Selling a ticket means holding someone's name and email, and often more. That makes you a data controller under UK GDPR, with a short list of obligations that are easier to meet than the acronym suggests. This guide sets out what you actually collect when you sell online, which rules apply to each piece, what your ticketing platform is responsible for, and the handful of habits that keep a small organiser on the right side of the ICO without a lawyer.
Who is who
- You are the controller. You decide why the data is collected: to sell a ticket, to run the door, to tell people about the next event.
- Your platform is a processor. It handles the data on your instructions and must not use it for its own ends. tickts publishes its list of sub-processors, such as its payment and email providers, and offers a data processing agreement.
- The payment processor is a controller in its own right for card data. On tickts, card details go to Stripe or PayPal and never touch tickts or you, which removes the most sensitive category from your plate entirely.
What you collect, and the lawful basis for each
| Data | Why it is collected | Lawful basis |
|---|---|---|
| Name and email | To issue and deliver the ticket | Performance of the contract |
| Checkout questions you add | Dietary needs, access needs, a team name | Contract, or consent if it is optional |
| Marketing opt-in | To email them about future events | Consent, given by a tick box that is unticked by default |
| Scan records | Who was admitted and when | Legitimate interests, for security and capacity |
| Gift Aid declaration and home address | HMRC requires them for a valid claim | Legal obligation |
The pattern matters more than the labels: everything needed to fulfil the order is covered by the order itself, and anything beyond it needs either a clear reason or a clear yes.
Marketing is the place people get it wrong
Buying a ticket is not consent to a newsletter. Under the privacy rules that sit alongside GDPR, marketing email to individuals needs their consent, with a narrow exception for people who bought from you and were given a clear chance to opt out at the time. On tickts the opt-in at checkout is a separate tick box, unticked by default, and only the people who tick it join your marketing list. That is the safe shape: nobody is on your list who did not ask to be, and you can show when and how they asked.
If you could not point to the moment a person said yes, do not email them about anything except the ticket they bought.
The five habits that keep you compliant
- Collect only what the order needs. If you add a checkout question, ask because you will use the answer. Do not ask for a date of birth to sell a comedy ticket.
- Tell people what you do with it. A short privacy notice on your event page or website: what you collect, why, who you share it with, how long you keep it. Your platform's own notice covers the platform; it does not cover you.
- Be able to answer a request. Anyone can ask what you hold about them and ask you to delete it, and you have a month to respond. Your platform should let you find and export or remove a buyer's data yourself.
- Keep the door list private. A printed list of names is personal data. Do not leave it on the table, and shred it afterwards.
- Pay the ICO fee if you must. Most organisations that process personal data for their own purposes must register with the ICO and pay the annual data protection fee; some small not-for-profits are exempt. The ICO's online self-assessment takes two minutes and gives you a definite answer.
Choosing a platform with GDPR in mind
- Card details never reach the platform or you. Payment is handled by a regulated processor.
- Guest checkout that verifies an email rather than forcing an account, so you do not accumulate passwords you do not need.
- A marketing opt-in that is separate, explicit and off by default.
- A published sub-processor list and a data processing agreement you can download.
- A way to export or delete a buyer's data without emailing support.
- Data held in the UK or under adequate safeguards if it leaves.
When something goes wrong
A breach is any loss of control of personal data: an email sent to the wrong list, a laptop with the door list left on a train, an account taken over. If it is likely to put people at risk, it must be reported to the ICO within 72 hours; keep a note of what happened either way. The organisers who come out of these well are the ones who wrote down what they hold and where, before they needed to.
