Digital Business Cards and UK GDPR: What to Tell the People You Share With
Digital Business Cards UK Editorial Team — — Guides
What UK GDPR means in general terms when your digital business card collects other people's details, and where to find the ICO's official guidance.
In short: if you use a digital business card to collect other people's contact details, those details are personal data under UK GDPR. In general terms you should tell people who you are, why you want their details, what you will do with them and how to ask for removal. This guide is general information, not legal advice; check the ICO's guidance.
A digital business card makes it easy to swap details, and with lead-capture features it can also collect them. That second part is where data protection comes in. This guide sets out general, checkable facts about the UK framework and what people commonly tell the contacts they share with. It does not tell you what the law requires in your circumstances — the Information Commissioner's Office (ICO) is the authoritative source. For the buying side, see our UK buyer's guide to digital business cards.
The framework in brief
Data protection in the UK is governed mainly by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The ICO is the regulator. Electronic marketing, such as emails and texts, is also covered by the Privacy and Electronic Communications Regulations (PECR).
What counts as personal data?
Information about an identified or identifiable living person. A named person's work email address or mobile number is personal data.
Controllers and processors
A controller decides why and how personal data is used. A processor handles data on a controller's behalf. If you collect leads through your profile, you will typically be the controller for those contacts, and the profile platform will often act as your processor.
Your own profile versus the details you collect
Your profile shows information you have chosen to publish about yourself. The position changes when the card is used to gather other people's information — for example through a contact form, a "share your details back" option or a card scanner. Those details belong to other people, and the general principles of UK GDPR apply to how you handle them.
What people commonly tell their contacts
UK GDPR includes a right to be informed. The ICO's guidance describes the information organisations generally provide, such as:
- who you are and how to contact you
- why you are collecting the details
- the lawful basis you rely on
- how long you will keep the details
- who else will receive them, if anyone
- the rights people have, including access, correction and erasure
- how to complain to the ICO
A short privacy notice linked from your profile is a common way to provide this. The ICO publishes guidance and templates for small organisations.
Lawful basis
UK GDPR sets out six lawful bases for processing: consent, contract, legal obligation, vital interests, public task and legitimate interests. Which one applies depends on what you are doing; the ICO has an interactive tool to help organisations choose.
Marketing emails
If you plan to send marketing emails to people you met, PECR rules on consent and the "soft opt-in" are relevant. Check the ICO's guidance on direct marketing before you start.
Practical habits to consider
These are general good practices rather than legal requirements for any particular situation:
- Collect only what you need. A name, email and the reason they want to hear from you is often enough.
- Keep leads in one place. Avoid copying contacts across several spreadsheets and apps.
- Decide when you will delete. Set a review period for contacts you never followed up.
- Restrict access. Only people who need the leads should see them.
- Export with care. Store exported files securely and delete copies you no longer need.
Questions to ask a provider
- Where is profile and lead data stored?
- Is a data processing agreement available for business customers?
- Can I export and delete all the data my profile has collected?
- Who at the provider can access my leads?
On this site, leads captured with the Business Add-ons plan stay in your dashboard and can be exported to a spreadsheet. See the digital business card for face-to-face networking for the plan details.
A simple record to keep
Many small organisations find it useful to keep a short written note of how they handle the details they collect. It might cover:
- what details you collect through your profile and why
- where those details are stored and who can see them
- how long you keep them before reviewing or deleting them
- how someone can ask to see, correct or remove their details
- whether you send marketing emails, and on what basis
Writing this down once makes it easier to answer questions from contacts and to keep your habits consistent. The ICO's guidance for small organisations explains what records may be relevant to you.
Mistakes to avoid
- Assuming data protection does not apply because the card is "only" a business card
- Adding met contacts to a marketing list without checking the PECR rules
- Keeping old leads indefinitely with no review
Frequently asked questions
Does UK GDPR apply to digital business cards?
It applies to personal data. If your card collects other people's contact details, those details are personal data.
Do I need a privacy notice on my profile?
The right to be informed generally requires people to be told certain things when their data is collected. Check the ICO's guidance for what applies to you.
Is this legal advice?
No. This is general information. For your circumstances, read the ICO's guidance or take professional advice.
Where can I find official guidance?
The Information Commissioner's Office website, ico.org.uk, publishes guidance for small organisations, including on the right to be informed and direct marketing.