GDPR and Its Impact on Exhibition Events
GDPR didn't just change how exhibitors handle leads — it reshaped how the whole event handles data, from registration to badge scanning to the lists organisers share.
GDPR didn't just change how exhibitors handle leads — it reshaped how the whole event handles data, from registration to badge scanning to the lists organisers share. Understanding the wider picture helps exhibitors work within it and ask the right questions. This is general information, not legal advice; confirm specifics with a data-protection professional.
Registration and attendee data
From the moment attendees register, an event is processing personal data, and everyone in the chain has obligations under the GDPR. The organiser collects names, job titles, contact details and often dietary or accessibility information; that data has to be gathered on a lawful basis, described in a clear privacy notice, and kept only as long as it is needed. For exhibitors, the practical point is that you rarely control the registration data directly — you receive it, or a slice of it, from the organiser — and you inherit responsibility for whatever you then do with it. Before an event, it is worth knowing exactly what attendee data you will be given, on what basis, and what the organiser's notice told those attendees would happen to it. If the answer is unclear, that is a signal to slow down rather than a detail to skip.
Badge scanning and lead retrieval
Badge-scanning systems make lead capture easy, and that ease is exactly where teams get careless. When you scan a badge, you are collecting personal data, and the person being scanned should reasonably understand what that means: who you are, why you are capturing their details, and what you will do next. A scan is not a blanket licence to add someone to a marketing programme forever. The disciplined approach is to capture only what you need, tell people plainly what the scan is for, and separate a genuine opt-in to ongoing marketing from the simple fact of a conversation at a stand. Train the stand team on this before the show, because the failure here is almost never malicious — it is a busy salesperson scanning everything that moves and sorting it out later. Later is where the compliance problem lives.
Shared and purchased lists
Attendee lists offered or sold around an event are a classic GDPR risk, and the temptation is real: a ready-made list of everyone at the show, for a fee, lands in your inbox weeks beforehand. Treat it with caution. Using a list of people who never agreed to hear from you — who have no relationship with your company and were never told their details might be passed on — is precisely the kind of processing the regulation exists to restrain. The fact that a list is for sale does not make it lawful for you to use. Before you touch a purchased or shared list, ask where the data came from, what those individuals were told, and whether there is any lawful basis for you to contact them. If you cannot answer those questions confidently, the safe and correct decision is not to use it.
Consent, follow-up and retention
The days after a show are when good intentions meet reality. You come home with a stack of scanned leads, and the pressure is to email all of them immediately. Slow down enough to separate the leads by what actually happened: someone who asked you to follow up is different from someone whose badge was scanned in passing, and different again from a name on a bought list. Your follow-up should reflect that. Keep a record of how each contact came to you and what they agreed to, so that if anyone later asks why they are hearing from you, you have an honest answer. And do not keep the data forever by default — retention has to be justified, so decide up front how long you will hold show leads and delete what you no longer need. None of this slows a real sales process; it simply keeps the follow-up on the right side of a line that a careless bulk email crosses.
Real shots from our Frankfurt workshop and European show floors. Click any image to enlarge.
What this means for organisers
Organisers carry significant responsibility, because they sit at the top of the data chain. Transparent registration, a clear and honest privacy notice, careful handling of the attendee database, and a considered position on what data is shared with exhibitors and sponsors all fall to them. When an organiser is sloppy — an opaque notice, a database shared loosely, no clarity on what exhibitors may do with scans — the risk propagates to everyone on the floor. As an exhibitor you cannot fix the organiser's practices, but you can choose how much you rely on them: understand what you are being given, confirm the basis for it, and do not assume that because the organiser handed you data, you are free to do anything you like with it.
Working within it
For exhibitors, the practical takeaway is not to fear the GDPR but to work within it, which is entirely doable. Understand the data you are given and on what basis; capture only what you need at the stand and tell people why; keep a clear opt-in for ongoing marketing separate from the record of a conversation; be cautious with shared or purchased lists; and hold data only as long as you have a reason to. Handled this way, compliance is not a brake on lead generation — it is simply doing lead capture honestly, which is also how you build the kind of contact list that is worth having. One honest note to close on: this is general information drawn from running stands across Europe, not legal advice. For anything specific to your company's processing, confirm it with your data protection officer or a qualified adviser, because the details of your situation are what matter.
Related
- GDPR for exhibitors: an expo perspective
- How to ensure secure meetings and events
- Expo consultancy
- About SOL Germany
Want this turned into a 3D concept?
Send us your show, plot and goal — we'll design to them, not to a template.
Frequently asked questions
How does the GDPR affect exhibitions?
It governs the whole chain — attendee registration, badge scanning and the lists shared around an event. Personal data must be collected on a lawful basis, people should understand what happens to their details, and it should be kept only as long as needed. Exhibitors inherit responsibility for whatever they do with the data they receive or capture.
Can I use an attendee list offered around a show?
Treat it with caution. Using a list of people who never agreed to hear from you, and were never told their details might be passed on, is the kind of processing the regulation restrains. The fact that a list is for sale does not make it lawful to use. Confirm where the data came from and what those people were told before you touch it.
Is scanning a badge enough to add someone to my marketing list?
No. A scan captures personal data for the purpose the person reasonably understood — usually the conversation at your stand. Adding them to an ongoing marketing programme needs a genuine, separate opt-in. Capture only what you need, tell people what the scan is for, and keep the marketing consent distinct from the fact of the scan.
How long can we keep leads from a show?
Only as long as you have a justified reason to. Retention has to be justified rather than indefinite, so decide up front how long you will hold show leads, record how each contact came to you and what they agreed to, and delete what you no longer need. This is general guidance, not legal advice — confirm specifics with your data protection officer.
Further reading: GDPR for Exhibitors: An Expo Perspective and Why It's So Important to Have the Right Exhibition Logistics and Design Company.
