Guest lists and GDPR – store less, delete on time
A guest list is personal data. In the EU that means GDPR applies, even for a club night. The good news: the safest approach is also the simplest one.
This is not legal advice
This guide is a plain-language overview to help you ask the right questions. For your specific situation, talk to a lawyer or your data protection officer.
Collect as little as possible
For a door, a name and the number of extra guests is usually enough. Phone numbers, emails and birth dates are rarely needed to let someone in – and every extra field is something you have to protect and justify. GDPR calls this data minimisation.
Know who is responsible
The organiser who decides who is on the list is normally the controller. A software provider that stores the list on the organiser’s behalf is normally a processor, and should have a data processing agreement with the organiser.
Pick a deletion period – and automate it
GDPR doesn’t name a number of days for guest lists, but says data shouldn’t be kept longer than needed. Many organisers use a fixed period after the event, for example 30 days, to handle follow-ups and incidents. The important part is that deletion happens without someone remembering to do it.
Spreadsheets and chats are the risk
Lists in WhatsApp groups, forwarded emails and shared spreadsheets are hard to delete, because copies live everywhere. A single place that the door, the hosts and the organiser all use – and that deletes itself – is easier to keep compliant.
How RONDZA handles it
RONDZA stores only the name a host writes, the number of extra guests and how many were checked in. Lists are deleted automatically 30 days after the event. Read our privacy policy for details.