How to get permission to share attendee details with event sponsors

To get permission to share attendee details with an event sponsor for its own email marketing, ask the attendee to make a separate, optional choice that names the sponsor, explains what you'll share and says what the sponsor will send. Record that choice, check it before the handoff and make withdrawal work across both businesses. Buying a ticket, accepting your terms or walking past a sponsor's stand doesn't give you that permission.

So you've sold a sponsorship, the event went well and the brand asks for the attendee list. The invoice is paid. You want a happy sponsor. Now you're looking at a spreadsheet and wondering whether you can send it.

Start with what the sponsor actually wants to do. Reporting how many people attended is a different job from giving the sponsor email addresses to promote its products. And permission to share information is a different question from permission to send marketing through a particular channel.

This guide uses UK rules for its worked examples. It explains how to agree the sponsor benefit, collect a clear choice, check the records and handle the handoff. EU events also need the relevant national electronic marketing rules. Elsewhere, check the rules that apply to your event and audience before copying the wording.

Decide what the sponsor needs before you promise a list

The first thing you want to do is ask the sponsor a useful question. "What do you want to achieve with attendee information?"

Maybe the brand wants to know whether its stand reached the audience it paid for. Maybe it wants people to book a product demonstration. Maybe its sales team wants every buyer's number. Those requests need different answers, even when they all arrive under the same heading in the sponsorship proposal.

For a paid conference, you could sell a demonstration station where attendees choose to request a follow-up. For a music event, you could sell a tasting activation and report participation without transferring ticket buyers' details. For an expo, you could let visitors register directly for a sponsor's product session.

Each gives the sponsor something concrete. None requires you to promise the entire database before you know whether people want contact.

Write the proposed benefit in ordinary words. "A staffed demonstration space and the contact details of attendees who separately request sponsor email updates" is something your team can deliver and check. "Access to our audience" leaves everyone guessing.

Our guide to event sponsorship agreements helps you put the benefit and its limits into the deal. Decide this before the sponsor sends its first payment. A contract signed by your business and the sponsor doesn't make an attendee's choice for them.

If the sponsor needs campaign results, agree the measures upfront. You might report stand visits, booked demonstrations or offer redemptions. Define each measure so someone scanning a badge twice doesn't become two interested people. Keep reporting separate from permission to contact the people behind those results.

Here's why this helps. You can still sell a valuable sponsorship, and your delivery team knows exactly what success means. It also stops the sponsor finding out after the event that the "lead list" was really a promise you couldn't safely keep.

Check sharing and marketing as separate decisions

There isn't a universal rule that every disclosure to a sponsor needs consent. Under UK data protection law, your organisation needs an appropriate lawful basis, meaning a valid legal reason, for the sharing. The sponsor also needs a basis for what it does with the information.

The ICO's guidance on planning direct marketing explains that legitimate interests may support sharing when justified. That requires assessing people's reasonable expectations and the impact on them. If you use that route, the ICO recommends a clear opportunity to object when collecting the information. A sponsor fee doesn't settle that assessment.

Next, check the rules for the intended message. In the UK, the Privacy and Electronic Communications Regulations, or PECR, set additional requirements for electronic marketing. A basis for processing personal information doesn't automatically permit the sponsor to send promotional emails or texts.

For unsolicited email marketing to individual subscribers, consent is normally required unless a relevant exception applies. That matters for consumer ticket buyers, and it can matter at business events too. Sole traders and some partnerships count as individual subscribers under these rules.

Your own customer relationship doesn't pass to the sponsor with the spreadsheet. The usual commercial soft opt-in, which can sometimes allow marketing about a business's own similar products, depends on that business collecting the details directly and meeting the other conditions. It isn't permission for another business to use your ticket customers.

The ICO's electronic mail marketing guidance says third-party list consent must name the sender and cover the intended method of contact. "Trusted partners" won't do that job. An email choice also doesn't become a text message choice because the sponsor finds a phone number in the booking.

This is why a clear, named sponsor opt-in is the practical approach for the independent sponsor email marketing described here. Review other arrangements on their facts. Corporate subscriber marketing has different PECR rules, but using a named business contact's personal information still brings data protection responsibilities.

The ICO flags some guidance as under review following the Data Use and Access Act 2025. Check the live guidance when you build the campaign. For EU events, the European Commission's guidance on third-party marketing data also points to electronic communications requirements. Don't treat one UK checkbox as a complete international policy.

Ask for a choice the attendee can actually understand

A good permission request answers the questions someone has before they tick the box. Who gets my details? Which details? What will they do with them? Can I still buy my ticket if I say no? How do I stop later?

Keep the answer next to the choice. Your privacy notice can explain the wider arrangement, but it shouldn't carry the entire meaning of an otherwise vague checkbox. Someone shouldn't have to hunt through several pages to discover they're joining another company's mailing list.

Use the sponsor's recognisable name and identify the responsible business clearly. If the event calls the sponsor "Northbank Audio" but the privacy notice names a company the attendee won't recognise, explain the connection. Be equally clear about your own event business.

For a fictional paid conference, a draft invitation could read like this.

That's a working example to adapt and review, rather than universal legal wording. Put accessible links to the actual preferences form and relevant privacy notices beside the option. Replace the purpose with what the sponsor will really send. If it only wants to send one requested demonstration booking, don't describe an indefinite newsletter.

Keep the box unticked. The buyer has to make an affirmative choice. Use equally understandable labels if your form uses yes and no instead. Don't make the no option sound like a penalty or hide it below the payment button.

Separate this from accepting ticket terms and from your own event marketing. A person might want your next conference announcement and have no interest in a sponsor's products. They might want a sponsor's demonstration without joining your mailing list. Your form needs to allow those choices where they are distinct.

The ICO's guidance on obtaining and recording consent describes consent requests as clear and separate, with meaningful choices and evidence of what people accepted. Your practical test is simpler. Can someone explain their choice back to you without using the word "partners"?

Make the offer useful without making the ticket conditional

Tell the attendee why they might want the contact. A relevant product guide, a demonstration invitation or offers for equipment they actually use gives them something to judge. "Stay connected with our ecosystem" doesn't explain anything.

Don't turn that explanation into pressure. The event ticket they've paid for should still work if they decline an unrelated sponsor mailing list. Your staff should also understand that refusing marketing doesn't reduce the attendee's access to the event benefits they've purchased.

If an incentive, competition or restricted experience depends on sharing, have that arrangement reviewed separately. The question is whether the choice is genuinely free in that setting. Calling a field optional won't fix a process that blocks the promised service until someone agrees.

Collect permission at the right moment

Checkout is convenient, but it isn't always the best moment for every sponsor. A buyer concentrating on ticket types and payment may not yet know whether a sponsor's offer interests them.

Use checkout when the sponsor and purpose are already settled and the request fits without burying the purchase. If sponsorship sales are still underway, don't ask buyers to consent to businesses you'll name later. A list of sponsors added after purchase doesn't rewrite an earlier invitation.

At the event, a demonstration stand can make the choice more relevant. Someone has seen the product, spoken to the team and understands why follow-up might be useful. Put the notice where the person gives their details, rather than somewhere else in the venue.

A QR code can lead to a sponsor-specific form. Explain the destination before the scan. "Request a Northbank demonstration" sets a different expectation from "Scan for your event badge". Keep essential event access separate from optional marketing collection.

If the sponsor collects details directly through its own form, it needs to provide its information and manage the appropriate permission. You still need to understand the activation you're hosting and avoid promising that direct collection removes every responsibility your event business may have.

A badge scan needs an explanation

Scanning a badge doesn't tell you what the attendee understood. Was it entry to a booked session, proof of a stand visit, a request for one brochure or agreement to future marketing?

Train the stand team to say what the scan does before taking it. Match their script to the form and stored record. If the scanner automatically puts everyone into a marketing audience, change that setup before doors open.

A request for a brochure should deliver that brochure. It shouldn't quietly subscribe the attendee to every sponsor campaign. Future promotional messages need their own appropriate permission or other valid route. Be careful with systems that label all scanned contacts "leads" because that word can hide very different intentions.

Paper forms can work too. Keep the invitation readable, give people a real choice and store the evidence securely. Photographing a messy sheet after the event isn't a substitute for knowing which person agreed to which use.

One ticket order doesn't cover every guest

At a conference, a manager might book tickets for a whole team. Their marketing choice doesn't make choices for the other attendees. The same issue appears when someone buys festival tickets for friends or transfers a ticket later.

Keep each person's permission attached to that person. Don't copy the buyer's sponsor checkbox into every guest record. If you can't establish the guest's choice, leave that guest out of the consent-based sponsor transfer.

This also protects the sponsor's results. A list full of guests who never saw the invitation creates awkward follow-up, even when the original buyer was enthusiastic. Build the collection around the people who will actually receive the message.

Keep an eye on promises made outside the formal proposal. Your sponsor contact might tell its sales team that every attendee will become a contact. Your event salesperson might mention a database during a call without checking the permission arrangement. Ask both teams to use the agreed description in their briefings.

If the sponsor wants a larger eligible audience, improve the invitation and the activation for future attendees. Explain the relevant offer more clearly, put the choice where people can judge it and make the form easier to use. Don't change existing records to manufacture the result. A smaller list with a clear reason for contact gives the sponsor a campaign it can explain, and gives your team fewer confused replies to handle after the event.

Keep evidence that survives a sponsor query

Your sponsor may ask, "How do we know these people agreed?" You should be able to answer without relying on whoever happened to build the form.

Keep the attendee identifier, their affirmative choice, the sponsor, the purpose and the contact method. Link that record to the date and time, where the choice happened and the exact wording shown then. Keep the matching privacy information too.

A field saying "marketing consent: yes" is too broad for this arrangement. It doesn't tell you whether the person agreed to your event announcements or Northbank's emails. It also doesn't show whether that record existed before the sponsor joined the event.

Keep the earlier wording when you change the form. A link to today's page only tells you what people would see now. If an attendee chose last month, you need the information they saw last month.

Set up the records through your approved form and data tools. Don't ask the delivery team to recreate permission from memory after the show. They can check a system; they can't reconstruct a conversation they didn't hear.

Record withdrawals as well. A person who agreed during checkout might change their mind before the event. When you prepare the transfer, the latest valid choice matters more than the first positive response you collected.

Give the sponsor enough evidence to check eligibility without sending unnecessary browsing history or unrelated booking details. Agree how it can inspect the relevant wording and record. An export containing every technical field your form captured isn't automatically a sensible evidence package.

Agree how the sponsor will use the information

Before you send the file, ask who decides what happens to it. If the sponsor chooses its own campaigns, it's usually a controller, the business responsible for why and how it uses those details.

An agency following your instructions may instead be a processor. In some arrangements, organisations jointly decide the purpose and means. The actual work determines the role. Calling every partner a processor in the contract doesn't make it true.

Those roles change the arrangements you need. A processor relationship requires appropriate contractual terms. Joint controllers have specific responsibilities to allocate. For separate controllers, a clear data sharing agreement helps both sides understand the handoff.

The ICO's data sharing agreement guidance calls such an agreement good practice and explains that it doesn't itself make an unlawful use lawful. Use it to document the real arrangement, rather than treating a signature as permission.

The document should make the permitted use clear. Which sponsor receives which information? For what purpose? Through which channel? Who checks the records? Who handles objections or withdrawals? How long can each business keep the information for that purpose?

Add the practical details your teams need. Name the recipient responsible for the file. Set the secure transfer method and access controls. Agree what happens when a record is wrong, a request arrives or the relationship ends.

If the sponsor wants to involve an agency, establish what the agency will do before you approve the arrangement. Don't let "we'll upload it to our CRM" become permission to share it with an unlimited set of businesses for their own campaigns.

A contact list for sponsor email offers also isn't automatic permission for advertising audience uploads, profiling or sale to another company. Those are different proposed uses. Evaluate them separately instead of stretching the original checkbox until it covers whatever the sponsor's marketing team tries next.

Rehearse the sponsor handoff before launch

Let's put this into a conference conversation. Your audio sponsor wants product enquiries, and your team initially offers every attendee's email address. Ask which enquiries would actually help its sales team. The sponsor wants people considering new equipment, rather than everyone who happened to buy admission.

You agree on a demonstration space and a separate invitation for Northbank email updates. Your package explains that the sponsor will receive only eligible contacts who make that choice. The event still delivers the demonstration space if nobody joins the mailing list. That distinction belongs in the commercial agreement before the price is approved.

Now run a rehearsal with test records. One person accepts organizer news only. Another chooses Northbank emails. A third accepts Northbank emails and then withdraws. A group buyer supplies guest names without guest choices. Ask the team to produce the sponsor audience and explain every inclusion.

Only the record with the current Northbank email choice should enter this consent-based handoff. If the other records appear, fix the audience selection before launch. Then ask the sponsor to demonstrate how it applies a later withdrawal to a contact already imported.

Finally, check the attendee experience. Can someone buy with both marketing boxes empty? Can they find the sponsor's identity and privacy information? Does the withdrawal route work on a phone? Does the sponsor's first email match the purpose the person accepted?

This rehearsal gives you something better than a reassuring sentence in a proposal. It shows whether the package, invitation, records and sponsor campaign agree. Keep the test outcome with the campaign brief so the people covering the event can follow the same arrangement when your usual contact is away. Repeat the relevant checks when a sponsor, purpose or collection method changes, rather than assuming the original rehearsal still proves everything works.

Send the smallest eligible list

Build a sponsor transfer from the approved purpose, rather than exporting the whole attendee table and removing a few columns at the end.

For the fictional Northbank email offer, name and email address may be enough. A buyer's home address, ticket spend, access requirements, dietary notes or payment information doesn't become relevant because it sits in the same database.

Treat sensitive information with particular care. Accessibility requests or health-related details collected to deliver the event should stay in the delivery workflow. Don't use them to help a sponsor identify a promising customer without a separately reviewed basis and the additional conditions that may apply.

Before the transfer, check that each included person has a valid sponsor-specific choice for the intended purpose and channel. Remove withdrawals. Resolve unclear records. Exclude guests whose permissions were copied from the buyer. Check the approved fields and recipient again.

Make someone responsible for that final check. It can be a small task in a small event business, but it needs an owner. Otherwise the sales team assumes operations checked it, and operations assumes the sponsor already has permission.

Use an approved secure transfer with limited access and a record of the handoff. Don't leave an unrestricted file in a shared event folder or send it to a large email thread. The sponsor's salesperson may be your contact, but that doesn't mean every person copied into negotiations should receive attendee details.

If the recipient is overseas, review international transfer requirements before sending or granting access. The sponsor's location, its systems and its service providers can all matter. Consent to ordinary marketing is not a substitute for addressing those requirements.

Run the check again if delivery is delayed

Imagine you prepare the list before the event, but the sponsor can't import it until the following week. People can withdraw during that gap. Set a process for checking and communicating changes before the sponsor starts the campaign.

An approved list is a record of a particular moment. It doesn't freeze people's choices. Agree who will send updates, how the sponsor will apply them and when both teams will confirm the audience is ready.

Don't promise the sponsor a fixed number of contact records regardless of consent. Sell the activation you can deliver, describe how interested people can respond and be honest about the uncertainty. That is much easier to manage than a guarantee that pushes your team to include doubtful records.

Make withdrawal work after the handoff

The attendee needs an easy way to change their mind. Build that route before collecting permission, and test it before you share the first contact.

If someone withdraws the permission you rely on for sponsor sharing, stop the affected consent-based processing. If you've already sent their details, use the agreed process to tell the sponsor and obtain confirmation of the action needed for that arrangement.

The sponsor also needs its own functioning unsubscribe route for marketing. Don't leave the attendee bouncing between businesses because each says the other collected the record. Explain the available routes clearly and make the teams cooperate.

A withdrawal doesn't automatically erase every record of an event booking. You may have separate reasons to retain information for accounting, customer service or legal claims. Keep those purposes separate from marketing and explain the relevant retention approach.

Likewise, a minimal suppression record can help prevent a person being added back to a mailing list. Keep only what you need for that job, restrict its use and document the appropriate basis. Deleting every trace without a plan can lead to another import sending the same person another promotion.

Your process should also cover corrections. If the attendee entered the wrong address, forwarding the corrected details to the right sponsor may need action in both systems. Don't fix the event record and assume a copy already transferred fixes itself.

Test a withdrawal after an export and before a scheduled campaign. That's where a lot of otherwise reasonable processes break. The form updates one database, but the sponsor still has yesterday's file and its campaign goes out anyway.

Set a clear operational response with the sponsor. "Our teams will coordinate" isn't enough for the person who has to stop the send. Name who receives the request, how it reaches the campaign owner and what confirmation comes back. Confirm the campaign owner has received that instruction.

What if you've already promised the attendee list?

Pause the transfer and look at the actual agreement, invitation and records. Don't send the file first and hope an unsubscribe link will make it fine later.

If the existing invitation doesn't support the intended sponsor marketing, renegotiate the deliverable. You could offer an on-site activation, an anonymous performance report or another permitted placement. Explain the constraint early so the sponsor has time to choose something useful.

A new consent request might be possible through an appropriate channel, but don't assume you can email everyone to ask. A message asking people to opt into promotional contact can itself be marketing. Review whether you're permitted to send that invitation to the proposed audience.

Keep the conversation factual. You sold a benefit that needs a particular permission, and you don't have reliable evidence for some contacts. Offer a replacement you can fulfil. Avoid presenting a larger, unverified spreadsheet as the only way to protect the relationship.

If information has already been shared improperly, stop further transfers and get the appropriate privacy advice promptly. Work out what happened, what the sponsor has done and which remedial or reporting obligations apply. Don't try to repair the history by ticking a consent field after the fact.

Show sponsor value without sharing every contact

A sponsor can get useful evidence without a personal attendee list. Our guide to event sponsorship reports helps you organise what you delivered and what happened.

Report the measures you agreed, with their limits. A stand visit shows a visit. It doesn't prove purchase intent. A requested demonstration is a more specific response, and you can explain that difference without attaching the entire ticket database.

For audience summaries, make sure people aren't identifiable from the detail. Removing names alone may leave someone obvious in a small group, especially when a sponsor can combine the report with information it already has. The ICO's introduction to anonymisation explains why identifiability matters.

Our event sponsorship tools let you define priced packages and their perks on a private page, with approval available for selected packages. Use that clarity to sell the benefit you intend to deliver. Package administration doesn't decide whether you can share attendee details, so keep the permission arrangement alongside the commercial offer.

Get the arrangement right before tickets go on sale

Ask what the sponsor needs, choose the deliverable and check the legal route for both sharing and contact. For independent sponsor email marketing to individuals, build a clear optional choice around the named sponsor and the real purpose.

Keep evidence, transfer only eligible information and make withdrawal work after the handoff. Your attendee bought a ticket to your event. Give them a fair choice about the sponsor, and give the sponsor a benefit your business can deliver with confidence.