Is badge scanning legal at a UK exhibition?

Who is actually responsible for the data

Two organisations are involved, and they are separate controllers. The organiser collects the registration data and prints the badge; that is its processing, under its own privacy notice. You collect the lead when you scan or photograph that badge; that is your processing, under yours.

The practical consequence is that you cannot point at the organiser if someone asks you to delete their details. If the record sits in your CRM, you are the controller for it, and the visitor’s request comes to you.

• The organiser is the controller for registration, badge issue and show entry.
• You are the controller for the lead you capture on your stand, including anything you write in the notes field.
• A lead file handed over by the organiser does not make the organiser responsible for how you then use it.

Which lawful basis actually applies

For B2B follow-up, legitimate interests is usually the honest basis. You are a business that spoke to a person at a trade show, and following up on that conversation is a reasonable expectation. Legitimate interests still requires a three-part test recorded somewhere: you have a genuine interest, the processing is necessary for it, and it is not overridden by the individual’s rights and expectations.

Consent is the basis most exhibitors assume they are using, and it is usually the weaker choice. A scan at a busy stand is not informed consent to indefinite marketing, and if you rely on consent, withdrawing it has to be as easy as giving it. Where the badge contains a QR code the visitor scans themselves to share details, that is a much better consent moment, and worth designing for.

• Legitimate interests: record the interest, the necessity and the balancing test once, and keep it.
• Consent: only if it is genuine, specific, recorded, and as easy to withdraw as to give.
• If you are relying on legitimate interests, an opt-out at the stand and in every email is not optional good manners; it is the safeguard that makes the basis hold.

What you may email afterwards (PECR)

UK PECR draws a line between individual subscribers and corporate subscribers. Unsolicited marketing email to an individual subscriber needs consent, with a soft opt-in exception where details were collected in the course of a sale or negotiations for a sale. Corporate subscribers, meaning limited companies, LLPs and public bodies, sit outside that consent requirement.

That is why B2B follow-up to a work address at a limited company is generally permitted without prior consent. It is not a licence to send anything to anyone: every marketing email must still identify who you are and offer a simple way to opt out, and sole traders and partnerships are individual subscribers, so the stricter rules apply to those addresses.

• Marketing to a named person at a limited company: allowed without consent, with identification and an opt-out.
• Sole traders and partnerships: treat as individual subscribers, so consent or the soft opt-in is needed.
• A genuine service message about the conversation you had, such as a sample you promised, is not the same as a campaign.

What a badge actually contains, and what to leave behind

A typical exhibition badge carries a name, company, job title and the email used to register, often plus a phone number. That is enough for the follow-up you promised. It is not an invitation to enrich the record with a home address, a personal mobile or a scraped social profile.

Be careful with the fields nobody thinks about: dietary requirements, accessibility needs, visa letters or medical notes sometimes appear in registration data and are special category data. Do not copy them into a lead record, and do not let a free-text notes field become the place they end up.

• Capture the work identity you need for the follow-up, not everything the badge prints.
• Never carry special category data, such as health or accessibility details, into a CRM.
• Notes should describe the conversation, not the person’s personal circumstances.

What to say at the stand

Transparency at the point of collection is the part that carries the most weight with the ICO and the least effort at the stand. A short, plain sentence plus a QR code to your privacy notice covers it, and it takes less time than scanning the badge.

The test is whether a visitor would be surprised by what happens next. If they would be, the notice is not doing its job.

• "We will email you about what we discussed today, and you can tell us to stop at any time."
• A QR code to your privacy notice, visible from the aisle, not buried under the counter.
• An obvious way to decline: “no scan, thanks” should be as easy as yes.
• If you are recording a voice note, say that you are recording it.

How long you can keep a lead

There is no fixed legal period for exhibition leads. What the law requires is that you decide a period, write it down, and then actually delete at the end of it. “Forever, because the CRM does” is the answer that causes trouble, because it fails the storage limitation principle and it is impossible to defend in a complaint.

A defensible default for a B2B lead is a defined window from capture, extended only when there is a live conversation, and shortened for anyone who has objected or never engaged.

• Set a retention period per event, for example 24 months from the show, and record it.
• Delete at the end of it, automatically if your tools allow.
• Keep a suppression list of people who asked you to stop, so you do not re-add them at the next show.
• A lead who replies is a live conversation; a lead who never opens anything is a deletion candidate.

The requests you will actually get

Most requests after a show are small: “where did you get my details”, “delete me”, “stop emailing me”. Each has a one-month deadline, and none of them require a lawyer. What they require is that you can find the record, and that whoever answers the inbox knows what to do.

• Access: send them the record you hold about them, which for a lead is usually one paragraph.
• Erasure: delete the lead and stop the follow-up sequence.
• Objection: stop using their details for marketing, and note that you did.
• Rectification: fix a misspelled company or a job title they have moved on from.
• If you cannot resolve it, the visitor can complain to the ICO, and that is stated in your notice.

Where StandProof fits

StandProof is a tool, not a compliance officer. What it does is keep the record on your event, under your account, with a consent status on every lead so a rep can mark a visitor as having declined, and a CSV export you can use to delete on schedule rather than leaving data stranded in a vendor platform.

It does not decide your lawful basis, write your privacy notice or answer a subject access request for you. Those stay with you, as the controller.

• Every lead carries a consent status: confirmed, implied B2B, or declined.
• Your leads live on your event and are exportable and deletable at any time.
• Photographs of badges are stored privately and served through short-lived signed links.