GDPR
Entrant rights: what an organizer must be able to answer, and how fast
A draw your entrants can recompute themselves
Seed published before the draw, public drand randomness, shareable video. Free for entrants.
Create an accountVerify an existing drawAn entrant writes: "delete my data." The message arrives on Tuesday, the draw is Thursday. What do you do, and what are you required to do? The answer differs by which right is invoked, and the difference bears directly on the integrity of the draw.
The four rights you actually encounter
Access. The person asks what you hold about them. You must provide a copy of the data, the purposes, the recipients and the retention period. For a giveaway this is usually short: an address, a date, an entry status.
Erasure. The person asks for deletion. The right is not absolute — it yields to a legal retention obligation or the defence of legal claims — but in a giveaway it almost always applies.
Objection. The person refuses a processing activity, typically marketing. Unlike erasure, they are not asking their data to disappear, they are asking a specific use to stop.
Withdrawal of consent. It operates for the future only, and must be as easy to exercise as consent was to give. A one-click unsubscribe satisfies that; a request by postal mail does not.
The deadline: one month, and what it covers
A response is due within one month, extendable by two months for complex requests — provided you inform the person of the extension and its reason within the first month.
That deadline is not a processing deadline, it is a response deadline. Replying "we have received your request" does not stop it.
The case that really matters: the already-sealed draw
This is the situation organizers care about, and almost no article addresses it.
On DrawSeal, the entrant list is sealed when entries close: reduced to a fingerprint published before the randomness used even exists. That seal is what makes the draw demonstrable — if the list can still change afterwards, nothing is provable.
So what happens if an entrant requests erasure after sealing?
The two requirements conflict only if you believe the seal contains personal data. It does not: the tree's leaves carry only pseudonymous identifiers and weights. No email address, no name. Erasure applies to the personal data attached to the identifier; it removes them without touching the seal, which stays valid.
This is a direct consequence of a design choice: publish a fingerprint rather than a list. It lets you satisfy one entrant's right without destroying the proof owed to all the others.
How to organise, concretely
- A contact address stated in the rules and in every email. A request sent anywhere remains valid; you may as well direct it.
- A written procedure, however short: who receives, who verifies identity, who executes, where execution is logged.
- Proportionate identity checks. Demanding ID to delete an email address is excessive: control of the address usually suffices to establish it.
- A record of execution. That's what protects you if the same person returns six months later.
Key takeaways
Four rights recur: access, erasure, objection, withdrawal of consent — the last of which must be as easy to exercise as it was to give. The response deadline is one month. An erasure requested after the list is sealed does not destroy the proof of the draw, because the seal contains no personal data: only pseudonymous identifiers.
FAQ
Must an entrant be removed from the draw if they request erasure beforehand?
Yes, if the request arrives before entries close: there is no longer a basis for including them. After sealing, the entry stays counted in a frozen list, but the associated personal data is erased.
Can erasure be refused in order to keep proof?
Rarely, and you would have to justify the legal obligation relied on. Proof of a draw doesn't qualify once it rests on pseudonyms: the argument collapses by itself.
What do you answer to an access request about a promotion that ended two years ago?
Whatever you still hold. If the promotion's data was purged at the planned term, the answer is "we no longer hold this data", stating the retention period applied. That is a complete answer, not an evasion.
Does unsubscribing amount to an erasure request?
No. Unsubscribing is an objection to marketing. It even requires keeping a trace of the address, in a suppression list, so as not to contact it again.