All articles

Are Digital Business Cards GDPR Compliant?

Digital business cards can be GDPR compliant, but the format isn't the test. How you collect, store and follow up on contact data is.

Nookesh Karri

· 8 min read

Dark cover card with the title 'Are Digital Business Cards GDPR Compliant?' in white and a lime accent bar

Digital business cards can be GDPR compliant, but no card is compliant on its own. GDPR looks at what personal data you collect, why, and what you do with it next. A card that shows your own details is low risk. A card that captures other people’s details and feeds a marketing list needs a lawful basis, a privacy notice and a way to delete data.

Does GDPR apply to digital business cards at all?

GDPR applies to digital business cards whenever they hold details about a named person, which is almost always. The European Commission says the rules don’t cover data about a company itself. They do cover personal data “in the course of a professional activity”, and its example is a work email like forename.surname@company.eu, plus business phone numbers.

So “it’s just business contact data” isn’t an exemption. A generic sales@ inbox is company data. Your name, direct line and work email are personal data. The Commission adds that details of a one-person company can count as personal data too, which matters if you’re a freelancer.

There is one narrow exception. Article 2 excludes processing “in the course of a purely personal or household activity”. Swapping numbers with a friend fits. Collecting leads for your business doesn’t.

The three data flows a digital business card creates

A digital business card moves personal data in three different directions, and each one has different rules. Most compliance guides treat the card as one thing.

Data flow Whose data Who decides how it’s used What you need
Your own profile Yours (or your staff’s) You or your employer Show only what you want public
Views and saves of your card Visitors’ usage data You and the card vendor A vendor you trust, a clear privacy policy
Leads you capture The people who share details back You A lawful basis, a notice, deletion on request

The third flow is where the duties sit. You’re collecting someone else’s data for your own purposes.

Your own details on the card

The data on your own card is the easiest part, because you chose to publish it. If a company hands cards to its staff, though, the company is putting employee data online and should only publish what each role needs.

Article 5 calls this data minimisation: data should be “limited to what is necessary”. A field sales rep may need a mobile number on the card. An office-based analyst probably needs only an email.

In QRCard, each of phone, email and location can be set to Shown, Button only, or Hidden. Button only gives people a call or email button without showing the raw value on the page. If you’re weighing whether to show a mobile number at all, the risks of sharing a phone number on a card are worth reading first.

Leads you collect: picking a lawful basis

When a card captures someone’s details, you need one of the lawful bases in Article 6. For business cards, three come up:

  1. Consent: the person agrees “for one or more specific purposes”. Under Article 7 you must be able to show they agreed, and “It shall be as easy to withdraw as to give consent.”
  2. Contract: processing is needed for a contract, or for steps the person asked for before one, such as sending a quote they requested.
  3. Legitimate interests: you have a real business reason, unless the person’s interests or rights override it.

The ICO warns that legitimate interests puts more responsibility on you to justify the processing and protect people’s interests. You weigh your reason against what the person would expect.

My take: when someone at an event chooses to send you their details, legitimate interests is usually a sensible basis for a follow-up about the conversation you had. A monthly newsletter is a different purpose, and for that I’d ask for consent with an unticked checkbox.

What you have to tell people when you collect their details

Article 13 lists what you must tell someone when you collect data from them directly. The short version:

  • who you are and how to contact you
  • why you want the data and your legal basis
  • your legitimate interest, if that’s the basis
  • how long you’ll keep it
  • their rights to access, correct, erase, restrict, object and move their data

None of this has to sit on the card. A one-line note next to the lead form, linking to your privacy policy, is enough: “I’ll use these details to follow up on today’s meeting. Privacy policy.” The policy carries the rest.

Following up by email: the UK rule most guides skip

Email follow-up has a second layer in the UK called PECR, and it depends on who you’re emailing. The ICO’s business-to-business guidance says the PECR rule on marketing by email or text doesn’t apply to corporate subscribers: companies, LLPs and other bodies with separate legal status.

Sole traders and some partnerships count as individual subscribers, so the full rules apply to them. That matters for card users, because freelancers and small shop owners are exactly who you meet at local networking events.

Even for corporate contacts, the ICO says you must tell people you plan to market to them, have a lawful basis under UK GDPR, and identify yourself in every message. It also suggests a “do not email or text” list for anyone who opts out. Across the EU, Article 21 gives everyone the right to object to direct marketing at any time, and once they do, you stop.

The safest follow-up is a short message about the conversation you actually had. The guide to following up after a networking event has examples.

Your card vendor’s role

Your digital business card vendor usually processes leads on your behalf, which makes you the controller and the vendor a processor. Article 28 says a controller “shall use only processors providing sufficient guarantees”, and that processing must be “governed by a contract or other legal act”. That contract is usually called a data processing agreement (DPA).

Before you roll cards out to a team, check:

  • whether the vendor offers a DPA
  • where data is stored and who can access it
  • how you delete a lead, and how fast it’s really gone
  • whether you can export leads, so you can answer an access request

A limitation on our side: QRCard’s published product facts don’t yet document a hosting region, a DPA or certifications. If your company needs those in writing, ask us before you buy, and ask any other card vendor the same.

Storing and deleting the contacts you collect

GDPR expects you to keep personal data only as long as you need it. Article 5 calls this storage limitation: no longer “than is necessary for the purposes”. For leads, that means setting a review point, such as clearing contacts that never replied after a few months.

Leads rarely stay in one place. They end up in the card dashboard, a CSV export, your CRM and your phone’s contacts, and a deletion request has to reach all of them. Pick one system as the “home” for each contact. If you move leads out, the CSV export guide shows a clean way to do it.

In QRCard, Mutual Exchange lead capture is optional for the viewer: they choose whether to share their name, email, phone and a short note. Leads land in the dashboard and can be exported to CSV. The dashboard also tracks views, saves and traffic sources, which you can read more about in how to track who viewed your card.

A quick checklist

If you only do five things, do these:

  1. Publish only the contact fields each person actually needs.
  2. Add a one-line notice and privacy link next to any lead form.
  3. Pick and write down your lawful basis for follow-ups.
  4. Keep a do-not-contact list and honour objections straight away.
  5. Get a DPA from your card vendor and know how to delete a lead everywhere it lives.

This is general information about the law, not legal advice. If you handle sensitive data or work in a regulated field, talk to your data protection officer.

FAQ

Is a work email address personal data under GDPR?

Yes, when it identifies a person. The European Commission gives forename.surname@company.eu as an example of personal data, along with business phone numbers. A generic address for a company usually isn’t.

Not always. Consent is one of several lawful bases in Article 6. Many businesses rely on legitimate interests for networking contacts, but that basis needs a real balancing test and it has to be explained to the person.

Can I send marketing emails to people who scanned my card?

Under GDPR they can object to direct marketing at any time, and you must stop when they do. In the UK, the ICO says the PECR email consent rule doesn’t cover corporate subscribers such as companies and LLPs, but it does cover sole traders.

Is my card vendor responsible for GDPR or am I?

Usually you are the controller for the leads you collect, and the vendor processes them for you. Article 28 says you should only use processors with sufficient guarantees, under a contract that sets out what they do with the data.

Sources