How do I ensure my attendee surveying with a survey platform is compliant with GDPR and consent requirements?

To make attendee surveying compliant with GDPR and consent requirements, treat it as a data protection process, not just a marketing activity. The key question is: do you have a lawful basis to collect, store, and use the survey responses, and have you informed attendees properly?

Here’s a practical checklist:

1) Decide the lawful basis

For attendee surveys, consent is often used, but it is not always the best lawful basis under GDPR.

Possible bases:

• Consent: best when participation is optional and you want to use responses for follow-up or marketing.
• Legitimate interests: may be appropriate for genuine event feedback and service improvement, if you balance your interests against attendee rights.
• Contract: sometimes relevant if the survey is necessary to deliver the event/service, but less common.

Important: If you use consent, it must be:

• freely given
• specific
• informed
• unambiguous
• easy to withdraw

2) Be clear about purposes

Tell attendees exactly:

• why you’re collecting their data
• what questions you’re asking
• how long you’ll keep responses
• who will see them
• whether responses are anonymous, pseudonymous, or linked to identities
• whether data will be used for marketing, segmentation, or follow-up

If you want to use survey data for a new purpose later, check compatibility or obtain new consent.

3) Use a proper privacy notice

Provide a privacy notice at or before survey collection. It should include:

• your identity and contact details
• the survey platform/vendor details
• lawful basis
• purposes of processing
• categories of data collected
• recipients/third parties
• international transfers and safeguards
• retention period
• data subject rights
• right to withdraw consent if consent is the basis
• right to complain to a supervisory authority

4) Keep consent separate from other terms

If you rely on consent:

• don’t bundle it with event registration terms
• don’t pre-tick boxes
• use a clear affirmative action, such as a checkbox or button
• make withdrawal as easy as giving consent

If you need consent for multiple purposes, ask separately for each one.

5) Minimize data collection

Only ask for what you actually need:

• avoid collecting unnecessary personal data
• avoid sensitive data unless strictly necessary and explicitly justified
• if free-text responses could reveal sensitive info, warn users not to include it

6) Be careful with special category data

If a survey asks about health, disability, ethnicity, religion, political views, etc., this is special category data and needs:

• a GDPR Article 9 condition in addition to a lawful basis
• stronger safeguards
• a very clear reason for collection

Avoid collecting this unless you really need it.

7) Control survey platform/vendor compliance

If using a survey platform:

• sign a Data Processing Agreement (DPA)
• confirm the vendor acts as a processor
• check where data is hosted and whether it leaves the EEA/UK
• ensure appropriate transfer safeguards if data is transferred internationally
• review sub-processors
• make sure security measures are adequate

8) Set retention and deletion rules

Define how long survey data will be retained and why:

• keep only as long as needed for analysis, reporting, or compliance
• delete or anonymize afterward
• ensure backups are handled in the retention plan

9) Respect attendee rights

Be ready to handle:

• access requests
• correction requests
• erasure requests
• objection, especially if using legitimate interests
• withdrawal of consent

If responses are anonymous, explain that deletion may not be possible if no link exists to the respondent.

10) Secure the data

Use appropriate technical and organizational measures:

• access controls
• encryption in transit and at rest
• role-based permissions
• audit logs
• secure export and storage
• staff training

11) If using cookies or tracking in the survey

If the survey platform uses non-essential cookies, analytics, or tracking:

• obtain cookie consent where required
• explain this in your cookie notice
• avoid embedding unnecessary trackers

12) Do a DPIA if risk is higher

Run a Data Protection Impact Assessment if the survey involves:

• special category data
• profiling
• large-scale collection
• vulnerable participants
• automated decision-making
• cross-border transfers with higher risk

A simple compliant approach

For a standard attendee feedback survey:

1. show a short privacy notice
2. explain the purpose as event feedback/improvement
3. ask only necessary questions
4. avoid identifiable or sensitive questions unless needed
5. use a reputable survey platform with a DPA
6. set a retention period
7. provide a contact for privacy requests

Example consent wording

If you need consent:

I agree to the collection and use of my survey responses for event feedback and follow-up as described in the privacy notice. I understand I can withdraw my consent at any time.

If you want, I can also provide:

• a GDPR-compliant survey privacy notice template
• a consent checkbox wording template
• a vendor due diligence checklist for survey platforms