Every lead you collect at a European trade show is personal data, which means GDPR applies the moment someone hands you a card or scans a badge.
Every lead you collect at a European trade show is personal data, which means GDPR applies the moment someone hands you a card or scans a badge. Getting it right protects both your prospects and your follow-up. This is a practical, plain-English perspective for exhibitors — general information, not legal advice, so confirm specifics with a data-protection professional.
Every lead you capture is personal data
From an exhibitor's point of view, the practical heart of the GDPR is simple: every lead you capture at a show is personal data, and you are responsible for how you handle it. A scanned badge, a business card, a name typed into a tablet — each is personal data the moment you collect it, and the regulation asks that you have a lawful basis for collecting it, that the person reasonably understands what you will do with it, and that you keep it only as long as you genuinely need it. This is not a reason to fear the show floor; it is a reason to be deliberate about how you gather and use contacts. Treated sensibly, compliance and good lead practice point the same way — capturing the right people, with their understanding, in a way you can actually follow up. This is general guidance, not legal advice; confirm specifics with a data-protection professional.
A scan is not blanket consent
Badge-scanning makes lead capture easy, and that ease is exactly where exhibitors get careless. When you scan a badge you are collecting personal data, and the person should reasonably understand what that means — who you are, why you are capturing their details, and what happens next. A scan is not blanket permission to add someone to a marketing programme forever. The disciplined approach is to capture only what you need, tell people clearly what the scan is for, and keep a genuine opt-in for ongoing marketing separate from the mere fact of a conversation at your stand. Brief the team on this before the show, because the failure here is almost never malicious — it is the busy salesperson scanning everything that moves to sort out later. That "later" is where the compliance problem, and a pile of contacts you cannot properly use, both live.
What our clients say
Three years of booth excellence
Expert support and a stunning stand design
Our first CPHI, a successful show
Be very careful with bought or shared lists
Attendee lists offered or sold around a show are a classic GDPR risk, and the temptation is real — a ready-made list of everyone at the show, for a fee, landing in your inbox weeks ahead. Treat it with caution. Using a list of people who never agreed to hear from you, who have no relationship with your company and were never told their details might be passed on, is exactly the kind of processing the regulation exists to curb. That a list is for sale does not make your use of it lawful. Before you touch a bought or shared list, ask where the data came from, what those people were told, and whether there is any lawful basis to contact them at all. If you cannot answer those confidently, the safe and correct decision is not to use it — and to build your list from the people who actually chose to talk to you instead.
Follow up honestly, and do not keep data forever
The days after a show are where good intentions meet reality: a pile of leads, a tired team, and pressure to email everyone at once. Slow down enough to separate the leads by what actually happened — someone who asked for a follow-up is different from a badge scanned in passing, which is different again from a name on a bought list — and let your follow-up reflect that. Keep a record of how each contact reached you and what they agreed to, so you have an honest answer if someone later asks why they are hearing from you. And do not keep the data forever by default: retention should be justified, so decide in advance how long you hold show leads and delete what you no longer need. None of this slows a real sales process; it just keeps your follow-up on the right side of a line that a careless mass email crosses.
Understand what the organiser has and has not done
As an exhibitor you sit downstream of the organiser in the data chain, and it pays to understand what that means. The organiser collects the registration data and decides, in their privacy notice, what attendees are told about how their data may be used and shared. When they hand you attendee data, or a scan facility, you inherit responsibility for what you then do with it — and you should not assume that because the organiser gave you data, you are free to use it however you like. Before a show, it is worth knowing what attendee data you will actually receive, on what basis, and what the organiser's notice told those attendees. If that is unclear, it is a signal to be more careful, not less. You cannot fix the organiser's practices, but you can decide how much you rely on them and handle what you are given responsibly.
Real shots from our Frankfurt workshop and European show floors. Click any image to enlarge.
Working within the rules is good practice anyway
For exhibitors, the honest takeaway is not to fear the GDPR but to work within it — which is entirely doable and largely just good lead practice. Understand that the leads you capture are personal data; collect only what you need and tell people why; keep a clear opt-in for ongoing marketing separate from the record of a conversation; be cautious with bought or shared lists; and keep data only as long as you have a reason to. Handled this way, compliance is not a brake on lead generation — it is honest lead capture, which is also how you build the kind of contact list that is actually worth having. An honest closing note: this is general guidance drawn from running stands across Europe, not legal advice. For anything specific to your business's processing, check with your data-protection officer or a qualified adviser, because the details of your situation are what matter.
Related
- GDPR and its impact on exhibition events
- How to maximise ROI from exhibitions
- Expo consultancy
- About SOL Germany
Want this turned into a 3D concept?
Send us your show, plot and goal — we'll design to them, not to a template.
Frequently asked questions
What does the GDPR mean for exhibitors?
Every lead you capture is personal data you are responsible for. Collect it on a lawful basis, make sure people understand what you will do with it, and keep it only as long as you need. This is not a reason to fear the show floor — handled sensibly, compliance and good lead practice point the same way.
Is scanning a badge enough to start marketing to someone?
No. A scan collects personal data for the purpose the person reasonably understood — usually the conversation at your stand. Adding them to an ongoing marketing programme needs a genuine, separate opt-in. Capture only what you need, explain what the scan is for, and keep marketing consent separate from the scan.
Can I use an attendee list sold around a show?
Only with great caution. Using a list of people who never agreed to hear from you, and were never told their details might be shared, is the kind of processing the regulation curbs. That a list is for sale does not make using it lawful — confirm where the data came from and what those people were told first.
How long can we keep exhibition leads?
Only as long as you have a justified reason. Retention must be justified, not indefinite: decide in advance how long you hold show leads, record how each contact reached you and what they agreed to, and delete what you no longer need. This is general guidance, not legal advice — confirm specifics with a data-protection professional.
Further reading: The Benefits of AR and VR in Your Expo Display and Exhibition Stand Fabrication Disasters We've Seen — and How to Avoid Them.
