Exhibition Visitor Data Collection: GDPR Compliance Guide

Exhibition organisers who collect visitor data without a documented lawful basis are exposed to ICO enforcement, exhibitor contract disputes, and the kind of press coverage that follows a show for years. UK GDPR does not prohibit data collection at exhibitions — it requires that collection is purposeful, transparent, and controllable by the individual.\n\n## Why Visitor Data Compliance Is an Operational Problem, Not Just a Legal One\n\nCompliance failures at exhibitions rarely begin with malice. They begin with rushed registration builds, badge-scanning apps handed to exhibitors without data-sharing agreements, and post-show email blasts sent to lists nobody audited. Each step in the visitor journey — pre-registration, on-site badge scan, post-show follow-up — is a distinct processing activity that needs its own legal footing.\n\nFor UK organisers, the governing framework is UK GDPR and the Data Protection Act 2018, administered by the Information Commissioner's Office (ICO). Australian organisers operating events that attract UK or EU visitors, or that process data on servers in those jurisdictions, must treat UK GDPR obligations as live.\n\n## Establishing a Lawful Basis Before Registration Opens\n\nThe most defensible lawful basis for most exhibition registration data is consent — freely given, specific, informed, and unambiguous. That means:\n\n- A clear opt-in at registration, not a pre-ticked box\n- Separate consent granules for different purposes (organiser communications vs. exhibitor lead sharing vs. third-party sponsors)\n- A record of when and how consent was given, stored and retrievable\n\nSome organisers also rely on legitimate interests for operational data — for example, retaining a visitor's name and company to issue an invoice or enforce access control. Legitimate interests requires a documented balancing test, and it cannot be used to justify marketing without consent.\n\n## Badge Scanning and the Exhibitor Data Chain\n\nBadge scanning is where most compliance gaps appear. When an exhibitor scans a visitor's badge, two things happen simultaneously: the organiser's platform captures the scan event, and the exhibitor receives personal data. Under UK GDPR, both parties are processing personal data, and both need a lawful basis.\n\nOrganisers should:\n\n1. Include a data-sharing clause in exhibitor contracts that specifies what data will be passed, for what purposes, and under what retention limits\n2. Inform visitors at registration that their badge data may be shared with exhibitors they engage with — not buried in a privacy policy, but stated plainly\n3. Ensure that badge-scanning apps (whether provided by the organiser or a third party) are covered by a Data Processing Agreement (DPA) if the vendor processes data on your behalf\n\nAI-assisted lead capture tools can reduce manual error in this chain by flagging consent gaps at the point of scan, prompting exhibitor staff to confirm visitor engagement before data is logged. They do not replace the underlying consent requirement, but they can make it easier to enforce consistently across a large show floor.\n\n## Privacy Notices: What Must Be Present\n\nA compliant privacy notice for an exhibition registration must cover: the identity of the data controller, the purposes and lawful bases for each processing activity, how long data will be retained, whether data will be shared and with whom, and how visitors can exercise their rights (access, rectification, erasure, objection).\n\nThis notice must be accessible at the point of data collection — not sent in a follow-up email three days after pre-registration closes.\n\n## Post-Show Data Handling\n\nThe post-show period is where retention becomes a risk. Visitor lists from three years ago, stored in spreadsheets on sales team laptops, with no deletion schedule, are a common source of Subject Access Request headaches.\n\nSet a documented retention period before the show — typically 12 to 24 months for marketing purposes — and build a deletion schedule into your event close-down checklist. If you use a CRM or exhibition management platform, confirm it supports automated data expiry or supports bulk deletion on request.\n\n## Useful Tool\n\nIf you are planning the operational timeline for an upcoming show, the Exhibition Timeline Planner includes 90/60/30/7-day checklists that can be used to schedule data compliance tasks alongside logistics milestones.\n\n## Common Mistakes\n\nTreating badge scan data as organiser property. Visitors consent to share data with the organiser and, where disclosed, with specific exhibitors — not with the entire exhibitor list by default.\n\nUsing a single consent checkbox for multiple purposes. Bundled consent is not valid under UK GDPR. Each distinct use of visitor data needs its own opt-in.\n\nFailing to issue DPAs to badge-scanning app vendors. If a third party processes personal data on your behalf, a DPA is mandatory, not optional.\n\nNo data subject rights process. Visitors can submit access or erasure requests at any time, including during the show. Organisers need a named contact and a documented response process in place before doors open.

Useful tool

Try Samvara's Organiser Exhibition ROI Planner — For organisers — show P&L by day.