ICO's current fee tiers are £40, £60 and £2,900 a year, with a £5 discount by direct debit. Processing only for staff administration, accounts and advertising your own goods and services may be exempt.

Check the ICO's registration pages and take advice if unsure.