Every visitor whose badge you scan or business card you collect at an exhibition is protected by UK GDPR, and the moment you capture that data you're responsible for using it lawfully — not just chasing the lead. The rules aren't complicated, but they're easy to get wrong on a busy stand: the two things that matter most are having a lawful basis for contacting someone afterwards, and being honest about what you're collecting and why at the point you collect it.
What Counts as Personal Data on Your Stand
A scanned badge, a business card, a name typed into a lead capture app — all of it is personal data under UK GDPR the moment you hold it. This applies whether you're using the show's official badge-scanning app, a dedicated lead capture tool, or a paper form, and it applies regardless of how informal the exchange felt on the day.
Lawful Basis: What You Actually Need
You need a lawful basis to contact someone after the show, not just their consent to scan a badge. "Legitimate interest" often applies to a genuine follow-up related to what was discussed on your stand, but a blanket import of every scanned badge into a marketing email list without a clear basis is where exhibitors get this wrong. Be specific with your team about what "following up" actually means for different types of visitor before the show, not after.
Transparency at the Point of Capture
Tell visitors clearly what you're collecting and why before you scan or note anything down — a simple line on your stand or from your team ("we'll follow up by email about what we discussed today") covers most of this. Avoid vague blanket statements and avoid collecting more than you'll actually use — job title and company size might be relevant; home address almost never is for a B2B follow-up.
Storage, Retention and Third Parties
Don't hold scanned lead data indefinitely — have a retention policy and delete data for leads that clearly went nowhere. If you're using a third-party lead capture app or CRM, that's a data processor relationship with its own obligations, so check what the provider actually does with the data, not just what your team does with it afterwards.
Frequently Asked Questions
Is scanning a visitor's badge at an exhibition covered by GDPR?
Yes — any personal data you capture, including via badge scanning, business cards or a lead capture app, is covered by UK GDPR from the moment you hold it.
Can I email everyone whose badge I scanned after the show?
Only if you have a lawful basis to do so — typically legitimate interest tied to what was actually discussed on your stand, not a blanket import into a general marketing list.
What should I tell visitors before scanning their badge?
A clear, simple statement of what you're collecting and why — for example, that you'll follow up by email about what was discussed — rather than a vague or absent explanation.
How long can I keep exhibition lead data?
There's no fixed rule, but you should have a retention policy and delete data for leads that clearly went nowhere rather than holding it indefinitely.
Need a lead capture process that's actually compliant? Talk to us.
