What is GDPR, for events?

This is a plain description for organizers and not legal advice. If your event touches people in the EU or the UK, take advice for your own circumstances.

In practice at an event

An attendee list is personal data. So are photographs of identifiable people, profile details, questions attributed to a name, and connection records. The fact that a conference is a business activity does not change that.

The operational consequences an organizer feels are four:

Say what you are collecting and why, before the event, in plain words rather than buried in terms. State a retention period and honour it. “Indefinitely” is an answer your reviewer will have views about. Provide an easy deletion path — a published address, a named person, and a resolution measured in days rather than weeks. Do not share the list with sponsors. A sponsor gets the details of people who chose to give them, at a scan or a form. Wholesale list sharing is a different thing.

What to look for

Ask a vendor for data processing terms you can sign, a named storage region, a retention period, a sub-processor list, and the deletion path for an individual attendee. Those five cover most of what a reviewer asks.

How event67 handles it

Attendees control what appears on their profile and can stay out of the directory entirely. Photo moderation modes and auto-hide on report give you control over published images. Every administrative action is audit-logged.

The gap to state: there is no in-app account deletion. An attendee requests deletion by emailing privacy@event67.com or through a web page, and it is actioned manually. That is a known gap, not a design choice, and it should be scored as absent if your review requires self-service deletion.