GDPR and data capture at events: a plain-English UK guide

This is general information to help you plan, not legal advice. For your own situation, check the Information Commissioner’s Office guidance at ico.org.uk or speak to a data protection adviser.

Two sets of rules

Collecting names and contact details at an event is covered by the UK GDPR and the Data Protection Act 2018. Sending marketing emails or texts afterwards is also covered by the Privacy and Electronic Communications Regulations (PECR). The first is about having a good reason to hold the data and looking after it; the second is mostly about permission to market to people electronically.

1. Know why you are collecting it

Decide what each detail is for before the event. A name for the leaderboard, an email address to contact the winner and, if you want it, permission to send news afterwards are three different purposes. Write them down: they decide which fields you need and what your consent wording should say.

2. Ask only for what you need

Data minimisation means not collecting details “just in case”. If you will only ever email people, do not ask for a phone number. If a postcode helps you route leads to the right sales team, ask for it; if not, leave it off. On our arcade every field can be switched off, made optional or made required, so the form matches your purposes exactly.

3. Make marketing consent a separate, real choice

For marketing emails and texts to individuals, PECR generally needs their consent. Consent must be freely given, specific, informed and shown by a clear action, so:

• Use a tick box that starts unticked (pre-ticked boxes do not count)
• Keep it separate from entering the game or the prize draw
• Say who will contact them and how, in plain words
• Keep a record of who agreed, and when

On our arcade the consent box is separate and unticked, the wording is yours, and each sign-up records whether it was ticked. Avoid making marketing consent a condition of playing.

4. Tell people what happens to their data

People should know who is collecting their details, what for, and where to find more information, at the moment they hand them over. Put a short line on the sign-up form and link to your privacy notice. If you are running a prize draw or competition, link to its terms too.

5. Keep it safe and keep it short

Store the data securely, limit who can see it, and decide in advance how long you will keep it. Do not show contact details in public: on our arcade only names (or a first name and initial) appear on screen. Export what you need after the event, and delete what you no longer need.

6. Know who is responsible

Whoever decides why and how the data is used is the controller, usually the brand or exhibitor. Suppliers who handle the data for you, such as the provider of the game, act as processors and should do so under a written agreement.

7. Be careful with children

At family events, think about whether children may sign up. If you do not need children’s details, say the sign-up is for adults, or let children play with a first name only and no contact details.

Checklist for your event

• Purposes written down for every field
• Only the fields you need switched on
• A separate, unticked marketing consent box with clear wording
• A link to your privacy notice (and competition terms, if any)
• No contact details on public screens
• A plan for exporting, using and deleting the data after the event

See how this works on our arcade: data capture games.