Since 2018, the GDPR (General Data Protection Regulation) has governed the handling of personal data across the EU. For events, this affects the entire participant journey: registration, payments, photo and video recordings, data sharing with sponsors, and collaboration with service providers such as hotels and IT vendors.
Scope: EU-wide, plus EU citizens worldwide
Fines: Up to €20 million or 4% of annual turnover
Supervisory authority: State Data Protection Commissioners (DE)
Why the GDPR is critical for event organizers
A conference naturally collects large amounts of personal data: registration details, payment information, photographs, behavioral data in the event app, and lead handovers to sponsors. The GDPR requires that there is a legal basis for each of these processing activities, that the individuals concerned are informed, and that their rights (access, deletion, withdrawal) can be exercised at any time.
Violations can not only lead to significant fines but—perhaps worse—reputational damage within the community and a loss of trust among speakers, sponsors, and participants.
Data flows at a conference
The GDPR covers every stage of the participant lifecycle at a conference:
- Registration: Collection of master data, tickets, payment information
- Communication: Sending confirmations, reminders, newsletters (consent required!)
- Payment: Transmission to payment service providers, storage of billing data
- On-site: Check-in scans, photo and video recordings, Wi-Fi logins if applicable
- Event app and platform: Profiles, networking contacts, behavioral data
- Exhibitor contacts: Lead retrieval, business card exchange
- Follow-up: Certificates of attendance, surveys, evaluations
- Archiving: Retention for accounting, follow-up events, legal obligations
Obligations in detail
Legal bases
Every data processing activity requires a legal basis. Typical examples for events:
- Contract performance (Art. 6 (1) (b)) for ticketing, check-in, certificates
- Legal obligation (lit. c) for accounting, retention periods
- Legitimate interest (lit. f) with balancing of interests – e.g., for event photos
- Consent (lit. a) for newsletters, photo publication, lead handover
Information obligations
At the latest during registration, a privacy policy must inform users about all processing activities—who is processing what, for what purpose, for how long, who it is shared with, and what rights exist.
Data Processing Agreement (DPA)
A Data Processing Agreement must be signed with every service provider that processes personal data (conference software, email marketing, hotel, print shop, lead retrieval)—in writing, before the first data flow occurs. Converia provides a template developed in collaboration with data protection officers from universities and PCOs. It works for almost all cases but can be adapted if necessary.
Data minimization
Only collect data that is necessary for the specific purpose. Example: Only ask for a date of birth if it is truly required (e.g., for CME reports) – otherwise, omit it.
Deletion policy
Clear deadlines for when specific data will be deleted. Accounting data is kept for 10 years, marketing data usually for 2–3 years, and attendee data without a follow-up event typically for 1–2 years. Converia supports this with its own data cleansing tools.
Special topic: Photo and video recordings
Event recordings are a classic source of GDPR violations. To be safe:
- Posting signs at the entrance notifying people of recordings is legally insufficient if individuals are clearly identifiable.
- Active consent (e.g., via registration form or a different colored lanyard for "no photos") is best practice.
- Speakers and panelists require separate image rights agreements.
- Publication on social media is a separate processing activity and requires its own consent.
- Live streaming has additional rules (viewer data, recording rights).
Sponsorship and lead handover
Transferring attendee data to sponsors is only possible with active, granular consent from the attendees – blanket "you consent to data transfer" clauses are invalid. In practice, this means:
- At a booth, the badge is only scanned after a conscious action by the attendee.
- Include a separate opt-in in the registration form for "data may be shared with exhibitors."
- Lead retrieval devices must document the time and location of the scan (burden of proof).
Practical checklist
- Current privacy policy linked in the registration form and on the website.
- Data Processing Agreement (DPA) signed and archived with all service providers.
- Record of processing activities maintained.
- Data Protection Officer appointed (required if 20+ people process data regularly).
- Consents documented by version (which version was agreed to and when).
- Deletion and blocking periods technically implemented.
- Employees and volunteers committed to data privacy.
- Emergency plan for data breaches (mandatory reporting within 72 hours!).
GDPR compliance in Converia
Converia is designed to be GDPR-compliant from the ground up: hosting in EU data centers, with a Data Processing Agreement included.
Data protection as a standard, not a hurdle
With Converia, you fulfill your event's GDPR obligations without extra effort – because the platform meets the requirements out-of-the-box.
- Payment management – Ticketing & Registration
- Attendee management – Ticketing & Registration
- Event registration – Ticketing & Registration
EU hosting, granular consent, Data Processing Agreement included – GDPR is standard, not an add-on.