How long should you keep fan data?

UK GDPR doesn't set a fixed time limit for keeping fan data. Instead, you must keep personal data only for as long as you need it for the purpose you collected it, set your own retention periods, be able to justify them, and delete or anonymise data when the period ends. Some records, like financial records for tax, have minimum periods set by other rules, so those are kept longer.

In practice, that means writing a simple retention schedule: a list of each type of data you hold, how long you keep it and why. This guide gives you a starting point. This is general guidance, not legal advice.

Key takeaways

• There's no single legal retention period for fan data: you decide, based on purpose, and you must be able to justify it.
• Marketing contacts can be kept while they're engaged and the consent still makes sense. Review long-inactive contacts and either re-permission or remove them.
• Event-specific data such as guestlists, door check-ins and accessibility requests usually only needs keeping for a short period after the show.
• Financial records have minimum periods set by HMRC, which override a shorter period you might otherwise choose.
• Keep a minimal suppression list of opted-out contacts indefinitely, so they aren't messaged again.

The rule: storage limitation

One of the seven principles of UK GDPR is storage limitation: personal data must be kept in a form that identifies people for no longer than necessary for the purposes it was collected for. The ICO's guidance expects you to:

• Know what personal data you hold and why.
• Set retention periods, or criteria for deciding them.
• Document them, ideally in a retention schedule.
• Review what you hold regularly, and delete or anonymise what you no longer need.

You can keep data longer if it's anonymised so individuals can't be identified. Aggregate figures, like "312 people checked in" or "40% of buyers were from Leeds", aren't personal data.

For the wider principles, see GDPR for promoters and artists.

Why it matters beyond compliance

Keeping data forever isn't just a legal risk:

• Breach exposure. The more you hold, the more you can lose.
• Deliverability. Old, unengaged email addresses lead to bounces and spam complaints, which can push your emails into spam for everyone else.
• Wasted money. You pay to store and message people who've moved on.
• Subject access requests. The more you hold, the more you have to find and disclose.

A sample retention schedule

The periods below are examples to help you think, not legal requirements. Set your own based on your circumstances and write down why.

Marketing contacts: when to let go

Marketing lists are where most promoters and artists over-retain. Someone who signed up at a gig four years ago, hasn't opened an email since and has moved city is unlikely to expect to hear from you.

A practical approach

1. Define "inactive". For example, no opens, clicks, replies, ticket purchases or check-ins in the last 18 to 24 months. Choose a period that fits how often you run events.
2. Remember open tracking is unreliable. Some email apps automatically load images, which can register as opens even when nobody read the email. Clicks, purchases and attendance are stronger signals.
3. Run a re-permission campaign. Send inactive contacts a simple message asking if they still want to hear from you, with a clear button to stay subscribed.
4. Remove those who don't respond. Delete or anonymise them, keeping only a suppression record if they've explicitly opted out.
5. Repeat on a schedule. Once or twice a year is manageable.

In Backline, you can build a list of contacts with no recent engagement and send them a re-permission campaign, then remove those who don't respond. For more on building segments like this, see how to segment your fan list.

Event data: guestlists and the door

Guestlists and check-in data are needed to run the night. Once the event has passed and any queries or refunds are dealt with, there's usually little reason to keep the names attached to each entry.

Sensible habits:

• Keep detailed guestlist and check-in data for a short, defined period after the event.
• Keep aggregate figures (attendance, no-show rate, arrival times) for planning, without names.
• If someone has opted in to marketing at the door, that becomes a marketing contact with its own retention rules.
• If check-in data is linked to an incident, keep the relevant records as long as the incident requires.

See guestlist management and door check-in best practice for setting these up well.

Financial records: HMRC's minimums

Some data has to be kept for longer because of tax rules. As a guide from HMRC:

• Limited companies must generally keep records for at least six years from the end of the last company financial year they relate to.
• Sole traders and partnerships must generally keep records for at least five years after the 31 January submission deadline of the relevant tax year.

Check gov.uk for the current rules and any exceptions. This applies to invoices, receipts and transaction records, not to your marketing list. A ticket order kept for tax purposes shouldn't be used for marketing unless you have consent or the soft opt-in.

Opt-outs: keep a suppression list

When someone unsubscribes, don't delete them completely. Keep their email address or phone number on a suppression list so that if they turn up in a future import, they aren't messaged again. The ICO recommends this approach. Keep only what's needed, nothing more. See unsubscribes and STOP replies.

Erasure requests

People can ask you to delete their data. You must act on it in certain circumstances, including where you no longer need the data or they withdraw consent and there's no other lawful basis. When you get a request:

• Find all the data you hold on them, across every tool.
• Delete what you can, and explain anything you must keep (for example, financial records).
• Keep a suppression record if they've also opted out of marketing.
• Respond within one month.

Don't forget backups and old exports

Data has a habit of surviving in places you forgot:

• CSV exports in download folders and email attachments.
• Old spreadsheets in shared drives.
• Paper sign-up sheets from the merch table.
• Former team members' devices.

Include these in your annual review. Shred paper sheets once they've been entered into your system.

Writing your retention policy

Keep it simple and usable:

1. List each type of personal data you hold.
2. Note why you hold it and the lawful basis.
3. Set the retention period or the criteria.
4. Say what happens at the end: delete, anonymise or review.
5. Name who's responsible for doing it.
6. Mention retention in your privacy notice.
7. Set a calendar reminder to review it every year.

Frequently asked questions

How long can I keep fan data under UK GDPR?

There's no fixed limit. You can keep personal data only for as long as you need it for the purpose you collected it, and you must be able to justify the period you choose. Set retention periods, write them down, and delete or anonymise data when they end. This is general guidance, not legal advice.

When should I remove inactive subscribers?

A common approach is to review contacts who haven't engaged for 18 to 24 months, send them a re-permission message, and remove those who don't respond. The right period depends on how often you send and run events. Clicks, purchases and attendance are better signs of engagement than opens.

How long should I keep guestlists and door check-in data?

Usually only for a short period after the event, long enough to handle queries and refunds. Keep aggregate figures without names for planning. If the data relates to an incident, keep the relevant records as long as the incident requires.

Do I have to delete someone who unsubscribes?

You should stop marketing to them and delete data you don't need, but keep a minimal suppression record with their email or number. That way they won't be re-added and contacted again by a future import.

How long must I keep ticket sales and financial records?

HMRC sets minimum periods: generally at least six years from the end of the relevant financial year for limited companies, and at least five years after the 31 January submission deadline for sole traders. Check gov.uk for current rules. These records shouldn't be reused for marketing without consent or the soft opt-in.