GDPR and Trade Show Lead Capture: What Exhibitors Need to Know

Every business card you photograph and every voice note you record about a prospect is personal data. That means data protection law applies to your lead capture, whether you thought about it or not. This is a plain-English guide for UK exhibitors, updated for the changes that came into force in 2026. It is general information, not legal advice, so check anything specific with the ICO or a data protection specialist.

You are probably the data controller

When you capture a lead, you decide why you are collecting it and what you will do with it. In data protection terms that usually makes you the data controller, and the controller carries the main legal responsibilities. The tools you use to store and process those leads are typically your data processors, acting on your instructions.

That split matters, because the obligations below sit with you as the exhibitor, not only with your software.

Your lawful basis for capturing a lead

You need a lawful basis to collect and use someone's data. For business-to-business lead capture, the usual basis is legitimate interests: you have a genuine business reason, and it is balanced against the person's rights. Document that reasoning in a short legitimate interests assessment so you can show your thinking. Consent is the alternative, and it has to be freely given and specific, not assumed because someone stood at your stand.

Whatever the basis, be transparent at the point of capture. People should be able to find out who you are and what you will do with their details, usually through a privacy notice you can point them to.

Following up: the PECR rules and the bigger fines

Sending marketing emails or making marketing calls is governed by PECR, the Privacy and Electronic Communications Regulations, which sits alongside UK GDPR. The important 2026 change is enforcement: PECR fines used to be capped at £500,000, and under the Data (Use and Access) Act 2025 they now reach the same ceiling as UK GDPR, up to £17.5 million or 4% of global annual turnover, whichever is higher. Getting marketing consent wrong is now a lot more expensive.

In practice for B2B follow-up: marketing to corporate contacts has more latitude than marketing to individuals, but sole traders and some partnerships are treated like individuals, so do not assume every business email is fair game. Keep follow-ups relevant, make opting out easy, and stop contacting people who have gone quiet. The honest, wanted follow-up you would send anyway is also the compliant one. Our guide to choosing a lead capture app covers export and data handling as one of the selection criteria, which is worth weighing here.

What changed in 2026

The Data (Use and Access) Act 2025 received Royal Assent in June 2025, with most core provisions commencing on 5 February 2026. It amends UK GDPR, the Data Protection Act 2018 and PECR rather than replacing them. The points most relevant to exhibitors:

• Higher PECR fines, as above, aligning electronic marketing penalties with UK GDPR levels.
• Recognised legitimate interests, a narrow new category for specific activities such as safeguarding and crime prevention. For ordinary commercial marketing, you still apply the standard legitimate interests test and balancing exercise.
• A new complaints route, effective from 19 June 2026, giving individuals a right to complain about how their data is handled and requiring organisations to have a procedure to deal with complaints.
• Subject access requests clarified so that searches must be reasonable and proportionate rather than exhaustive in every case.
• Divergence from the EU. UK compliance is no longer simply a subset of EU GDPR, so if you also capture EU attendees' data, check the EU rules separately.

Your practical checklist before the next show

• A privacy notice you can point leads to at the point of capture.
• A documented lawful basis, usually a legitimate interests assessment for B2B.
• A retention period, so you are not keeping lead data forever.
• A way to honour data subject rights, including access and erasure requests.
• A signed data processing agreement with each tool that processes your leads.
• Knowledge of your tools' sub-processors, so you know where the data flows.
• Secure storage, not a spreadsheet emailed around the team.
• An easy opt-out on every follow-up.

If your tools are processors: the DPA and sub-processors

Because your lead capture tool processes personal data on your behalf, you need a data processing agreement with it, and you should be able to see its list of sub-processors, the other services it relies on. Ask for both before you onboard. On the Beagle side, the product is built as a UK data processor with export and erasure as first-class features, and the data processing agreement and sub-processor disclosure are being published for customers who need them.

FAQ

Do I need consent to collect a business card at a trade show? Not always. For B2B lead capture you can usually rely on legitimate interests rather than explicit consent, provided you document the reasoning and are transparent about how you will use the data. Consent is one option, not the only one.

Can I email someone I met at a trade show? Usually yes, if the follow-up is relevant, you make opting out easy, and you respect the PECR rules, which differ between corporate contacts and individuals like sole traders. Keep it genuine and stop if they do not engage.

How long can I keep trade show leads? Only as long as you have a reason to. Set a retention period and delete or review leads after it. Keeping data indefinitely with no purpose is not compliant.

What changed for UK data protection in 2026? The Data (Use and Access) Act 2025 amended UK GDPR, the DPA 2018 and PECR from February 2026. The biggest practical changes for exhibitors are much higher PECR fines for electronic marketing and a new complaints procedure requirement from June 2026.

Capture leads properly and sleep at night

Data protection is not a reason to capture fewer leads. It is a reason to capture them properly: a clear lawful basis, transparency at the point of capture, a sensible retention period, and tools that take their processor duties seriously. Do that and follow-up stays both effective and compliant.

Beagle is built as a UK data processor with export and erasure baked in, so the mechanical side of compliance is handled for you. It is free to use solo. Try it free, and for the current data processing agreement and sub-processor details, get in touch.