Giveaways and GDPR: what actually falls to you

A giveaway that asks for an email address is processing of personal data. This is not a lawyer’s subtlety: from the first entry, you are a data controller under the GDPR, with the obligations that follow. The good news is that there are few of them and they fit on one page. The bad news is that most giveaways meet none.

This page describes general obligations and is not legal advice. Depending on your country, your sector and the volume you handle, your situation may call for professional advice. The reference texts are published by the European Data Protection Board.

1. A legal basis, and only one that holds

You must be able to say why you are allowed to process those addresses. For a giveaway, the basis is consent: freely given, specific, informed and unambiguous.

The word that counts is “unambiguous”. A pre-ticked box is not consent. An address scraped from the comments of a post is not either: the person commented, they did not consent to being in your database.

That is the point of double opt-in: the entrant receives an email and must click to confirm. You then hold a timestamped proof of consent that you can produce. Here, an unconfirmed entry does not join the draw — the rule is technical, not declarative.

2. Keep the giveaway separate from marketing

This is the most common mistake and the most expensive. Entering a giveaway is not consent to receive your newsletter. Those are two distinct purposes, calling for two distinct consents.

Concretely: two boxes, separate, neither pre-ticked, and entry must not be conditional on accepting the second. A giveaway that requires a newsletter sign-up turns consent into a toll — it is then no longer “freely given”, and it is worth nothing.

3. Collect only what is necessary

Minimisation is not advice, it is an obligation. To draw a winner and reach them, an email address is enough. Date of birth, phone number, postal address: they are justified only when they become necessary — the postal address when shipping the prize, for instance, not at everyone’s sign-up.

The question to ask of each field: “if I remove it, does the giveaway still work?” If yes, the field has no business being in the form.

4. Inform, plainly, at the point of collection

Before submitting, the entrant must know:

• who processes their data — you, not the platform you use;
• what for — the draw, announcing the winner, delivering the prize;
• how long it is kept;
• who it is passed to, if anyone;
• how to exercise their rights: access, rectification, erasure, objection, withdrawal of consent.

That information naturally belongs in the giveaway’s rules. Our guide to giveaway rules sets out what else they must contain.

5. Set a retention period, and purge

No keeping data “just in case”. You must announce a period and stick to it: the duration of the giveaway and of any possible challenge, then deletion.

One useful nuance: the data needed for the verifiability of the draw is not the addresses themselves. A seal is enough to prove a list did not change, without keeping the list itself. That is what makes it possible to purge without losing the proof.

6. Your processors are your responsibility

The draw tool, the email service, the host: these are processors under Article 28. You must know who they are, where the data is hosted, and hold a contract framing what they do.

What DrawSeal does on its side

• Hosting within the European Union, with no transfer outside the European Economic Area.
• Partitioning per organiser: your entrants’ data lives in a space separate from other customers’, and that isolation is held by a blocking test — not by an internal guideline.
• No audience measurement: no Google Analytics, no advertising pixel, no third-party tracker. That is also why the site shows no cookie banner: there is nothing to make you accept.
• The IP address is not kept: the country is derived in memory from an embedded database, for the rules’ sake — the IP is passed to no one and the resulting country is not stored.
• Double opt-in by construction: an unconfirmed entry is excluded from the draw.

The detail of purposes, processors and rights is in our data protection policy, which is the binding document.

7. Be able to answer a rights request

An entrant may ask for access to their data, its rectification, its erasure, or withdraw consent — at any time, including during the giveaway. You have one month to answer.

The awkward case: an entrant asks for erasure after the draw. You can comply, because the proof of the draw rests on a seal and not on the list itself. That is exactly the sort of situation the distinction in point 5 exists for.

Read next

• Giveaway rules — what written rules must contain, clause by clause
• Running a giveaway — the full path, from prizes to handing over the prize
• Proof of a draw — screenshot, live stream, notary: what each really demonstrates

Frequently asked questions