{"id":8697,"date":"2018-03-22T16:23:27","date_gmt":"2018-03-22T16:23:27","guid":{"rendered":"https:\/\/www.eventmobi.com\/?p=8697"},"modified":"2025-07-23T13:31:28","modified_gmt":"2025-07-23T17:31:28","slug":"the-event-marketers-guide-to-gdpr-compliance","status":"publish","type":"post","link":"https:\/\/www.eventmobi.com\/blog\/the-event-marketers-guide-to-gdpr-compliance\/","title":{"rendered":"The Event Marketer\u2019s Guide to GDPR Compliance"},"content":{"rendered":"

You know that feeling in your stomach? The one you get when there\u2019s something you\u2019ve been putting off for awhile, but there\u2019s a looming deadline that\u2019s getting closer and closer? Well, from the sounds of it that\u2019s how a lot of event marketers are feeling these days about something called the GDPR and GDPR compliance.<\/span><\/p>\n

Sound familiar? For those who might need a refresher, the General Data Protection Regulation (GDPR) is a piece of EU legislation that will be coming into effect on May 25, 2018. It\u2019s all about protecting individuals\u2019 personal data in the digital age.<\/span><\/p>\n

How does GDPR affect event marketers? <\/b><\/h2>\n

As you go about planning, marketing and hosting an event, you\u2019ll likely be collecting and using a lot of personal data. This data may be about your attendees, your speakers, and other event stakeholders. Information like names, job titles, emails, even dietary preferences! All of this is data that will fall under the umbrella of the GDPR as of May 25, 2018. And the GDPR has some pretty specific requirements about the circumstances under which you can collect and use that data.<\/span><\/p>\n

The GDPR identifies two key roles related to the collection, processing and usage of personal data: the Data Controller and the Data Processor. As the event\u2019s organizer, you are a Data Controller. You decide and are responsible for communicating the purpose for which you are collecting personal data from attendees, speakers, and any other event participants. Any event technology providers that you employ will typically act as Data Processors in the context of your business relationship.<\/span><\/p>\n

Let\u2019s bust some myths right off the bat. Some of you may be hoping you can get away with turning a blind eye because your business doesn\u2019t operate in the European Union. Or that you can ensure your compliance with the GDPR. You might do this by guaranteeing you work only with event technology providers that can verify they are GDPR compliant. <\/span><\/p>\n

Unfortunately, neither is true. More on that to come, but the GDPR\u2019s impact is global, and ensuring compliance goes beyond choosing the right event technologies. It includes the activities you carry out every day as part of your job. <\/span><\/p>\n

That means event planners worldwide are going to have to learn <\/span>at least a little bit<\/span><\/i> about GDPR, whether they like it or not. Here are steps that you\u2019ll need to take to protect your business from some pretty serious fines for non-compliance… If you don\u2019t think that your business can take a hit of up to <\/span>\u20ac20 million (or 4% of your global turnover, whichever is higher)<\/span>, then read on.<\/span><\/p>\n

\"GDPR\"<\/h2>\n

So where do we begin?<\/b><\/h2>\n

Before you read any further let\u2019s get one thing straight: none of the below should be seen as a substitute for good legal advice! We also highly recommend you take a good look at the <\/span>official GDPR website<\/span>, the <\/span>FAQs <\/span>p<\/span>age<\/span> in particular. <\/span><\/p>\n

That said, one thing we do know well is the event industry and the people who work in it. As we\u2019ve found ourselves answering many of the same questions repeatedly from our clients, we figured it was about time we share our tips for getting your house in order for the GDPR.<\/span><\/p>\n

Will the GDPR really affect me and my event(s)?<\/b><\/h2>\n

The majority of those reading this blog post should probably assume the answer is yes. If the information you collect about your participants is provided while the individual is in the European Union, or the information is about someone who lives in the EU, GDPR likely applies. This is true even if your event isn\u2019t taking place in the EU.<\/span><\/p>\n

Now, if you\u2019re hosting a small \u201clocals only\u201d event in North America and you\u2019re not offering any tools or services that your attendees might use while they are in the European Union, then you perhaps don\u2019t need to worry. But if you\u2019d like to allow EU residents to participate in your future events, or are looking to offer event technology participants can use away from your venue, GDPR compliance should matter to you. <\/span><\/p>\n

What do I need to do to ensure compliance with the GDPR?<\/b><\/h2>\n

There are a lot of implications of the GDPR, but to sum it up neatly: the way event marketers handle the personal data of their attendees and invitees will need to change. Here are the main areas we recommend event professionals focus their compliance efforts:<\/span><\/p>\n

Running a Data Audit<\/b><\/h3>\n

It might be scary to admit it, but there are many event professionals who don\u2019t fully know the origins of all their data. Some of the names on your list may have come from business cards dropped off at booths, from lists of previous event attendees, or even purchased email lists. <\/span><\/p>\n

Most event marketing databases have been built over a long stretch of time and the data has been sourced using a variety of methods. Few of these databases would hold up to the GDPR\u2019s requirements. These state that you must be able to prove that the people in your database have opted-in to have their information stored and used by you. This means you\u2019ll need to validate the information in your databases if you want to ensure compliance. It may sound like a daunting task, but try to think of it as a chance to clean out the cobwebs and better target your efforts!<\/span><\/p>\n

Reviewing How You Obtain Consent<\/b><\/h3>\n

If you want to keep collecting and using personal data for your future event efforts, you\u2019ll likely need to change the way you obtain consent to use this personal data. <\/span><\/p>\n

Many of our existing approaches wouldn\u2019t pass the test, as the GDPR requires that requests for consent \u201cmust be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent\u201d.<\/span><\/p>\n

We recommend seeking legal advice to ensure your approach is in line with the GDPR. It is encouraged however to make two different lists to get yourself started. Firstly, identify and review all the different ways you gather personal information from people. This includes onsite at your event itself, in forms on your website, through an event registration portal, or within other event technologies. Secondly, ask yourself how you use this data. For instance, do you intend to share attendee information with event sponsors or exhibitors? Going forward, every time you gather personal data you will need to clearly state how that information will be used and enable attendees to opt in or out.<\/span><\/p>\n

Updating Your Privacy Policy and Privacy Notice <\/b><\/h3>\n

Once you\u2019ve gone through the exercise of reviewing where and how you obtain consent, updating your privacy policy and privacy notice is the next step. These two terms have often been used interchangeably, but to ensure GDPR compliance it\u2019s helpful to distinguish between them. Your event\u2019s privacy policy is a document that tells your team how they should handle the personal data you\u2019ve collected. In contrast, a privacy notice is the document you share with participants that informs them what personal data you are collecting and why.<\/span><\/p>\n

Developing Awareness in Your Team <\/b><\/h3>\n

You might be a member of a marketing department, or the owner of an event management company, or perhaps you work for an association that invites its members to events throughout the year – regardless of your situation, odds are you work with other people. You want to make sure everyone is on the same page about the GDPR\u2019s impact. This ensures that nobody is confused about how they need to approach the collection and use of personal data moving forward.<\/span><\/p>\n

There are other areas you\u2019ll want to review with your team. These include your data security practices and what you\u2019ll do in the instance of a data breach. Another are to discuss is how you\u2019ll respond to any potential requests for access to data or data deletion. <\/span><\/p>\n

What should I be asking event technology providers?<\/b><\/h2>\n

[clickToTweet tweet=”The important question to ask your technology providers is not \u201care you GDPR compliant?\u201d – the question you need to ask is \u201chow will you help me ensure my GDPR compliance?” quote=”The important question to ask your technology providers is not \u201care you GDPR compliant?\u201d – the question you need to ask is \u201chow will you help me ensure my GDPR compliance?”]<\/p>\n

Today\u2019s event professionals are using a variety of technologies to collect, store and use their participants\u2019 personal data. Event registration platforms and event apps are two common examples. This means event technology providers have an important role to play in helping ensure your GDPR compliance.<\/span><\/p>\n

However, the important question to ask your technology providers is not “are you GDPR compliant?” – the question you need to ask is “how will you help me ensure my GDPR compliance?”<\/p>\n

You may want to ask whether your event technology provider is capable of:<\/span><\/p>\n