GDPR Trade Show Leads: What Sales Teams Can Do After Events

Every trade show leaves you with a pile of names: badge scans, business cards, people you met at talks and contacts from exhibitor lists. Under GDPR, each of those is personal data, and how you collected it shapes what you may do next. This guide covers the practical rules for GDPR trade show leads, so your team can follow up with confidence.

Not legal advice. This article explains common practice in plain language. Rules vary by country, and national e-marketing laws add their own requirements. Check your approach with your data protection officer or legal counsel.

The short version

• Business contact details are personal data. A work email with a person's name in it is covered.
• You need a lawful basis for every use. For event follow-up, that is usually legitimate interest or consent.
• Tell people what you will do with their data, and do it only for that purpose.
• Make opting out easy, and honor it everywhere.
• Record where each contact came from and when.
• Keep data only as long as you need it, then delete it.

Choose your lawful basis: legitimate interest or consent

GDPR lists six lawful bases in Article 6. For event leads, two matter.

Legitimate interest

Article 6(1)(f) allows processing that is necessary for your legitimate interests, unless those interests are overridden by the rights and interests of the person. Following up on a conversation someone chose to have with you at a business event is a common example.

To rely on it, run and document a three-part test, often called a legitimate interests assessment:

1. Purpose. What is your interest? For example, following up on a product conversation.
2. Necessity. Is processing this data needed to achieve it? A name, role, company and work email usually are. A home address is not.
3. Balance. Would the person reasonably expect this? Does it affect them in a way they would object to?

Consent

Consent must be freely given, specific, informed and unambiguous, and people can withdraw it at any time. It fits uses that go beyond the conversation, such as adding someone to a newsletter or sharing their details with a partner.

Keep in mind that email marketing is also governed by national rules that implement the EU ePrivacy Directive. In some countries, those rules require prior consent even for business email addresses. Check the rules for each country you send to.

What you may do with contacts you met

The question to ask is simple: would this person expect it, given how you met?

Usually reasonable under legitimate interest:

• Sending the follow-up you promised in conversation
• Adding the contact to your CRM with the event as the source
• A small number of relevant follow-ups about the topic you discussed
• Inviting them to a related meeting or call

Usually needs consent or more care:

• Adding them to a general newsletter
• Passing their details to partners or resellers
• Long-running marketing sequences unrelated to your conversation
• Enriching their profile with personal data from other sources

Contacts from public sources

Exhibitor lists, speaker pages and published agendas are public, but the names on them are still personal data. When you collect data that did not come from the person directly, Article 14 requires you to inform them. If you use the data to contact them, you must do so at the latest in your first message. A short line works: who you are, where you found their details, why you are writing, and how to opt out.

I found your name on the Retail Ops Summit speaker page and wanted to reach out ahead of the event. If you'd rather not hear from me, just reply "no thanks" and I won't write again. Our privacy notice is linked below.

Badge scans

A badge scan feels like consent, but it is not consent to everything. The person agreed to share their details with you at that moment, for a reason they understood.

• Say what happens next. "I'll send you the slides and a short follow-up" sets the expectation.
• Do not trade scans for prizes and then market to everyone. If the scan was for a raffle, the follow-up should match.
• Read the organizer's terms. Lead retrieval apps often come with their own conditions on how you may use the data.
• Add context. A scan with no note is hard to justify later. Record what you talked about.

Badge scans also tend to be the weakest leads you bring home. The comparison in badge scanning vs booked meetings explains why booked meetings give you both better pipeline and a clearer basis for follow-up.

Opt-outs and the right to object

Article 21 gives people the right to object to processing based on legitimate interest. For direct marketing, that right is absolute: once someone objects, you must stop using their data for marketing.

In practice:

• Put a plain opt-out line in every message, such as "Reply 'no thanks' and I won't contact you again."
• Act on it the same day, not at the end of the quarter.
• Apply it across every tool: CRM, email, sequences, spreadsheets and event apps.
• Tell your team. A colleague sending a LinkedIn message after an opt-out undoes the good work.
• Keep a minimal suppression record, such as an email address flagged "do not contact," so the person is not re-imported from the next event list.

Record the source of every contact

Six months after the show, someone will ask, "Where did we get this person?" You need an answer. Store the source as structured fields, not in free-text notes.

Tools that build your event shortlist should make this easy. Hallway, for instance, builds the list from public exhibitor lists, floor plans, speaker pages, your CRM and people you mark yourself, so each name comes with a known origin. It also sends plain-text email from your own mailbox without tracking pixels, which keeps your follow-up simple from a privacy point of view.

Data retention

Article 5(1)(e) sets the storage limitation principle: keep personal data no longer than you need it for the purpose you collected it.

Set a written rule for event leads and automate it where you can. An example policy:

• Leads with an open deal or active conversation stay as long as the relationship is active.
• Leads with no reply and no engagement after 12 months are deleted or anonymized.
• Raw badge-scan exports are deleted once the contacts are imported and checked.
• Spreadsheets shared during the event are deleted after import.

Pick periods that fit your sales cycle, write them down, and review them once a year.

Exports and erasure requests

People can ask for a copy of their data under Article 15 and for deletion under Article 17. You generally have one month to respond.

Prepare before the first request arrives:

1. Map where event data lives. CRM, email tool, event app exports, shared drives, personal spreadsheets.
2. Name an owner who handles requests and knows the systems.
3. Write a short process for finding, exporting and deleting a person's data across every system.
4. Keep the suppression record after erasure so the person is not added again.
5. Log each request and what you did, with dates.

GDPR checklist for your next event

• Lawful basis chosen and documented for event follow-up
• Privacy notice link ready for first messages
• Badge-scan wording agreed with the booth team
• Source fields set up in your CRM
• Opt-out line in every template
• Retention rule written and scheduled
• Request process and owner in place

Follow up with confidence

GDPR does not stop you from following up with people you met at events. It asks you to be clear about why you have their data, use it the way they would expect, and stop when they ask. Teams that build this into their process spend less time worrying and more time selling. For the follow-up itself, see the trade show follow-up playbook.

Want a shortlist with known sources and plain-text outreach from your own mailbox? Start a 14-day free trial, or have our team run it for you with done-for-you.