Events · GDPR

Events — GDPR: managing large-scale and one-off data processing

The event organiser processes participants' data on a large scale: ticketing, registrations, badges, recording, and payment. The GDPR requires a legal basis for each purpose, information on recording activities, and payment security. This guide details these processing activities and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Organizers, trade shows, congresses, and venues are data controllers.
  • Define the purposes.
  • Inform about data capture.
  • Secure the payment.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

GDPR applies to all participant data. The purposes are multiple (access, billing, marketing) and require distinct legal bases and retention periods. Content capture articulates GDPR requirements with image rights.

International events often involve transfers outside the EU that need to be governed.

Is the 'Events' sector affected?

Organisers, trade shows, conferences, and venues are data controllers. Service providers (ticketing, payment, registration platforms) are sub-processors or joint controllers.

Participants, sometimes including minors, benefit from information and rights.

Detailed obligations

Define the purposes

Ground each processing activity (access, billing, marketing) on its own legal basis and retention period.

Inform about data collection

Inform participants of the recording and its distribution, with particular vigilance regarding minors.

Secure the payment

Secure payment data through compliant service providers.

Frame transfers

Securing transfers outside the EU through appropriate safeguards.

Limit retention periods

Erasing or anonymising data once the purpose has been fulfilled.

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Uncontrolled data capture and payment security are the most exposed areas.

Common mistakes in the sector

  • 1Conflated purposes. Mixing access and marketing without distinct legal bases.
  • 2Uninformed capture. Distribute images without information or authorisation.
  • 3Poorly secured payment. Processing payments without a compliant provider.
  • 4Ungoverned transfers. Transferring outside the EU without safeguards.

Practical case

A trade show was reusing ticketing data for marketing purposes without a separate legal basis and distributing photos without informing individuals. Remediation separates the purposes, informs on image capture, secures payment and governs transfers for international editions.

Compliance roadmap

  1. 1

    Map. Inventory processing activities by purpose.

  2. 2

    Frame. Legal bases and retention periods.

  3. 3

    Capture. Information and right to image.

  4. 4

    Secure. Payment and transfers.

  5. 5

    Document. Maintain the register.

Frequently asked questions

Only on a legal basis distinct from access (consent or framed legitimate interest).

Back to the Events guideEvents & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to events.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the events sector secured their compliance with DCO.

See testimonials