- \n
- What personal data you are collecting<\/li>\n
- What you will use this data for<\/li>\n
- If you share this data with any third party<\/li>\n
- Where and how the data is stored<\/li>\n
- How long you will store the data for<\/li>\n<\/ol>\n
You also have a responsibility to ensure the data is stored securely; more on this later.<\/p>\n
Event Organiser Best Practices for GDPR<\/h2>\n
There are many things you must do to ensure your event planning activities are GDPR-compliant. It\u2019s not going to be easy or fun, but we\u2019re here to help you through the process.<\/p>\n
1. Create a Data Audit<\/h3>\n
The term data audit probably makes you want to curl up into a little ball underneath your desk, but it\u2019s simply a document that maps out what data you collect on your attendees, how you use this data, and where it is stored.<\/p>\n
You are required under GDPR legislation to perform a data audit. This step will also help you to better prepare for the next steps listed below.<\/p>\n
Download or free GDPR data audit template<\/a> to help you knock this out of the park in under 30 minutes.<\/p>\n
2. Be Clear What You Will Use Attendee Data For<\/h3>\n
When someone signs up for your event, they will be providing their full name and email address along with any other data you collect. If you\u2019re going to use this data for any purpose other than checking them into your event, then you should clearly state this on your event registration page.<\/p>\n
For example, if you plan on emailing them news relating to the event or future events, then make this clear to them when they are booking a ticket.<\/p>\n
We recommend that you write a privacy policy that explains what you will use the data for and then link to this on your event registration page.<\/p>\n
3. Decide How Long You Will Retain Data<\/h3>\n
You should also explain to your attendees how long you will hold onto their data. Ideally, you should only store the data for the length of time that it is required for the purposes for which it was processed.<\/p>\n
In other words, after your event has ended \u2013 you should remove the attendee\u2019s data. If you plan on storing it for longer, then make this clear to your attendees and state the reasons why you are retaining it.<\/p>\n
4. Ask for Consent<\/h3>\n
When someone registers for your event and you plan on sharing their data with a third-party (such as an event sponsor), or you\u2019re going to send them marketing emails; then always<\/strong> ask for their consent to do so.<\/p>\n
Third-parties also include any services that you use to manage attendee data, like your event registration tool or Facebook ads if you\u2019re using mirror audiences.<\/p>\n
When an attendee registers for one of your events, you can contact them with marketing offers that relate to your event, but you must give them the option to opt-out of receiving communications from you free of charge.<\/p>\n
Always avoid using pre-ticked consent boxes for this. You can create opt-in boxes easily on Get Invited by adding a custom question.<\/a><\/p>\n
It\u2019s not just attendees you need to be concerned about either. If you\u2019re going to share a speaker\u2019s photograph and bio on your website or social media, make sure you ask for their consent to do this. Most people won\u2019t object, but it\u2019s courteous and good practice to ask.<\/p>\n
The same applies to taking photos of people at your event, always ask consent before sharing photos online.<\/p>\n
5. Provide Easy Opt-Outs<\/h3>\n
Attendees can withdraw their consent at any stage \u2013 if you\u2019re sending email marketing campaigns, ensure you have a clear unsubscribe link to opt-out at any time. Use an email service like MailChimp<\/a> to send email campaigns, and it will automatically include an unsubscribe link for you in every email.<\/p>\n
Attendees also have the right to object to receiving marketing emails; having their data shared with third-parties, or their data being used for automated decision making.<\/p>\n
6. Provide Personal Data When Requested<\/h3>\n
Under GDPR, every attendee of your event has the right to obtain a copy of the data you hold on them. This must be provided within 30 days, free of charge.<\/p>\n
Your data audit from point #1 should document the data you hold on your attendees and where it is stored, so you should be able to easily locate it and send it to them.<\/p>\n
7. Edit or Delete Personal Data Upon Request<\/h3>\n
If the information you hold on an attendee is inaccurate, you must be able to edit this upon their request. If you have shared incorrect details with a third-party, then it is your responsibility to correct any inaccuracies.<\/p>\n
Attendees also have the right to request that you delete any data you hold on them. Ensure you have the means and know-how to achieve this upon request.<\/p>\n
8. Ensure Good Security Practices<\/h3>\n
Make sure you choose secure passwords for any services you use for storing attendee data and don\u2019t share these passwords with anyone else. Never store attendee data on any service that isn\u2019t password protected.<\/p>\n
If you\u2019re sharing data with a third-party, like a sponsor or hotel, then make sure you understand and agree with their security practices.<\/p>\n
Ensure that all team members adhere to the same security practices, and if a member of staff leaves your team \u2013 always make sure that you revoke access to any online services they have access to.<\/p>\n
Your security practices should also extend beyond the digital realm \u2013 avoid using printouts of attendee lists at your event as these can easily be lost or stolen. Instead, use a digital check-in application like the free Get Invited app for managing attendees at your event.<\/p>\n
What to Do in Case of a Data Breach<\/h2>\n
![\"\"](\"https:\/\/i1.wp.com\/static.tapfiliate.com\/59d78d68bd2d6.png?ssl=1\")
<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"