Run an event and you hold personal data: names, email addresses, job titles, sometimes dietary or access needs. UK data protection law applies to it. This is a short introduction for organisers, written in plain words. It is general information, not legal advice; the Information Commissioner's Office (ICO) is the regulator and has detailed guidance for small organisations.

The principles in brief

The UK GDPR and the Data Protection Act 2018 set out a few principles that are worth keeping in mind for every event:

  • Have a reason. Each use of personal data needs a lawful basis. For a guest list, that is usually that you need it to run the event the person booked. The ICO explains the six lawful bases.
  • Be clear. Tell people what you collect and why, at the point you collect it. A short privacy notice on the booking page does the job.
  • Collect only what you need. If you don't need a phone number, don't ask for one.
  • Keep it safe. Don't leave printed guest lists on the registration table afterwards; don't email spreadsheets around.
  • Don't keep it forever. Decide how long you need the data and delete it after that.

Sensitive details

Dietary needs can reveal religious belief, and access needs can reveal health information. Both are special category data under the UK GDPR and need extra care. Ask only what you need, explain why, share it only with the people who need it (the caterer, the venue) and delete it after the event.

Follow-up emails

Emailing guests about the event they booked is part of running it. Sending them marketing afterwards is different. Electronic marketing is covered by the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR, and usually needs consent, unless a narrow "soft opt-in" applies. The ICO has a guide to electronic marketing. The simple approach: offer a clear, unticked opt-in on the booking form, and honour unsubscribes.

Sharing attendee lists

Attendee lists are tempting to share with sponsors and speakers. Only do it if people were told clearly when they booked and you have a lawful basis. Opt-in networking features, where guests choose to be visible to each other, are safer than a list handed over afterwards.

Photos

If you are taking photos, say so in the joining instructions and at the door, and give people an easy way to avoid being photographed.

People's rights

People can ask for a copy of the data you hold about them, ask you to correct it or, in many cases, delete it. You normally have one month to respond. The ICO sets out the individual rights.

The data protection fee

Many organisations that process personal data must pay a data protection fee to the ICO, unless they are exempt. The ICO has a short self-assessment to check.

How the system helps

On Business Event Stack, guests book through the region's app, which publishes its own privacy policy, and they accept the region's required documents when they sign up. Guests can download everything held about them, or close their account, from their profile without having to ask. Organisers see their own guest lists and can export them as CSV when they need to, so it is worth agreeing in your team who does that and where the file goes. Embedded feeds on other websites don't set analytics cookies.

None of that removes your own responsibilities for the data you hold, but it does mean the common requests can be answered without a long email chain.