GDPR for Event Organisers: Data, Photos, Email

You don't need consent to sell a ticket, put a name on it or scan it at the door. Under the GDPR, that processing rests on the contract with your guest (Art. 6(1)(b)). You need consent for marketing emails to people who never bought from you, for close-up photos used in advertising, and for health data such as dietary or access needs. On top of that, every organiser must tell guests what happens to their data (Art. 13), delete it on a schedule, sign a processing contract with service providers that handle data for them, and report serious data breaches within 72 hours. This guide sets that out with examples from across the EU, as of November 2026.

Key takeaways

Ticket, order and attendee-name data: lawful basis is the contract (Art. 6(1)(b)). Invoices: legal obligation (Art. 6(1)(c)).

Crowd photos usually work on legitimate interest (Art. 6(1)(f)) with clear notice. Portraits for adverts need consent. National rules on images differ, so check yours.

Marketing email needs consent, except the "soft opt-in" for your own similar events to past buyers (Art. 13(2) ePrivacy Directive), with an opt-out at collection and in every message.

A service that processes data on your instructions needs a contract under Art. 28 GDPR.

Notify your supervisory authority of a breach without undue delay and, where feasible, within 72 hours (Art. 33).

This guide is not legal or tax advice.

Personal data is any information that relates to an identifiable person. At events, that means names, email addresses, order numbers, a QR code linked to a name, scan timestamps, and photos where someone is recognisable.

The GDPR applies as soon as you process such data, except for "purely personal or household activity" (Art. 2(2)(c)). A family birthday is out of scope; a party with tickets on public sale is not.

The controller (Art. 4(7)) decides why and how data is processed. For your event that is normally you. Three basics follow:

Data minimisation (Art. 5(1)(c)): only collect what you need for the ticket and the door. Date of birth, address or phone number need a specific reason.
Transparency (Art. 13): tell people at the time you collect their data.
Records of processing (Art. 30): the exemption for organisations under 250 staff does not apply where processing is "not occasional". If you sell tickets regularly, keep a record. The table below is a good start.

Laughing guests arriving at the illuminated festival entrance, holding up their tickets

Which lawful basis applies to which data?

Don't ask for consent for everything: it can be withdrawn at any time (Art. 7(3)).

Data and purpose	Lawful basis	In practice
Name, email, order and payment details at checkout	Art. 6(1)(b) contract	No consent needed
Attendee name on a personalised ticket	Art. 6(1)(b)	Name only, no extra fields without a reason
Service emails: ticket delivery, door times, cancellation	Art. 6(1)(b)	Contract communication, not marketing
Invoices, refunds, accounting records	Art. 6(1)(c) legal obligation	Keep for the national retention period
QR scan at entry, fraud prevention	Art. 6(1)(b) and (f)	Delete scan logs soon after the event
Guest list plus-ones	Art. 6(1)(b) or (f)	The host informs their guests
Wide shots of the crowd for your website or report	Art. 6(1)(f) legitimate interest	Notice in advance and at the door, right to object
Close-up portraits in adverts, posters, paid social	Art. 6(1)(a) consent	Document it
Newsletter to people who never bought	Art. 6(1)(a) plus ePrivacy rules	Separate, unticked box
Email to past buyers about similar events	ePrivacy soft opt-in, Art. 6(1)(f)	Opt-out at collection and in every email
Dietary needs, wheelchair space, assistance	Art. 9(2)(a) explicit consent	Health data: ask separately, delete early

When is legitimate interest enough?

With Art. 6(1)(f) you balance your interest against the guest's, weighing their "reasonable expectations" (Recital 47). Guests can object (Art. 21), always to direct marketing. Name the interest in your privacy notice (Art. 13(1)(d)).

Don't make the ticket conditional on consent the sale doesn't need (Art. 7(4)). Offer newsletter and photo consent as separate, unticked options.

What must you tell attendees under Article 13?

When you collect data directly from guests, you must inform them "at the time when personal data are obtained" (Art. 13). Online, that means a link to your privacy notice before the order is placed. A short notice with a link to the full text ("layered" information) works well.

Mandatory content, translated into event terms:

A ticketing platform informs buyers about its own processing; your guest list, photos, exports and newsletter remain yours. Answer access and other rights requests within one month (EDPB small business guide).

Yes, with a lawful basis: usually legitimate interest or consent. Rule of thumb:

Motif	Typical basis	Recommendation
Wide shot of a full room, crowd from behind, stage with audience	Legitimate interest	Notice in advance and at the entrance
Performers on stage	Artist contract	Photo clause in the booking agreement
Small group, faces clear, for a recap post	Legitimate interest, case by case	Photographer asks briefly, respects "no"
Portrait of one person for a poster or ad	Consent	Written or electronic, naming purpose and channels
Children who are the subject, not background	Consent of parents	Collect before the event
Closed company party or private function	Usually consent	Guests don't expect publication

National differences: the German example

Art. 85 GDPR lets Member States reconcile data protection with freedom of expression, and they differ. In Germany, the older Art Copyright Act (KUG) allows publishing pictures of "assemblies, processions and similar events" without consent (§ 23(1) no. 3 KUG). The Federal Court of Justice held in 2020 (VI ZR 246/19 and VI ZR 250/19) that the KUG primarily governs journalistic use; an organiser's own marketing falls under the GDPR. A regional authority (Baden-Württemberg) says the KUG's values still feed into the legitimate-interest balancing.

Other countries have their own image rights and authority guidance. Before your first event in France, the Netherlands, Spain or elsewhere, check the local supervisory authority's guidance on photography.

Template: photo notice for the entrance

The following text is an example, not a reviewed legal template.

Photography and filming (example notice)

[Organiser] will take photos and video here for our recap on our website and [channels], based on our legitimate interest in documenting our event (Art. 6(1)(f) GDPR). Close-up portraits in advertising only with your consent.

Prefer not to be photographed? Ask the door team for [a coloured wristband]. Object to a published picture via [email]. Details: [short URL]. Controller: [name, address].

Put the notice up before the door and repeat it in the event description.

Photographer in the middle of the celebrating crowd capturing the cheering audience with confetti

Under Art. 13(1) of the ePrivacy Directive (2002/58/EC, as amended in 2009), direct marketing by email requires prior consent. Art. 13(2) contains an exception often called the soft opt-in: if you obtained a customer's email address "in the context of the sale of a product or a service", you may email them about "its own similar products or services", provided they were given a clear, free and easy way to object when you collected the address and in every message.

Soft opt-in condition	What it means for events
Address obtained in a sale	The person bought a ticket. Free RSVPs and guest-list entries are not a sale in the strict sense.
Your own similar products or services	Your next concert or club night, not a sponsor's offer
Opt-out offered at collection	A visible notice or box at checkout
Opt-out in every message	An unsubscribe link in each email

National wording differs. Germany's version, § 7(3) of the Unfair Competition Act (UWG), requires all four conditions.

For everyone else, use double opt-in: an unticked box, a confirmation email without advertising, and sign-up only after the click. Store the timestamp and consent text. For children, Art. 8 GDPR sets 16 as the default age for consent online; Member States may lower it to 13.

Is a ticketing platform a processor or a controller?

A processor processes personal data on behalf of, and on the documented instructions of, the controller (Art. 4(8)). You need a contract with a processor that meets Art. 28(3). The EDPB's Guidelines 07/2020 explain how to tell the roles apart: what matters is who actually determines the purposes and essential means.

For ticketing, this varies between platforms and even between parts of one service:

A pure white-label shop that stores attendee data only for you typically acts as processor.
A platform that also uses buyer data for its own purposes (its own customer accounts, fraud checks, payment, its own marketing) is a controller for those purposes.
Where both decide purposes and means together, you may be joint controllers (Art. 26) and need an arrangement setting out who does what.

Read the platform's terms, privacy notice and any data processing agreement before you sell, then list the platform in your Art. 13 notice and records under the role the documents describe. A processing agreement must cover, among other things: subject matter, duration and purpose; processing only on documented instructions; staff confidentiality and security (Art. 32); sub-processors only with authorisation (Art. 28(2)); help with rights requests and breaches; deletion or return at the end; and audits.

How long can you keep attendee data?

Only as long as needed for the purpose (Art. 5(1)(e)). Tax law sets minimum periods for accounting records, and these differ by country. Germany, for example, requires invoices and other accounting vouchers to be kept for 8 years since 1 January 2025 (§ 147 AO), counted from the end of the calendar year. Ask your accountant for your country's period.

Data	Keep for	Basis
Invoices, refunds, payout records	National tax retention period (DE: 8 years)	Art. 6(1)(c) plus national law
Guest list, scan logs, attendee names without tax relevance	Until door, settlement and follow-up questions are done	Art. 5(1)(e), Art. 17
Newsletter consent with proof	As long as you send, plus a period to prove it	Art. 7(1)
Dietary and access needs	Delete after the event	Arts. 5 and 9

Example: a concert on 14 March 2026 in Germany. The invoice period starts on 31 December 2026 and ends on 31 December 2034. The guest list is needed only until entry and settlement are done; "30 days after the event" is your own rule, not a legal number. Keep tax records and event data separate.

What do you do after a data breach?

A lost guest list or an export posted in the wrong group chat is a personal data breach. Notify your supervisory authority "without undue delay and, where feasible, not later than 72 hours" after becoming aware, unless the breach is unlikely to result in a risk (Art. 33). Where the risk is high, tell the affected people too (Art. 34). Document every breach, even ones you don't report.

Door helpers act under your authority (Art. 29), so brief them: no photos of lists or screens, scanner links only to briefed people, printed lists shredded afterwards.

How to do this with Eventoren

On Eventoren, buyers check out as guests without an account; each ticket carries an editable participant name and arrives by email as a PDF with a QR code. Before your organisation is approved for sales, read the contract and privacy documents shown during onboarding and file them with your records, so your own notice names the platform correctly.

For need-to-know access, use the team roles: Inhaber, Admin, Eventmanager, Finanzen and Einlass. Give door helpers the Einlass role, or a shareable scanner link that works in the smartphone browser, so they don't see finance data. Scanner links work like keys, so only share them with briefed helpers.

Exports are available as CSV, XLSX, PDF and ICS; deleting downloaded files is your job. A newsletter runs through your own email tool and consent process. Questions? Use the contact form. For the door process, see our guide to QR code ticket check-in, and for the bigger picture, how to sell tickets online in Europe.

Frequently asked questions

Do I need consent to sell tickets under the GDPR?

No. You process name, email and order data to perform the contract (Art. 6(1)(b)). Consent is only needed for extra purposes such as a newsletter for non-buyers, advertising portraits or health data.

Can I post event photos of guests on Instagram?

Crowd shots from a public event can usually rely on legitimate interest if you give notice in advance and at the door and respect objections. Advertising portraits need consent, and children who are the focus need parental consent.

Can I email past ticket buyers about my next event?

Yes, under the soft opt-in in Art. 13(2) of the ePrivacy Directive, if you got the address from a ticket sale, you promote your own similar events, and you offered an opt-out at checkout and in every message. Without the opt-out at checkout, you need consent.

Is my ticketing platform a processor or a controller?

It depends on the platform and the service. A platform that only stores data on your instructions acts as processor and needs an Art. 28 contract. One that uses buyer data for its own purposes is a controller for those purposes. Check its terms and privacy documents.

When do I have to report a data breach?

Without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people (Art. 33 GDPR). If the risk is high, inform the affected people as well.

GDPR for Event Organisers: Attendee Data, Photos and Email