ICO badge scanning rules for UK exhibitors and stand teams

What to take away

What UK GDPR and PECR mean at the exhibition stand

The Information Commissioner's Office (ICO) is the UK regulator for data protection. At an exhibition stand in Birmingham, Manchester or London, every scanned badge is personal data processing.

UK GDPR sets the principles: lawfulness, fairness and transparency, then purpose limitation, data minimisation and accuracy. Storage limitation and accountability follow. The ICO's UK GDPR guidance and resources explains these obligations for collecting and using personal data at trade shows. The exact guidance is the Guide to the UK General Data Protection Regulation (UK GDPR) at ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/.

PECR is separate from UK GDPR. It governs how you contact people by email, phone and text after the show. The ICO's Guide to Privacy and Electronic Communications Regulations covers the consent and opt-out rules for electronic marketing.

A stand team in Scotland or Wales faces the same rules as one in the West Midlands. Venue location does not change the law. What changes is the event organiser's own registration process, which may already collect consent on your behalf.

Exhibitors often assume the organiser handles everything. That is wrong. If you scan a badge, you decide why and how to use that data.

Good trade show marketing data protection checks start with a simple question: what will we do with this scan? If the answer is vague, the processing is likely unfair.

Badge scanning: who is the controller and who is the processor

The exhibitor is normally the data controller for badge scans it collects. The event organiser may be a controller for its own registration data, and a processor if it scans on your behalf under contract.

This distinction matters. A controller decides the purpose and lawful basis. A processor only acts on documented instructions. If you rent a scanner from a supplier, that supplier is usually a processor.

Get the roles in writing. Your contract with the organiser should say who is the controller for scan data, what the supplier may do with it, and when it is deleted.

If an organiser offers to sell you attendee lists, treat that as a separate data broker arrangement.

Some organisers act as joint controllers with exhibitors for certain scans. Joint controllership means you share responsibility for transparency and rights. Ask before the show.

A lead capture app that stores scans on a server is processing. Check where that server is and who can access it. International transfers need safeguards under UK GDPR.

The ICO's business-to-business marketing guidance notes that B2B marketing data protection rules still apply to corporate contacts. A work email address is personal data if it identifies a person.

Privacy notices and consent wording for lead capture

A privacy notice at the stand must be concise, transparent and easy to access. A QR code to a one-page notice works. A dense legal document does not.

The notice should name your company, say what you will do with the scan, give the lawful basis, state retention, and explain rights. It must also mention if you will share data with partners or data brokers.

Consent wording must be specific and granular. "I agree to receive marketing" is weak. A model sentence: "Tick here to receive emails about [product] from [Company]. We will keep your details for 18 months. You can unsubscribe at any time."

Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes do not count, and neither does a condition that you must scan to enter a prize draw.

If you rely on legitimate interests instead of consent, you still need an easy opt-out and a legitimate interests assessment.

For PECR, soft opt-in may cover existing customers, but not cold badge scans. A scanned badge from a stranger is not an existing customer relationship.

Keep the exact wording you used. If the ICO asks, you must show what people saw when they agreed. The same applies to trade show marketing survey tools, where consent wording is often buried.

Version your consent wording and keep a dated copy of each version. For example, if you updated the prize draw wording on 14 May 2024, save it as version 2.1 and note where it was used.

For a prize draw with no marketing consent, use: "Enter our prize draw. We will use your details only to contact the winner and delete them 30 days after the draw."

Lawful basis for B2B follow-up after the show

UK GDPR requires a lawful basis for every follow-up. The common ones are consent, legitimate interests and contract.

For cold B2B email, PECR generally requires consent. There is a narrow soft opt-in for existing customers, but it does not cover a badge scan from someone who never bought from you.

The Data Protection Act 2018 sets out the UK framework for lawful bases and exemptions. It sits alongside UK GDPR and PECR.

Legitimate interests can work for postal marketing or some B2B calls, but you must balance your interests against the individual's rights. Record that balancing test.

If you promise to send a brochure, that may be contract or legitimate interests. If you add that person to a monthly newsletter, you need a separate basis.

Segment your leads by basis. Scans with consent can receive email marketing. Scans without consent may only receive the information they asked for.

Trade show marketing measurement needs a plan before you decide what data to collect, because attribution affects lawful basis and retention.

Cookies and storage technologies on event registration sites

Event registration sites use cookies and similar technologies. PECR requires consent for non-essential cookies, including analytics and advertising pixels.

If you embed your own tracking on an organiser's registration page, check who obtains cookie consent. The organiser may not cover your pixels.

Badge scanners that store data locally may use device storage. That can fall under PECR storage rules, so tell attendees what is stored. At the stand, any lead capture that links to your landing page must have a compliant cookie banner. No cookie walls, no pre-ticked boxes, no implied consent from scrolling.

The ICO's Guide to Privacy and Electronic Communications Regulations (PECR) at ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/ explains the cookie rules and the exceptions for strictly necessary cookies. Marketing cookies need consent. Keep a record of your cookie audit. If you use a lead capture platform, ask what cookies it sets and where data goes.

The ICO enforcement approach to lead capture and data brokers

The ICO's Enforcement action page shows fines, reprimands and audits across marketing and data brokering. The regulator acts on complaints and its own intelligence.

Data brokers that sell attendee lists are a priority. If you buy a list, you inherit risk. You must check the seller's lawful basis and consent chain.

The ICO has taken action against companies for nuisance calls and unlawful marketing. For example, in 2019 the ICO fined Bounty UK Ltd £400,000 for sharing personal data without consent. Badge scanning sits in the same regulatory space when consent is missing.

Enforcement can include monetary penalties, enforcement notices and audits. Reputational damage at a UK trade show can be worse than the fine.

Exhibitors should keep evidence: consent wording, privacy notice versions, retention schedules and staff training records. The ICO expects accountability.

If you receive an information rights complaint, respond within one month. Ignoring it invites escalation.

Data subject requests and retention for scanned leads

Attendees can ask for access, correction, deletion, restriction or portability of their data. You must respond within one month.

Your lead capture system must be able to find a person by name or email. If scans sit in a spreadsheet on a laptop, you may fail.

Retention should be defined. A common approach is 12 to 24 months for marketing leads, then delete or anonymise. Do not keep scans indefinitely.

If you use a CRM, set automated deletion rules. Document why you chose the period. "Forever" is not a retention policy.

When someone withdraws consent, stop marketing immediately. Suppression lists are allowed to honour opt-outs.

For badge scans, the scan itself may include a photo or QR code. Treat that as personal data and secure it.

A stand team checklist for trade show marketing data protection

Use this before every UK show.

For a worked example, imagine a stand at a Birmingham show. You scan 200 badges with consent for a product demo email. You also scan 50 without consent for a prize draw. Only the 200 receive marketing. The 50 receive only the prize result. After 18 months, delete both sets unless consent is refreshed.

Follow these steps on the day.

If you use badge scans as an attribution method, make sure the consent covers that analysis, because the scan data must be lawful before you report on it.

Finally, document your decisions. The ICO's enforcement approach rewards evidence. A simple record of what you did, why and when is enough to show accountability.

Common questions