GDPR and company event guest lists: what you need to know
A guest list holds personal data: names, emails, sometimes dietary needs and photos. GDPR (and UK GDPR) applies. Here are the useful principles, in plain words, and what Invitotte does on its side. This isn't legal advice.
Does GDPR apply to a guest list?
Yes, as soon as a company collects names, emails or replies from identifiable people for an event. The organising company is responsible for that data.
The basic principles are simple: know why you collect, collect only what's useful, inform people, protect the data and limit how long you keep it. If in doubt, ask your DPO or legal team.
Which data should you collect for an event?
The minimum needed to organise it: name, contact, attendance, plus-ones. Every extra question should serve a concrete purpose.
- Useful: name, email, attendance, number of plus-ones
- Useful if needed: meal choice, shuttle, workshop
- Avoid: date of birth, home address, data unrelated to the event
- Handle with care: allergies and diets (see below)
Can you ask about allergies and dietary needs?
Yes, but carefully, because it's sensitive information: an allergy relates to health, and a diet can reveal religious belief. Make the question optional and explain it's for the caterer.
On Invitotte, a question can be free text or multiple choice: phrase it, for example, "Dietary requirement to pass to the caterer (optional)". Once the event is over, delete those answers if you exported them.
How long should you keep the guest list?
No longer than needed for the event and its follow-up. Once invoices are settled and the debrief done, the detailed list usually has no further use.
On Invitotte, the event and its replies are deleted automatically 12 months after its date, and you can delete the event sooner: its guests, replies and photos are then erased. The Excel/CSV export is your responsibility: store and delete it like everything else.
What about event photos?
Photos show identifiable people: tell attendees there's an album and let them remove a photo. On Invitotte, uploaders can remove their photos, guests can report one, and the album is permanently erased three days after the event.
How it works is covered in the shared photo album.
What does Invitotte do with guest data?
Guest pages aren't indexed by search engines and show no ads. Only you see detailed replies; guests only see who's coming if you turn that on.
With a closed list, each guest has a personal link. The settings are described in company event invitations and managing RSVPs online.
How do you tell guests how their data is used?
One or two sentences in the invitation message are often enough. Say what replies are for, who sees them and when they'll be deleted.
For example: "Your answers are only used to organise the evening (catering, shuttle). Only the organising team sees them, and they're deleted after the event." Add your DPO's contact if your company has one, and keep the wording the same across all your events.
Frequently asked questions
Do we need guests' consent?
Not necessarily: the legal basis depends on context (legitimate interest, the employment relationship…). Your DPO or legal team decides. Informing guests clearly is always required.
Can we show the guest list to other guests?
It's a choice to make knowingly. On Invitotte, the list can be hidden so only the organiser sees it.
Can a guest ask for their reply to be deleted?
Yes, they can ask you, and you can remove a guest from your list in the dashboard.
Does this guide replace legal advice?
No. It gives practical pointers; for a specific situation, ask your DPO or a professional.