Event industry compliance: GDPR & AI Act

Why the 'Events' sector is concerned

The events industry collects participant data in large volumes and often under time pressure: ticketing, registration forms, badges and accreditations, guest lists, payment data. Each purpose (access control, billing, marketing) requires its own legal basis and retention period.

Photo and video capture is systematic and raises image rights issues compounded by GDPR, particularly when minors are present. Informing participants about the capture and its distribution is essential.

The temptation to use facial recognition to streamline access control involves biometric data: the AI Act heavily restricts real-time remote biometric identification in publicly accessible spaces, and the GDPR treats biometric data as sensitive data.

GDPR — participants, badges, recording

The organiser is the data controller for ticketing, registrations, badges, guest lists, and filming. It must define legal bases by purpose, inform individuals about filming and image rights, secure payment data, and limit retention periods.

International events often involve data transfers outside the EU that need to be governed.

Key obligations

• Legal bases by purpose (access, billing, marketing).
• Information on image capture and the right to one's image.
• Payment data security.
• Framework for transfers outside the EU.

AI Act — biometric access

Facial recognition for access control involves biometric data. The AI Act severely restricts real-time remote biometric identification in publicly accessible spaces and regulates biometric categorisation. 'Smart' cameras call for the same level of vigilance.

Less intrusive solutions (named ticketing, QR codes) are generally preferable.

Key obligations

• Prohibit unauthorised biometric access controls.
• Classify smart camera systems.
• Transparency on AI usage.
• Articulation with the GDPR (sensitive biometrics).

Comparative overview of regulations

How these regulations interact

The events industry concentrates large-scale, one-off GDPR processing activities: rigour focuses on the legal bases per purpose, information provided at the point of data capture, and payment security. Image capture brings together GDPR requirements and portrait rights.

Biometric access control illustrates the cumulative GDPR / AI Act challenge: sensitive data (GDPR) and heavily restricted use (AI Act). In the vast majority of cases, non-biometric solutions should be preferred.

Application timeline

• 1GDPR. In force; vigilance on data capture and transfers.
• 2AI Act. Prohibitions: Biometric restrictions since February 2025.

Applicable penalties

GDPR up to €20M or 4%, AI Act up to €35M or 7% for prohibited practices. Uncontrolled data capture, payment security, and biometric access control are the most exposed areas.

Compliance roadmap

• 1Map. Map ticketing, registrations, badges, capture, payment.
• 2Frame the purposes. Defining legal bases and retention periods by purpose.
• 3Inform about data collection. Ensuring transparency and managing image rights.
• 4Securing payments and transfers. Secure payment processing and govern transfers outside the EU.
• 5Ruling out biometrics. Favour non-biometric access solutions.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports event organisers on ticketing, content capture, international transfers, and the question of biometric access control.

DCO offers tailored templates (ticketing notices, image capture information, transfer governance).

Frequently asked questions