GDPR for Events

Data privacy compliance for corporate events has gotten materially more complex since the original GDPR enforcement date in 2018. The European Union’s General Data Protection Regulation still sets the baseline for international corporate event compliance, but corporate event programs now operate under a layered patchwork of regulations: GDPR for EU attendees, CCPA/CPRA for California, similar state laws in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and a growing list of others. The 2026-2027 picture isn’t “GDPR or nothing” — it’s a multi-jurisdiction compliance framework that any program with U.S. + international attendee data needs to operate inside.

(For the broader operational framework that compliance fits into, our corporate conferences and meeting planning page covers the full scope.)

The Regulations That Apply to Corporate Events in 2026-2027

GDPR (EU/EEA + UK GDPR): applies whenever your program processes data on EU, EEA, or UK residents. Includes attendee personal data collected through registration, on-site badge scanning, lead-capture, and post-event communications. Penalties are up to 4% of global annual revenue or €20M, whichever is higher.

CCPA + CPRA (California): applies to organizations meeting certain revenue or California-resident-record thresholds. Covers California-resident attendee data with rights-to-know, rights-to-delete, and (under CPRA) rights-to-correct and sensitive-data-handling provisions.

VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah): active state laws covering resident data with varying provisions. Most include consent requirements for data collection, opt-out rights for sale/sharing, and data-subject access rights.

Additional state laws active or pending in 2026: Texas (TDPSA, effective July 2024), Florida (FDBR), Iowa, Indiana, Tennessee, Montana, Oregon — each with its own provisions. Per the International Association of Privacy Professionals (IAPP) tracking, the patchwork of U.S. state-level privacy laws continues to expand annually.

HIPAA: applies if your event collects health-related attendee data — dietary restrictions involving medical conditions, on-site medical event-staffing arrangements, etc. Not GDPR-style broad, but specific.

What This Means Operationally for Event Programs

For most corporate event programs running in 2026-2027, the practical compliance framework involves five operational disciplines:

1. Lawful basis for data collection

Every category of attendee data your program collects needs a lawful basis under GDPR — typically consent or legitimate interest. The registration form should explicitly identify what data is being collected, why, how long it will be retained, and what the attendee’s rights are. The cookie banner on the registration site needs to comply with EU cookie law (ePrivacy Directive) for any EU-resident registrants.

2. Data minimization

Collect only the data the program actually needs. The default registration form template that asks for company, role, address, phone, dietary restrictions, t-shirt size, partner name, and emergency contact for a program that needs only name + email + dietary is over-collecting. Per IAPP guidance, data minimization is one of the most consistently-violated GDPR principles in event registration flows.

3. Vendor data-processing agreements (DPAs)

Every vendor that processes attendee data on your program’s behalf — registration platform, mobile app provider, lead-capture provider, post-event communication tool, sponsor lead-share recipient — needs a signed Data Processing Agreement specifying their compliance posture, breach notification protocol, sub-processor disclosure, and data-deletion commitments. Per Cvent, Bizzabo, and other major platform published documentation, all major event platforms now ship standard GDPR-compliant DPAs as part of enterprise agreements — but the planner is responsible for executing them.

4. International data transfers

If attendee data flows from the EU/EEA to the U.S. (which it almost always does for U.S.-based event programs), the transfer needs a lawful basis under GDPR Chapter V. Standard Contractual Clauses (SCCs) and Data Privacy Framework certification (where applicable to U.S. recipients) are the two most common mechanisms. The transfer mechanism should be documented in the program’s data inventory.

5. Data subject rights handling

Attendees have rights — access, rectification, deletion, portability, objection. The program needs a named contact, a documented process, and a response-time commitment (typically 30 days under GDPR; varying under U.S. state laws). Most programs route data-subject requests through the registration platform’s standard DSAR (data subject access request) workflow.

The Compliance Audit Checklist Before a Program Launches

Programs that launch without a pre-launch compliance audit consistently surface avoidable issues mid-program. The 10-item pre-launch checklist:

1. Registration form data fields reviewed for data minimization
2. Privacy notice on registration page reviewed for accuracy and completeness
3. Cookie banner on registration site verified for EU compliance
4. Consent capture (opt-in for marketing, opt-out for processing where applicable) verified at registration
5. DPAs executed with all attendee-data-processing vendors
6. International transfer mechanisms documented (SCCs / DPF certification)
7. Sponsor lead-share consent flow reviewed (this is the most commonly-broken piece)
8. On-site badge-scan data flow documented
9. Post-event data retention schedule defined per category
10. DSAR response process documented with named contact

The Sponsor Lead-Share Pitfall

The single most commonly-violated GDPR provision in corporate event programs is sponsor lead-share. The conventional pattern — sponsor scans attendee badges, attendee data transfers to sponsor for marketing follow-up — usually does not have proper GDPR consent in place. Per IAPP enforcement coverage, several event-platform sponsors have been subject to GDPR enforcement actions specifically on the badge-scan-to-marketing-followup flow.

The compliant pattern: explicit opt-in consent at the moment of scan (“I consent to my information being shared with this sponsor for marketing follow-up”), separate from the event’s general registration consent. The major event platforms (Cvent, Bizzabo, Whova, Brella) all now support this consent-at-scan flow; the issue is usually that the program operations team hasn’t enabled it.

The Practical Reality

For most U.S. corporate event programs with EU/UK and California attendees in the mix, full multi-jurisdiction compliance is achievable but requires deliberate operational discipline. The programs that handle this cleanly typically have either a dedicated privacy/compliance team supporting events (large enterprise), or an agency partner with documented compliance protocols (mid-enterprise and smaller). The programs that handle this poorly are the ones treating compliance as a registration-page disclaimer rather than an operational discipline.

If you want help structuring data privacy compliance into your corporate event program, our team can help. We have working compliance protocols across the major event platforms and have supported programs with EU/UK, California, and other multi-jurisdiction attendee mixes.

Related reading: Corporate conference planning — the broader program operations framework.

You might also like...