GDPR

Giveaways and personal data: what you may lawfully ask for

· · By Yuval Abudarham

A draw your entrants can recompute themselves

Seed published before the draw, public drand randomness, shareable video. Free for entrants.

Create an accountVerify an existing draw

An entry form is a temptation. Since the person is right there and wants to win something, why not collect their phone number, date of birth, city and interests along the way? The GDPR calls this excessive collection, and it is among the easiest breaches to establish: it's visible on the form.

The principle, in one sentence

Data collected must be adequate, relevant and limited to what is necessary for the purpose. The purpose here is running a giveaway: identifying entrants, selecting a winner, delivering their prize.

The test to apply to every field is simple and brutal: if this field were empty, could the promotion still run? If yes, the field is excessive.

Field by field

The email address is necessary. It confirms the entry and notifies the winner. In most promotions it is also the only genuinely indispensable field.

Name and surname are defensible but rarely necessary to enter. They become necessary when the prize is delivered. Good practice is to ask only the winner, after the draw — not everyone, before.

The postal address follows the same logic, more starkly: it serves only to ship a physical prize, so only one person in a thousand. Asking for it at sign-up means collecting nine hundred and ninety-nine addresses you will never use.

Date of birth is justified only where an age condition exists, and even then an "I am over 18" checkbox almost always suffices. The exact date is more precise than the need.

Phone number is the most questionable field. It serves the promotion only if the prize requires it — a hand delivery, say. Otherwise it is collected for marketing, and must then be presented as such: optional, with separate consent.

City, occupation, interests have nothing to do with running a draw. These are marketing segmentation fields, belonging to another purpose, another legal basis, and separate consent.

The two-stage form

The practical conclusion is a reorganisation: collect the minimum at entry, the remainder at win.

  1. At sign-up: the email address, plus the age checkbox if required.
  2. After the draw, from the winner alone: whatever prize delivery requires.

This isn't only compliant, it performs better. Every added field lowers completion rates — and a short form increases entries as much as it reduces risk.

IP addresses and technical fingerprints

A separate case, often mishandled. An IP address is personal data. Collecting it to prevent fraud is legitimate, on three conditions: that it is disclosed, that it serves only that purpose, and that it doesn't outlive the need justifying it.

On DrawSeal, IPs are never stored in the clear: they are reduced to a fingerprint that detects multiple entries without allowing the address to be reconstructed. The need — excluding ten sign-ups from one machine — is met; the data itself is gone.

Key takeaways

There is one test: if this field were empty, could the promotion run? Email passes it, almost nothing else does. Name, postal address and phone serve prize delivery only: ask the winner, after the draw. Date of birth, city, occupation and interests belong to marketing, hence a distinct purpose and separate consent.

FAQ

Can you ask for the entrant's Instagram handle?

Yes if it serves the promotion — for example to verify a follow condition stated in the rules. No if it serves to build a list of accounts to approach later.

Is an optional field always acceptable?

It is more defensible, but not automatically so. An optional field is still collection, so it needs a stated purpose. "Optional" does not excuse you from explaining what it's for.

How long should non-winners' data be kept?

As long as the promotion and any complaint handling require, no longer. If the entrant separately consented to marketing, that consent has its own duration, distinct from the promotion's.

Do you need a data protection officer for a giveaway?

Not necessarily: the obligation depends on the organisation, not the promotion. The processing must, however, appear in your record of processing activities, and entrants must be informed of how you handle their data.

Read next

Try it