Scanning a Badge Isn't Consent: What UK GDPR Actually Requires at a Stand

A badge scan feels like a formality, point the reader at a lanyard, get a name and email, move on to the next conversation. Under UK GDPR it isn’t a formality at all. The moment that contact is stored or acted on, it’s data collection, and scanning the badge is not itself the consent needed to keep it or market to the person it belongs to. The ICO can fine up to £17.5 million or 4% of worldwide turnover for serious breaches, and that exposure applies to the smallest exhibitor on a 9 square metre stand exactly as it does to the headline sponsor.

The scan is not the consent

What makes a scan lawful is a stated purpose the visitor agreed to before it happened, not the scan itself. If someone asks for a spec sheet and the badge is scanned to send it, that’s a specific purpose with an obvious, reasonable basis, often called the soft opt-in. It does not extend any further than that. Adding the same contact to a general marketing list afterwards is a separate purpose, and it needs its own tick-box or a clear verbal confirmation at the time, not an assumption made back at the office once the leads are being sorted through. The safer habit is collecting only the fields actually needed rather than everything the badge happens to expose, and keeping that data only as long as the stated purpose requires it.

This is the same conversation as what happens to a lead after the show closes, just earlier in the process. A lead captured without a clear, specific basis for keeping it is a liability sitting in a spreadsheet, not an asset waiting to be followed up. Getting the consent right at the point of the scan is what makes the 48-hour follow-up worth doing at all.

What this means for a brief

This sits squarely with whoever is staffing the stand, not the contractor building it, but it belongs in the same planning conversation as the stand itself. Everyone on the stand needs to know, before the show opens, what the lead capture system actually asks a visitor to agree to, and what it doesn’t cover. A scanner that defaults to opting people into everything because nobody checked the settings is a problem that surfaces months later as a complaint or a subject access request, not on the show floor where it would have been easy to fix. It’s worth treating this the same way as the other paperwork first-time exhibitors get caught out by, something to settle before the show rather than after.

Stand Between introduces exhibitors to contractors who think about the whole exhibiting process, not just the structure on the floor. If a brief is still being put together and nobody has checked what the lead capture system actually asks visitors to agree to, get in touch with Stand Between before the show opens.