GDPR-compliant event registration: a checklist

A guest list is personal data. Names, email addresses, who came with whom, who asked for a vegetarian menu. For an organiser in the European Union, the GDPR applies from the first registration, not from the first complaint. This checklist is the set of questions a data protection officer will ask, in the order they usually ask them. It is a practical guide, not legal advice; your DPO or counsel has the last word.

1. Who is the controller

You are. The organisation that hosts the event decides why the data is collected and how it is used, which makes it the controller. The tool you use is a processor, acting on your instructions. That distinction decides who writes the privacy notice (you) and who needs a contract (the tool).

2. What is the legal basis

For a registration, the usual basis is the contract or the steps a person asks for before it (Article 6(1)(b)): they want to attend, you need their name to let them in. Public bodies often rely on their public task instead (Article 6(1)(e)). Consent is the wrong basis for the registration itself, because a guest cannot attend without giving the data. Keep consent for things that are genuinely optional, such as a newsletter.

3. What do you collect, and why

Collect what the event needs. Name and email for the ticket, a phone number only if you will call, a dietary preference only if there is food. Every extra field is a sentence in the notice and a question later. If a field could reveal something sensitive, such as a dietary choice that points to a religion, keep it optional and say why you ask.

4. Where is the notice

The Article 13 information belongs where the data is collected: under the registration form, not behind a link in the footer. It names the controller, the purpose, the legal basis, the recipients, the retention period and the rights. Mission Support renders a notice for each organiser from its organisation details, or links to your own if you have one.

5. Which processors touch the data

List them, and know where they are. A registration tool typically runs on a database provider, a hosting provider, a mail provider and, for paid tickets, a payment provider. Ask for the list and the regions. Mission Support runs on infrastructure in Frankfurt, sends mail through a provider in Paris and processes payments through Stripe in Dublin; the guest privacy notice names them.

6. Is there a processor contract

Article 28 requires one between you and the tool. It should cover the instructions, confidentiality, sub-processors, deletion at the end and audit rights. A tool that cannot show you its data processing agreement is a tool to avoid.

7. Does the data leave the EU

Transfers outside the EU are possible but need a mechanism and a paragraph in the notice. The simpler answer is to pick processors that keep the data inside the Union. Ask explicitly; “cloud” is not an answer.

8. How long do you keep it

Set a period and write it down. After the event, the guest list has two remaining purposes: the follow-up you promised, and the records your organisation must keep. Beyond that, delete or anonymise. A tool should do this on a schedule, not leave it to a reminder in someone’s calendar.

9. What happens at the door

The printed list is a data breach waiting on a table. Two hundred names and companions, in a public hallway, copied twice. A phone scanner shows one guest at a time to one person who is signed in. Check-in staff should see the name and the ticket category and nothing more.

10. Who inside your organisation can see what

Roles are a GDPR control, not just a convenience. The person at the door needs the scanner. The event manager needs the list. Billing needs neither. Keep the admin accounts to the people who run events, and remove the temp’s access the morning after.

11. Can you answer a request

Guests have the right to access, correction, deletion and portability. The test is simple: can you produce everything you hold on one guest, in a readable form, within a month, without searching five mailboxes? Mission Support has a per-contact export for exactly this, and a deletion that removes the person from every event.

12. Are the mails compliant

Invitations and reminders to registered guests are part of the event. A campaign to your whole contact list is marketing, which means a legal footer, a working unsubscribe link and respect for it. Send from your own domain, with a reply-to someone reads.

The short version

Decide the basis, collect little, put the notice under the form, know your processors and their regions, sign the contract, set a retention period, get rid of the printed list, limit the roles, and be able to export and delete one guest on request. Most of this is a one-time setup. The public bodies page describes how a ministry or city administration runs it in practice.