Seven trade show marketing data protection checks your stand team needs

What to take away

Start with the consent mistake

Treat a badge scan as a collection of personal data, not as a complete record of permission to contact someone. Check both UK GDPR data-protection duties and the separate rules for electronic marketing.

Why a badge scan is not consent

Badge scanners make it easy to collect a name, job title, email address and phone number in seconds, which hides a legal question. A scan normally records that someone agreed to have their badge read, or that a conversation took place. Neither of those is permission to send marketing emails.

Consent under the UK GDPR must be freely given, specific, informed and unambiguous, and easy to withdraw. If your stand script never says what the person will receive, your evidence is thin. A tick box on a tablet, with the wording saved, holds up better than a verbal yes nobody wrote down.

Business-to-business marketing can sometimes rest on legitimate interests, but that needs a documented assessment. The trade show marketing rules and compliance guide for 2027 sets data duties beside advertising and contract questions, which helps when you write the stand script.

The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) govern electronic marketing. Before sending marketing emails, check whether the recipient is an individual subscriber, such as a sole trader, or a corporate subscriber: the rules differ, and consent or the soft opt-in is generally needed for individual subscribers. For live marketing calls, screen against the Telephone Preference Service and Corporate Telephone Preference Service and respect objections; automated marketing calls require consent. Check the ICO's direct marketing guidance for the rules that apply to your campaign.

Choosing and recording a lawful basis

The UK GDPR's six lawful bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. Choose the basis that fits each purpose and record your reasoning; the Data Protection Act 2018 sits alongside the UK GDPR and sets out the ICO's enforcement powers.

A one-page table covering data type, purpose, basis and retention is enough. Keep it where the stand team can find it.

Check whether your organisation must pay the ICO data protection fee; exemptions apply, so use the ICO's fee self-assessment. Also check whether Article 30 of the UK GDPR requires your organisation to keep records of processing activities, including the purposes and categories of data you handle.

Build retention and supplier rules into the stand plan

Set these rules before the event and make sure stand staff and suppliers know who is responsible for each task. Include deletion, data subject requests and supplier access in the plan.

Set retention periods and a deletion routine

Decide how long leads stay in the system. For example, a team might agree a 90-day window for scanned badges and six months for quotes that were requested. Whatever you pick, write the date down and diarise the deletion.

Export the list, remove duplicates and people who opted out, then log what you deleted and when. Deletion is harder to evidence than collection, and it is the part complainants ask about first.

What to ask exhibit suppliers

Stand builders, registration platforms, AV contractors and scanner vendors may handle attendee data for you. Where a supplier acts as a processor, agree the required processing terms, get its sub-processor list and set breach-notification timescales in writing. Check whether any supplier access involves a restricted international transfer; appropriate safeguards can include the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

The quality management standards from BSI can help you assess whether a supplier has documented processes. They do not replace checks on the supplier's data-protection terms, security and any international transfers.

Run the checks in order before the show opens

Use the sequence below as a pre-show checklist. It separates data-protection tasks from other stand-planning matters.

The seven-step sequence

Separately, for screen-work health and safety, consult HSE display screen equipment guidance. This is not one of the seven data-protection checks.

After the show: requests and complaints

Attendees can ask what you hold, request deletion or withdraw consent. For most data subject requests, respond without undue delay and within one month; limited extensions may apply. If a personal data breach is reportable, notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it; your processor should tell you without undue delay. Name one person and one inbox for requests and breach reports.

Data protection law applies across the UK, while venue and local expectations differ between England, Scotland, Wales and Northern Ireland. The trade show marketing regulations in England explains how those local expectations interact with data duties, which is useful when your next event crosses a border.

Common questions

Does a scanned badge count as consent to email someone?

No. A scan alone is not evidence of consent to marketing. Identify your UK GDPR lawful basis and check PECR: rules for emails differ between individual and corporate subscribers, while live marketing calls must be screened against the relevant preference services and automated marketing calls require consent.

How long can we keep trade show leads?

There is no single statutory period. Set a window you can justify from the purpose, then delete on time. An indefinite list is the hardest position to defend.

Who is responsible if the scanner vendor has a breach?

You are normally the controller for attendee data you collect, so monitoring the processor is your job. Your contract should say what the vendor must tell you and how quickly.

Do we need a privacy notice on the stand?

Yes. Give people privacy information when you collect their details. A short notice at the scanner, or on the tablet before the scan, should identify your organisation and explain the purposes, lawful basis, retention, recipients and their rights; it can point to a fuller notice. Explain how to opt out of marketing where relevant.