GDPR for networking events comes down to four questions: what data you collect, on what legal basis, how you tell people about it, and how long you keep it. This is a practical overview for organizers. It is general information, not legal advice, so check with a lawyer or data protection officer if you are unsure.
Speed networking is a special case because the whole point is that attendees exchange information with each other. You collect names, companies and emails, then show part of that data to other people. If you run online events, the SpeedNetworking app helps with the setup: private attendee choices, mutual matches emailed only to people who agreed, and a CSV export for the organizer.
Who is the data controller at your event
Usually you are. If you decide why and how attendee data is collected, you are the controller under the GDPR. The tools you use (registration form, video platform, event software) typically process data on your behalf, which calls for a data processing agreement with the vendor.
If you co-host with a partner and you both decide the purposes, you may be joint controllers. Put in writing who handles the privacy notice and who answers attendee requests.
What data you actually need
Data minimization is simple in principle: collect only what serves the purpose. For a networking event that is usually:
- name,
- company and industry,
- a short description of what the person is looking for or offers,
- an email address for event communication,
- optionally a LinkedIn profile.
Skip the phone number if you will not call. Never ask for sensitive categories such as health or political views. Every extra field is an extra obligation and an extra breach risk.
Legal basis: consent or legitimate interest
You need a legal basis for each purpose separately. At a typical event you will meet three situations.
Registration and running the event
You can process the name, email and details needed to let someone attend, because you cannot deliver the event without them. This usually rests on Article 6(1)(b) or (f), depending on whether the event is paid or free and how it is structured.
Showing profiles to other attendees
This is the core of networking, so say it plainly at sign-up: who will see which data and when. An attendee should know before clicking register that a round partner will see their name, company and description.
Post-event contact and match emails
Consent is the safest basis here. According to the EDPB Guidelines 05/2020, consent must be freely given, specific, informed and unambiguous. In practice: a separate checkbox, unticked by default, with a clear description of the purpose. You cannot make attendance conditional on consent to something unnecessary for attending, and withdrawing must be as easy as giving consent.
The privacy notice: what to say at registration
When you collect data directly from a person, Article 13 requires you to tell them:
- who you are and how to contact you,
- the purposes and legal basis for processing,
- who may receive the data (other attendees, tool vendors),
- how long you keep it,
- their rights: access, rectification, erasure, objection, withdrawing consent,
- that they can complain to a supervisory authority.
Write in plain language. A short summary with a link to the full policy beats a wall of legal text.
How to do it with SpeedNetworking
These steps follow how the platform works. You still write the privacy wording yourself or with your lawyer.
- Create the event and share the registration link. Attendees sign up themselves, so their data comes straight from them rather than through spreadsheets passed around by email.
- In the event description and on the sign-up page, state which data round partners can see (name, company, industry, description, LinkedIn) and that conversations happen online in the browser.
- If you use pre-event swipe (Growth and Business plans), tell attendees that their Like / Maybe / Pass choices are private. See the pre-event swipe help page.
- Decide whether to keep AI icebreakers on. The questions are generated from the profiles of the two people in a pair, and you can turn the feature off.
- After the event, attendees see whom they liked and who liked them. The email with mutual matches goes only to people who gave consent. As the organizer you can download a CSV (attendees, mutual matches). Treat it as personal data and delete it when its purpose ends.
For the full setup flow, see the first event guide.
Manual setup vs. an events platform
| Area | Manual (video call + spreadsheet + timer) | SpeedNetworking |
|---|---|---|
| Registration | Form plus spreadsheet, often several file copies | Attendees sign up themselves via a link |
| Attendee choices | Chat messages or notes, hard to keep private | Pre-event swipe with private choices (Growth, Business) |
| Post-event matches | Manual matching and mailing | Mutual matches in the app and an email for people who consented |
| Control over data | Scattered across inboxes and drives | One place, CSV export for the organizer |
| Attendee setup | Depends on the video tool | Browser-based video, no install |
| Invoicing | Depends on your vendors | Automatic VAT invoices (Poland, EU reverse charge) |
| Format flexibility | Total, any format with no tool limits | Online 1:1 rounds only |
The last row is the honest one: doing it by hand gives you full freedom. A platform wins on repeatability and tidy data.
Retention and deletion
Data cannot sit around forever. Decide up front when you will delete the attendee list and put that period in your notice. What attendees save about each other after a mutual match is theirs, but your own export copies are your responsibility. Good habit: once matches are sent and the event is wrapped up, delete spreadsheets, exports and working copies.
Common organizer mistakes
- One blanket consent for everything. Separate the purposes: attending, matches, newsletter.
- Pre-ticked boxes. Consent needs an active step by the attendee.
- Emailing the full attendee list to everyone. People agreed to talk to a round partner, not to be published.
- No agreement with tool vendors. Know who processes data on your behalf.
- Collecting data just in case. If you cannot say why a field exists, remove it.
- No plan for withdrawn consent. Set up an email address and a response routine.
If you also plan to contact people afterwards, see our follow-up email templates, and for reporting results, the guide to measuring event ROI.
Checklist before you open registration
- You know who the controller is and who processes data for them.
- The form collects only necessary fields.
- The privacy notice is short, plain, and links to the full policy.
- Consents for matches and contact are separate and unticked by default.
- Attendees know what others will see and when.
- You have a deletion date and someone who owns it.
Next step
GDPR does not have to slow networking down. Clear rules at sign-up build trust, and trust makes people more willing to talk openly. The easiest way to test your process is a small event. Create a free account and run a trial event (up to 10 attendees), walk the attendee path from registration to mutual matches, then plan the bigger one. Plan details are on the pricing page.