Quick answer
If your event website handles data from EU residents — and ticket sales almost always do — GDPR applies to you. The essentials: collect only the data you need, get clear consent, tell people how their data is used, secure it, and let them access or delete it. This is general guidance, not legal advice; for your specific situation, consult a qualified professional.
- GDPR applies if you handle any EU residents’ data.
- Collect only what you need, with clear consent and transparency.
- Secure the data and honor access and deletion requests.
The General Data Protection Regulation (GDPR) governs how organizations handle the personal data of people in the EU, with significant penalties for getting it wrong. If your event website deals with EU residents in any way — and selling tickets means collecting names, emails, and payment details — it almost certainly applies to you, wherever you are based. Here is a practical overview for event organizers.
Please note: This article is general information, not legal advice. GDPR obligations depend on your specific circumstances. For compliance decisions, consult a qualified data-protection professional or lawyer.
Does GDPR Apply to You?
GDPR applies to any organization that processes the personal data of people in the EU, regardless of where the organization itself is located. If anyone from the EU can buy a ticket, register, or even submit a contact form on your site, you are processing their personal data and the regulation applies. For most event websites, the safe assumption is that it does. The official GDPR resource is a useful reference.
The Core Principles
GDPR is built on a few principles: collect data lawfully and fairly, only for specified purposes; gather only what you actually need (data minimization); keep it accurate and only as long as necessary; and protect it. For an event organizer, that means not hoarding attendee data “just in case,” and being clear about why you collect each piece.
Consent and Transparency
People must know what you collect and why, and consent must be freely given, specific, and unambiguous — no pre-ticked boxes. Keep your privacy policy clear and accessible, separate marketing consent from the ticket purchase itself, and only email people who actually opted in. Transparency is not just compliance; it also builds trust with attendees.
Treat attendee data as something you are trusted with, not something you own.
Respecting Data Rights
GDPR gives individuals rights over their data: to access it, correct it, delete it, and object to certain processing. Practically, you need a way for attendees to request their data or its deletion, and a process to honor those requests within the required timeframe. Owning your ticketing data — rather than it being locked in a third-party marketplace — makes honoring these rights much easier.
Securing the Data
You must protect the personal data you hold with appropriate security measures, and report certain breaches promptly. For an event website, that means SSL, strong access controls, reliable backups, and keeping your site and plugins updated. Our guide on the silent WordPress security gap covers what is at stake for event sites specifically.
Practical Steps for Event Sites
- Publish a clear, accessible privacy policy
- Collect only the attendee data you genuinely need
- Use unticked, separate consent for marketing emails
- Secure your site with SSL, updates, and backups
- Have a process to handle access and deletion requests
- Know which third parties (processors) touch your data
- Keep data only as long as you need it
Choosing where you run ticketing affects all of this. Keeping ticketing on your own site, as covered in selling tickets without marketplace fees, gives you direct control over the attendee data you are responsible for.
Final Thoughts
For event websites, GDPR is not optional — if you sell tickets, you handle personal data. Collect only what you need, get clear consent, be transparent, secure the data, and honor people’s rights over it. Treat attendee data as a responsibility, get the basics right, and consult a professional for your specific obligations. Good data practice protects both your attendees and your business.
Recommended next read
Securing attendee data starts with a secure site.
FAQ
Does GDPR apply to event websites outside the EU?
Yes, if you process the personal data of people in the EU, regardless of where you are based. If anyone from the EU can buy a ticket or submit a form on your site, GDPR generally applies. For most event websites, the safe assumption is that it does.
What does an event website need for GDPR compliance?
At minimum: a clear privacy policy, data minimization, freely given and specific consent (especially for marketing), strong security, and a process to honor access and deletion requests. This is general guidance — consult a qualified professional for your specific obligations.
Is buying a ticket consent for marketing emails?
No. Under GDPR, consent must be specific and unambiguous, so marketing consent should be separate from the ticket purchase and not pre-ticked. You can email people about their order, but you should only send marketing to those who have actively opted in.
