GDPR for trade show leads: a simple guide for exhibitors

Yes, you can scan badges and business cards at a trade show and still follow GDPR. You need three things: a clear reason to use the data (a lawful basis), a short notice that tells people what you will do with it, and a plan to delete leads you do not need. This guide shows how to do all three without slowing down your booth.

Does GDPR apply to trade show leads?

Yes. A name, a work email and a phone number on a badge are personal data. It does not matter that the person gave you the card by hand. If you are in the EU, or you collect data from people in the EU, GDPR applies. The UK has its own version with the same core rules.

The risk is real. For the most serious breaches, fines can reach 20 million euro or 4% of worldwide annual turnover, whichever is higher. Most exhibitors will never see a fine like that, but a clean process also makes your follow-up better.

Which lawful basis to use for event leads

GDPR lists six lawful bases. For trade show leads, two are common: consent and legitimate interest. GDPR itself says that direct marketing may be a legitimate interest, but you still have to balance it against what the person can reasonably expect.

What to tell people at the booth

When you collect data, GDPR says you must tell people who you are, why you use the data and what their rights are. You do not need to read a long text at the booth. A short line works, plus a link to your privacy policy.

• Print a QR code to your privacy policy on the booth wall or the scanning screen.
• Say one sentence when you scan: "We will email you the info you asked for. You can say stop any time."
• Put the same link in the footer of your first follow-up email.

UK rules for B2B email after an event

In the UK, email rules for business contacts depend on who you write to. The ICO says you can send B2B marketing emails to any corporate body without consent, but you must not hide who you are and you must give a way to opt out. Sole traders and some partnerships count as individuals, so you need their consent or a soft opt-in.

How long to keep trade show lead data

GDPR says you should keep personal data only as long as you need it, and collect only what you need. For event leads this means a simple rule: decide a time limit before the show, for example a fixed number of months with no reply, and then delete or anonymise the lead.

If someone says stop, you must stop. GDPR gives every person the right to object to direct marketing, and then their data can no longer be used for it.

GDPR checklist for exhibitors

1. 1

   Step 1: Before the show

   Pick your lawful basis for each type of follow-up. Write a one line notice and add a privacy QR code to the booth.

2. 2

   Step 2: At the booth

   Scan the badge or card, add a short note on what the person asked for, and mark a yes or no for marketing.

3. 3

   Step 3: Right after the show

   Move leads into your CRM, not into loose spreadsheets or photos on personal phones.

4. 4

   Step 4: Follow-up

   Send only what fits the basis you chose. Add an opt-out link to every email. For templates, see our trade show follow-up email guide.

5. 5

   Step 5: Clean up

   Delete leads that pass your time limit and remove anyone who asked to stop.

Where lead data leaks at events

Most problems are not about the law. They are about paper and copies. Business cards in a bag, photos in a phone gallery, a spreadsheet sent by email to five people. Each copy is one more place to protect and one more place to delete later. Fewer copies mean less work and less risk. For a step by step flow, see our guide on how to scan event badges into your CRM.

How Swopi helps

With Swopi, you scan a badge or a business card and the lead lands in your CRM. No typing, no spreadsheet, no box of cards to sort after the show. Swopi connects to HubSpot, Salesforce, Pipedrive and 5,000+ CRMs and apps, so lead data goes straight to the one place your team already protects. See pricing to start.