GDPR for Event Marketing: A UK Promoter's Guide

UK GDPR applies to every promoter, venue and festival that markets to people in the UK. For event marketing, you need three things. First, a lawful basis for each use of attendee data. Second, valid consent or a qualifying soft opt-in before you send marketing emails or texts. Third, a written record of what you hold, why, and for how long. This guide covers each of these in the order you meet them: collecting data at checkout, sending campaigns, storing data in a CRM, and choosing the software that holds it.

This is practical guidance for planning, not legal advice. For decisions about your own data, speak to a data protection adviser or solicitor, and use the Information Commissioner’s Office (ICO) guidance linked below.

TL;DR

• UK GDPR applies to organisations in the UK and to those outside it that offer goods or services to people in the UK, so a ticket sale is covered.
• Email and text marketing is governed by PECR as well as UK GDPR. You need specific consent, or a valid soft opt-in for existing customers with an opt-out in every message.
• Tell ticket buyers what you will do with their data at the point you collect it, and keep records of consent, opt-outs and preferences.
• Set a retention period for every list, including post-event lead lists, and put data protection terms in contracts with agencies and software providers.
• A breach that puts people at risk must be reported to the ICO within 72 hours where feasible.

Table of Contents

• Why event marketing data is regulated
• The seven principles, applied to a ticket sale
• Choosing a lawful basis for marketing
• Email and SMS: when consent is required
• Tell ticket buyers what you do with their data
• Retention: how long to keep event data
• Event CRM best practices
• Who is responsible: you, or your software provider?
• If something goes wrong: breach reporting
• Where Lookport fits
• A short compliance workflow for your next on-sale
• FAQ
• Sources

Why event marketing data is regulated

Every ticket sale creates personal data: name, email address, postcode, sometimes a phone number and accessibility needs. Marketing to those buyers again is a separate use of that data, and it has its own rules.

Two laws apply together:

• UK GDPR and the Data Protection Act 2018 govern how you collect, use, store and share personal data.
• PECR (the Privacy and Electronic Communications Regulations) govern electronic marketing by email, text and similar channels, and cookies.

The UK GDPR applies to controllers and processors of personal data in the UK. There is no exemption for small organisations, so a single-venue promoter has the same core duties as a national tour operator.

The law has also moved recently. The Data (Use and Access) Act 2025 amended UK GDPR, the Data Protection Act 2018 and PECR. One consequence for marketers is that PECR penalties are now aligned with UK GDPR levels, up to £17.5 million or 4% of global annual turnover. Check the ICO’s current guidance for the detail that applies to you.

The seven principles, applied to a ticket sale

The ICO sets out seven data protection principles in UK GDPR Article 5. Here is what each one means in a promoter’s day-to-day work.

The last principle matters most in practice. Article 5(2) makes you responsible for compliance and for being able to show it. A short written record of your decisions is the simplest way to do that.

Choosing a lawful basis for marketing

There are six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests. Sector guidance from the Live Theatre Association lists the same six for venues.

For a ticket sale, the basis for delivering the order is usually contract: you need the buyer’s name and email to issue the ticket. Marketing is different. The European Data Protection Board states that the contract basis does not cover marketing, targeted advertising or other purposes related to a business model, so you need consent or legitimate interests instead. That guidance comes from the EU, but the reasoning is a useful check on how you describe the purpose of each field you collect.

Consent

Consent has to be a clear, specific choice. One practitioner view is that consent must be freely given, specific and recorded, and that a tick box buried in a registration form rarely meets that test. In practice:

• Use an unticked box at checkout with plain wording, such as “Email me about future shows at this venue”.
• Keep marketing consent separate from your terms and conditions.
• Make buying a ticket independent of agreeing to marketing.
• Record who consented, when, to what wording, and through which form.

Legitimate interests

The ICO says legitimate interests can apply to direct marketing, but only where PECR does not require consent. The use must also be proportionate, have minimal privacy impact, and not be something that surprises people or that they are likely to object to.

The ICO describes a three-part test:

1. Purpose: are you pursuing a legitimate interest?
2. Necessity: is using the data necessary for that purpose?
3. Balancing: do the individual’s interests override yours?

This suits some postal marketing and some business-to-business contact, such as writing to a corporate hospitality buyer. Write the test down. It is your proof under the accountability principle.

Email and SMS: when consent is required

Most event marketing runs through email and text, so PECR is where promoters most often go wrong.

The ICO’s guidance on electronic mail marketing says you must not send marketing emails or texts to individuals unless they have specifically consented, or they are an existing customer who bought something similar from you and you offered a simple opt-out. The second route is the soft opt-in. It has conditions:

• The person bought, or negotiated to buy, a similar product or service from you.
• You gave them a simple way to opt out when you first collected their details.
• You give them that opt-out in every message you send.

The soft opt-in does not cover prospective customers, contacts from bought-in lists, or non-commercial promotions such as charity fundraising or political campaigning.

What this means for common situations

Identity and unsubscribing

Every marketing email must make clear who is sending it. The ICO says you must not disguise or conceal your identity and must provide a valid contact address so people can opt out. Make unsubscribing one click, and process it promptly. If you are building a first email programme, this guide to email marketing for musicians shows how an unsubscribe link and a clear sender line fit into a sales sequence.

For text campaigns, see our guide to SMS marketing rules and templates for concert promoters.

What enforcement looks like

The ICO’s action against Monetise Media Limited is a clear example. The ICO found the company sent 3,506,157 direct marketing emails and text messages without valid consent in a 12-month period, contrary to PECR Regulation 22. The fine was reduced from £125,000 to £85,000 on appeal. The company was not an events business, but the rule it broke is the one every promoter’s email programme sits under.

Tell ticket buyers what you do with their data

Transparency is a duty whichever lawful basis you use. Venue guidance from the Live Theatre Association states that UK GDPR requires venues to be very open and clear about their processing, and that making privacy policies available is an important part of compliance.

For ticketing, put the information where the buyer sees it, not only in a footer link. A good checkout privacy notice covers:

• Who you are, and how to contact you about data.
• What you collect and why (fulfilling the order, entry, safety, marketing).
• Your lawful basis for each purpose.
• Who receives the data, such as payment providers, ticketing software and marketing tools.
• How long you keep it.
• Buyers’ rights to access, correct, delete and object, and how to use them.
• How to opt out of marketing at any time.

Accessibility information deserves extra care, because details about a disability are sensitive. Collect only what you need to provide access, and keep it apart from marketing records. Our guide to an accessible tickets policy for UK events covers what to include.

People can ask what data you hold, ask you to correct or delete it, and object to marketing. The ICO’s small-organisation guidance sets these rights out. Decide who handles those requests before the first one arrives.

Retention: how long to keep event data

Storage limitation is where event lists decay. Contacts gathered at a launch, a trade stand or a sold-out tour are kept in a spreadsheet for years and then used again.

Practitioner advice is to set a default review date of 12 months after the event for lead lists unless there is a documented reason for longer. A commentary on the Data (Use and Access) Act also notes that retention periods are a weak spot and advises defining in writing how long you keep data collected at specific events. Treat both as sensible starting points rather than legal limits. The right period depends on your purpose.

A simple retention schedule might look like this (hypothetical example, adapt to your own purposes):

Financial and refund records follow their own rules. See our guides on VAT on ticket sales and refund policy for concerts.

Event CRM best practices

A CRM is where consent, preferences and purchase history meet, so it is also where mistakes spread fastest. These habits keep it clean.

1. Store the consent record with the contact. Keep the date, source and wording. A subscriber without a recorded source is a liability.
2. Separate marketing status from order status. A buyer who opts out of marketing still needs order emails about the show.
3. Segment on what you need. Use purchase history and show interest to make campaigns relevant. Avoid collecting extra attributes just because the system has a field for them.
4. Limit access. Give each team member the least access they need, and restrict list exports.
5. Suppress opt-outs everywhere. Sync unsubscribes across email, SMS and any advertising audiences you build from your lists.
6. Clean regularly. Remove hard bounces and long-inactive contacts on your retention schedule.
7. Document your decisions. Keep your lawful basis notes, balancing tests and retention schedule in one place.

Used well, ticket data also improves marketing without extra collection. Our guides to ticketing analytics for UK promoters and AI audience analytics in the first 72 hours of sales show what to track, and the festival marketing plan guide shows where those campaigns fit.

Who is responsible: you, or your software provider?

When you sell tickets or run campaigns through a platform, you are usually the controller: you decide why and how the data is used. The software provider is usually a processor acting on your instructions. The ICO says the controller is responsible for assessing that its processor is competent to process data in line with UK GDPR. Choosing a tool does not hand off your duties.

Article 28 sets out what a processor arrangement must include. Under Article 28, the provider must process data only on your documented instructions, ensure confidentiality, take Article 32 security measures, help you answer data subject requests, and delete or return personal data when the service ends.

Article 32 asks for security appropriate to the risk, which can include pseudonymisation and encryption, and a process for regularly testing the measures.

A checklist for choosing event CRM or ticketing software

Put these questions to any provider before you sign:

• Is there a written data processing agreement that reflects Article 28?
• Where is the data stored, and who can access it?
• Which fields does the checkout collect, and can you switch fields off?
• Can you export or delete a single person’s record quickly when asked?
• How does the tool record consent and honour unsubscribes?
• What happens to your data when the contract ends?
• How will the provider tell you about a security incident?

The same applies to agencies. Practitioner advice is to put the lawful basis, retention period and deletion process in the agency contract.

If something goes wrong: breach reporting

Under UK GDPR Article 33(1), the controller must notify the ICO of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to risk people’s rights and freedoms.

A lost laptop with an unencrypted guest list, an email sent with every recipient visible, or a mis-shared spreadsheet can all qualify. Agree in advance who decides whether a breach is reportable, and how your processors will alert you. Practical door-list controls help too, and our guide to guest list management covers handling attendee lists on the day.

Where Lookport fits

Lookport Ticketing is built for concert promoters, event organisers and venues. Ticket proceeds go directly into your own Stripe account, and the Lookport commission is 6% with no other Lookport charges. Availability follows Stripe-supported countries. You can see the details on the Ticketing page and the pricing page.

If you plan campaigns from your ticket data, the marketing integrations page describes how Ticketing connects with marketing tools. Before you commit to any platform, run the checklist above and agree your data protection terms in writing. When you are budgeting a tour, the tour break-even calculator helps you model costs, ticket prices, revenue and break-even, including the marketing spend your consent-based lists make possible.

A short compliance workflow for your next on-sale

Use this order for each new show or tour:

1. Map the data. List every field collected at checkout, on your mailing list form and at the door.
2. Cut what you do not need. Remove fields without a stated purpose.
3. Assign a lawful basis to each purpose and write down any legitimate interests test.
4. Write the checkout notice and add an unticked, specific marketing opt-in.
5. Check your processors. Confirm written terms and security measures with ticketing, email, SMS and CRM providers.
6. Set retention dates for each list and diarise the review.
7. Test the unsubscribe path in every channel before the on-sale.
8. Agree the breach plan and who contacts the ICO.

FAQ

Does UK GDPR still apply to event marketing after Brexit?

Yes. The UK has its own version of GDPR, which sits alongside the Data Protection Act 2018 and PECR. The ICO says it applies to UK controllers and processors, and to organisations outside the UK that offer goods or services to people in the UK. If you also sell to people in the EU, check the EU rules separately.

Can I email everyone who bought a ticket last year?

Possibly, under the soft opt-in. The buyer must have bought something similar from you, been offered a simple opt-out when you collected their details, and be offered one in every message. Contacts who only enquired, or came from a bought-in list, need consent instead.

Do I need consent to market to a business contact?

Not always. Legitimate interests can cover some business-to-business contact, but only where PECR does not require consent, and you must record your balancing test. Check the ICO’s electronic mail marketing guidance for the type of subscriber and channel before you rely on it.

How long can I keep attendee data?

Only as long as necessary for the purpose you collected it for. The law gives no single figure for marketing lists, so set your own period and write it down. A 12-month review after the event is a common starting point for lead lists.

Who is liable if my ticketing platform has a breach?

You remain responsible as controller for choosing a competent processor and for having the right contract in place. The ICO also expects processors to meet their own obligations. Put breach notification terms in your written agreement, and remember the 72-hour reporting window.

Sources

• Who does the UK GDPR apply to? | ICO
• A guide to the data protection principles | ICO
• Legitimate interests | ICO
• Electronic mail marketing | ICO
• Monetise Media Limited | ICO
• Responsibilities and liabilities for controllers using a processor | ICO
• Process personal data lawfully | EDPB
• UK GDPR Article 28 | legislation.gov.uk
• UK GDPR Articles 32 and 33 | legislation.gov.uk
• Frequently asked questions | Live Theatre Association
• Event marketing data protection in England | Experience Campaign
• Event data consent under the Data Act 2025 | B2B Insiders
• UK Data (Use and Access) Act 2025: Privacy Compliance Guide | Usercentrics

Recommended

• Festival Marketing Plan: A UK Promoter’s Guide for 2026
• Stop Door Time Failures: Guest List Management for UK Event Operators
• Five SMS Marketing Uses, Templates and UK Rules for Concert Promoters
• Post-Event Marketing for Promoters: A 30-Day Plan