GDPR for Teams Capturing Leads at Events: What Managers Sign Off

When your team captures contact details at a show, your business is responsible for how that data is handled. This is general guidance, not legal advice, but it covers the points managers usually need to sign off.

Who is responsible

Your business decides why contacts are collected and how they are used, which makes it the controller under UK GDPR. Any tool you use to capture and store them acts as a processor on your behalf. You should have a data processing agreement in place with that tool's provider.

Lawful basis

Most business contact at shows relies on legitimate interests: a person has spoken to your rep and a follow-up is reasonably expected. Record your reasoning. For marketing emails, also consider the rules on electronic marketing, which can differ for business and personal addresses.

Tell people what happens

Your privacy notice should explain how you use contacts collected at events. Reps should be able to say, simply, that you'll follow up about the conversation.

Keep it within the business

Contacts captured for the business should stay with the business. Avoid reps keeping leads in personal apps or phones. Use a shared workspace, and remove access when someone leaves.

Collect only what you need

Name, company, contact details and notes on the conversation are usually enough. Avoid sensitive details.

Retention

Decide how long you keep leads that go nowhere, and delete or review them after that period.

Checklist for sign-off

• Data processing agreement with the capture tool.
• Lawful basis recorded.
• Privacy notice covers events.
• Data stays in a business-owned workspace.
• Access removed when people leave.
• Retention period agreed.

For more, read GDPR and trade show lead capture and see Beagle team security and data, which sets out the processor role, DPA and sub-processors.