GDPR for promoters and artists: a plain-English guide

GDPR applies to promoters and artists because fan names, emails, phone numbers, Instagram handles and ticket histories are all personal data. In the UK, the rules are UK GDPR and the Data Protection Act 2018, with marketing messages also covered by PECR. In practice you need a lawful reason for each use of fan data, a clear privacy notice, proper security, and a way to respond when people ask what you hold or want it deleted.

This guide explains what that means for a promoter running club nights or an artist running a mailing list, without the jargon. This is general guidance, not legal advice. For anything specific to your business, check the ICO's guidance or speak to a data protection specialist.

Key takeaways

• If you can identify a living person from it, it's personal data: emails, phone numbers, social handles, ticket and check-in records all count.
• Every use of fan data needs one of six lawful bases. For marketing emails and texts, you'll usually rely on consent or the soft opt-in under PECR.
• Tell people what you're collecting and why at the point you collect it, and keep a privacy notice that explains the rest.
• Fans have rights to see, correct and delete their data, and an absolute right to stop direct marketing.
• Security and access control matter as much as paperwork: a shared spreadsheet on a lost phone is a data breach.

Which law applies: UK GDPR, the DPA 2018 and PECR

Since Brexit, the UK has its own version of GDPR, known as UK GDPR, which sits alongside the Data Protection Act 2018. The two work together and are regulated by the Information Commissioner's Office (ICO).

Separately, the Privacy and Electronic Communications Regulations (PECR) set specific rules for marketing by email, text and phone, and for cookies. If you send marketing messages, you need to think about both. We cover marketing consent in detail in consent for marketing texts and emails in the UK.

The Data (Use and Access) Act 2025 amends UK GDPR, the DPA 2018 and PECR. Its changes are being brought into force in stages, so check the ICO's guidance for the current position rather than relying on older articles.

If you sell tickets to, or market to, people in the EU, the EU GDPR may also apply to that activity.

What counts as personal data

Personal data is any information relating to an identified or identifiable living person. For promoters and artists, that includes:

• Names, email addresses and phone numbers.
• Instagram, TikTok and other social handles.
• Postcodes and cities.
• Ticket purchases, guestlist entries and door check-in records.
• Messages in your inbox and DMs.
• Notes you've written about someone ("regular, always brings a group").
• Photos and video where people are identifiable.

Some data is "special category" and needs extra care, including information about health, ethnicity, religion and sexual orientation. For events, the most common example is health information disclosed through accessibility requests. Collect only what you need to make the arrangements, and restrict who can see it.

Controllers and processors

• A controller decides why and how personal data is used. A promoter running their own mailing list is a controller. So is an artist with their own fan list.
• A processor handles data on a controller's behalf and on their instructions, like an email sending service or a CRM.

Ticket platforms can be in either role depending on the arrangement, and often act as a controller for their own customer relationship. Read the platform's terms to understand what you can and can't do with buyer data.

If you use a processor, you need a written contract with them covering data protection. Reputable software providers include this in their terms.

The seven principles, in plain English

UK GDPR is built on seven principles:

1. Lawfulness, fairness and transparency. Have a lawful basis, don't use data in ways people wouldn't expect, and be upfront.
2. Purpose limitation. Collect data for a stated purpose and don't repurpose it for something unrelated.
3. Data minimisation. Only collect what you need. A sign-up form rarely needs a date of birth.
4. Accuracy. Keep data up to date and fix errors.
5. Storage limitation. Don't keep data longer than you need it. See how long should you keep fan data?
6. Integrity and confidentiality. Keep it secure.
7. Accountability. Be able to show how you comply, for example with records of consent.

Lawful bases: why you're allowed to use the data

Every use of personal data needs a lawful basis. There are six: consent, contract, legal obligation, vital interests, public task and legitimate interests. For promoters and artists, four are relevant:

For marketing by email, text or WhatsApp, PECR adds its own rules on top. In most cases you'll need consent or the soft opt-in, whatever lawful basis you'd otherwise rely on.

What valid consent looks like

Consent under UK GDPR must be freely given, specific, informed and unambiguous, given by a clear positive action. That means:

• No pre-ticked boxes.
• Separate consent for separate channels where that's what you're asking (email and SMS, for instance).
• Plain language about what people will get.
• A record of when and how each person consented.
• An easy way to withdraw.

Privacy notices: telling people what you're doing

At the point you collect data, tell people who you are and what you'll do with it. A short line on a sign-up form, linking to a full privacy notice, is the usual approach.

Your privacy notice should cover:

• Who you are and how to contact you.
• What data you collect and where it comes from.
• Why you use it, and the lawful basis for each purpose.
• Who you share it with (ticket platforms, co-promoters, software providers, ad platforms).
• How long you keep it.
• People's rights, and how to complain to the ICO.

If you upload contact lists to social platforms to build ad audiences, say so in your privacy notice and make sure you have a lawful basis. Many promoters take the cautious approach of only uploading people who have opted in to marketing. See Facebook and Instagram custom audiences for events.

Fans' rights

Under UK GDPR, people have rights including:

• Access: to get a copy of the data you hold on them (a subject access request). You normally have one month to respond.
• Rectification: to have inaccurate data corrected.
• Erasure: to have data deleted in certain circumstances.
• Objection: including an absolute right to object to direct marketing. If someone says stop, you must stop.
• Restriction and portability in some circumstances.

Make sure you can find everything you hold on a person quickly. That's hard when data is split across three spreadsheets, a ticket platform and an Instagram inbox. Handling opt-outs properly is covered in unsubscribes and STOP replies.

Sharing data with others

Live music involves a lot of sharing: co-promoters, venues, artists, ticket platforms, street teams. Before sharing personal data, check:

• Is it covered by what you told people when you collected it?
• Do you have a lawful basis for the sharing?
• Is it the minimum needed? A venue usually needs a guestlist name, not a phone number.
• Is there an agreement in place, especially for regular sharing?

Never assume a co-promoter can market to your list, or you to theirs, without proper consent. See co-promoting a show: share audiences without breaking data rules.

Security: the practical bit

Most data problems at events aren't sophisticated hacks. They're lost phones, shared logins and spreadsheets emailed around. Basic steps:

• Use strong, unique passwords and two-factor authentication on everything that holds fan data.
• Give each team member their own login with only the access they need.
• Avoid emailing spreadsheets of contacts. Use shared access to a secure system instead.
• At the door, use a device you can lock and wipe remotely.
• Don't photograph or store ID documents unless you genuinely need to and have thought through the legal basis.
• Remove access promptly when staff, volunteers or street team members leave.

In Backline, consent is tracked on each contact record, which makes it easier to show where and when someone opted in.

If something goes wrong

A personal data breach is any security incident affecting personal data: a lost device, a wrong email recipient, an unauthorised login. If it's likely to result in a risk to people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it. If the risk to individuals is high, you must also tell them. Keep a record of all breaches, including ones you don't report.

The ICO data protection fee

Most organisations and sole traders that process personal data must pay an annual data protection fee to the ICO, unless they're exempt. Whether you need to pay depends on what you do, so use the ICO's self-assessment tool to check.

A starter checklist

• Know what personal data you hold and where it lives.
• Record a lawful basis for each use.
• Put a clear notice on every sign-up form, with a link to your privacy notice.
• Record consent for marketing: when, where and what was agreed.
• Make opt-outs easy and act on them promptly.
• Set retention periods and stick to them.
• Lock down access and use two-factor authentication.
• Check whether you need to pay the ICO fee.

Frequently asked questions

Does GDPR apply to small promoters and bands?

Yes. UK GDPR applies to anyone processing personal data for business or commercial purposes, including sole traders, small promoters and bands with mailing lists. The obligations scale with what you do, but the basics of lawful basis, transparency, security and fans' rights apply to everyone. This is general guidance, not legal advice.

Do I need consent to email ticket buyers?

Usually you need either consent or the soft opt-in under PECR. The soft opt-in can cover marketing your own similar events to people who bought from you, if they were given a chance to opt out when you collected their details and in every message. If the ticket platform sold the ticket, the position is less clear, so many promoters ask for explicit consent.

What is a lawful basis under UK GDPR?

A lawful basis is the legal reason you're allowed to use someone's personal data. There are six: consent, contract, legal obligation, vital interests, public task and legitimate interests. You need at least one for each purpose, and you should decide which before you start.

How quickly do I have to respond to a subject access request?

Normally within one month of receiving it. The deadline can be extended in limited circumstances, such as complex or numerous requests, but you must tell the person within the first month. In most cases you can't charge a fee.

What happens if I lose a spreadsheet of fan data?

That's a personal data breach. Assess the risk to the people involved, and if it's likely to affect their rights and freedoms, report it to the ICO within 72 hours of becoming aware. If the risk is high, tell the individuals too, and record what happened and what you've changed.