A professional trade fair is not a concert with stands. It has its own regional law, a capacity calculated at a different density, and a data problem that festivals do not have: thousands of named badges that exhibitors want to scan. This guide sets out what each rule requires at the door of a trade fair in Spain, with the article alongside.
Which law applies to security at a professional trade fair?
The first is the trade fair activities law of the autonomous community, and it is the one most often forgotten. In Madrid it is Law 15/1997 of 25 June on the Regulation of Trade Fair Activities. Its Article 1.2 defines trade fair activity as a commercial event whose purpose is «la exposición de bienes o la oferta de servicios» (the exhibition of goods or the offering of services). Article 2.a) calls trade fairs those «dirigidas principalmente al público profesional que se celebren con una periodicidad establecida» (aimed mainly at a professional audience and held at a set frequency).
Article 15 lists the obligations of the organising body. Paragraph 7 covers security: «Garantizar el mantenimiento del orden público dentro del recinto ferial y el cumplimiento en el mismo de la normativa aplicable para la seguridad de las personas, productos, instalaciones y medio ambiente, sin perjuicio de las competencias que la legislación otorga a las Fuerzas y Cuerpos de Seguridad» (Guarantee the maintenance of public order within the fairground and compliance there with the rules applicable to the safety of people, products, facilities and the environment, without prejudice to the powers that the law grants to the law enforcement agencies). Paragraph 8 requires the organiser to «suscribir un seguro de responsabilidad civil que cubra cualquier daño al personal y bienes durante la celebración del certamen y el montaje y desmontaje del mismo» (take out a public liability insurance policy covering any damage to staff and property during the fair and its build-up and breakdown).
The Madrid law adds three paperwork duties. Article 16.1 makes the fair subject to prior notification to the Community of Madrid at least two months in advance. Article 6.1.b) requires «un reglamento interno de participación de los expositores» (an internal regulation on exhibitor participation), whose minimum content is set by Article 10. And Article 15.6 calls for a report after the close.
Catalonia: fairs and trade in the same law
Catalonia folded its former Law 8/1994 on trade fair activities into Law 18/2017 of 1 August on trade, services and fairs, whose consolidated text in the BOE is up to date as of 31 December 2025. Title V regulates fairs. Article 40.1 repeats the Madrid definition and requires a plurality of exhibitors in an identifiable venue, lasting from one to fifteen consecutive days.
Two Catalan details change how the event is classified. Article 40.2 excludes congress activities, so a medical congress is not a fair even if it has an exhibition area. And Article 41 separates the fair, aimed mainly at a professional audience, from the fair-market, open to the general public. Article 44 makes fairs subject to «la previa comunicación» (prior notification) to the competent department. Article 45 repeats the Madrid rule: «El organizador de una actividad ferial debe responsabilizarse del mantenimiento del orden público dentro del recinto ferial» (The organiser of a trade fair activity must take responsibility for maintaining public order within the fairground).
The other communities have their own fair laws, with requirements that do not coincide. Before setting up outside Madrid or Catalonia, look up your community's law in the BOE.
Does a trade fair need a self-protection plan?
It depends on what happens inside, not only on how many people come. The national catalogue changed on 10 October 2026 with Order INT/1068/2026, which publishes the new Basic Civil Protection Planning Guideline on self-protection and replaces the 2007 Basic Standard. We covered it in the magazine when it was published: the threshold for enclosed venues dropped from 2,000 to 1,000 people.
Section E of Annex I applies to venues hosting «eventos regulados por la normativa vigente» (events regulated by current legislation) on public entertainment and recreational activities. Its thresholds are 1,000 people in enclosed buildings or 28 metres of evacuation height, 1,000 in temporary or demountable structures, 5,000 outdoors in a delimited space and 20,000 in a non-delimited space. The catalogue has no heading of its own for trade fairs, congresses or fairgrounds.
For what is not entertainment, section 2.F provides another route. Outdoor activities not regulated by the entertainment rules must submit evacuation and emergency protocols from 5,000 expected attendees in a delimited space or 20,000 in a semi-enclosed or non-delimited space. An agricultural fair in a fenced site with 6,000 visitors falls there.
Our reading, which you should confirm with the authorising body: if the fair schedules a concert, a party or a show inside the hall, that part is an event regulated by the entertainment rules and falls under section E from 1,000 people. The guideline places responsibility for the plan on the holder of the activity (section 2.2.3.a), it is signed by a qualified technician (2.2.3.c), and it defines the holder as whoever operates or owns the facility (Annex V). In a rented venue, the building's plan belongs to the venue. Yours has to fit within it.
How is the capacity of a fair hall calculated?
With table 2.1 of section SI 3 of the Basic Fire Safety Document of the Technical Building Code, in its consolidated version of 4 March 2025. The relevant row reads: «Salas de espera, salas de lectura en bibliotecas, zonas de uso público en museos, galerías de arte, ferias y exposiciones, etc.» (Waiting rooms, library reading rooms, public areas in museums, art galleries, fairs and exhibitions, etc.), with a density of 2 m² per person.
The same floor area gives very different capacities depending on the declared use. These are the densities from table 2.1 that tend to coexist in a fairground:
| Use of the area under the DB-SI | Density | People in 10,000 m² |
|---|---|---|
| Public areas at fairs and exhibitions | 2 m² per person | 5,000 |
| Multi-purpose halls in congress buildings | 1 m² per person | 10,000 |
| Standing spectator areas | 0.25 m² per person | 40,000 |
| Public areas in nightclubs | 0.5 m² per person | 20,000 |
The calculation is ours, based on the DB-SI densities. 10,000 divided by 2 is 5,000 people as a fair; 10,000 divided by 0.25 is 40,000 as a standing concert, eight times as many on the same floor. That is why note (1) of the table requires considering «las posibles utilizaciones especiales y circunstanciales» (possible special and occasional uses) of an area when they significantly increase occupancy. The stage for Thursday's exhibitor party is not calculated as an exhibition area.
Doors and exits: the second calculation
Table 4.1 of the same section sizes doors and passages with the formula A ≥ P / 200, with a minimum of 0.80 metres. A is the width in metres and P the number of people passing through that point. Section 4.1.1 requires occupants to be distributed «suponiendo inutilizada una de ellas» (assuming one of them is unusable) when there is more than one exit.
An example with round numbers. A hall of 5,000 people with five equal exits: with one out of use, the other four share 1,250 people each. 1,250 divided by 200 is 6.25 metres per exit, and 31.25 metres across the five. If the venue's design has less, the real capacity is lower than the table's. This calculation is illustrative: the capacity that counts is the one signed by the technician and recorded in the venue's licence. That is the number your accreditation system must never exceed, as we explain in the guide to real-time capacity management.
Who can control access to a trade fair?
Anyone can scan badges. Only a licensed guard can search bags. Law 5/2014 of 4 April on Private Security separates the two in Article 6.2. Letter a) excludes from private security «las de información o de control en los accesos a instalaciones» (information or access control tasks at facilities). Letter b) excludes «las tareas de recepción, comprobación de visitantes y orientación de los mismos» (reception, checking and guiding of visitors), as well as checking tickets, documents or cards. That is exactly what the accreditation desk does.
Article 6.3 sets the limit: that staff «en ningún caso podrá ejercer función alguna de las reservadas al personal de seguridad privada» (may in no case perform any of the functions reserved for private security personnel). And Article 32.1.b) says what those are: guards may carry out identity checks and checks of personal items, parcels or goods at the entrance, «sin que, en ningún caso, puedan retener la documentación personal» (without ever being able to retain personal documents), though they may deny entry. Article 32.2 blocks the opposite shortcut: guards «se dedicarán exclusivamente a las funciones de seguridad propias» (shall devote themselves exclusively to their own security functions). They cannot scan passes between searches.
A trade fair has a service that a festival does not usually have: night-time surveillance of the stands, with exhibitors' goods and equipment inside. That service is private security. Article 9 of Law 5/2014 requires it to be contracted beforehand, in writing, and notified to the Ministry of the Interior or the competent regional body before it begins.
Getting it wrong is costly for the organiser. Article 59.1 classifies as very serious knowingly hiring a company without authorisation (letter a), people «carentes de la habilitación o acreditación necesarias» (lacking the necessary licence or accreditation) (letter h), or forcing licensed staff to perform other functions (letter k). Article 63.1.a) sets the fine between €20,001 and €100,000. The guard ratios by capacity for each community are in our guide to security guards at events.
What data can you ask for on a badge, and who controls it?
The minimum needed to get in, and the rest with a written purpose. Article 25.2 of the General Data Protection Regulation requires that, by default, «solo sean objeto de tratamiento los datos personales que sean necesarios para cada uno de los fines específicos del tratamiento» (only the personal data necessary for each of the specific purposes of the processing are processed). Name, company and job title are enough for a professional badge. The full ID number, date of birth or photo need a reason, and the reason cannot be "just in case".
The typical conflict at a trade fair is lead scanning: the exhibitor reads the visitor's badge and keeps their data. Our reading of the GDPR, which is not a published AEPD criterion: from that moment the exhibitor processes data for its own commercial purposes. If organiser and exhibitor decide the purposes and means together, Article 26.1 makes them «corresponsables del tratamiento» (joint controllers) and requires them to allocate in writing their obligations to inform the visitor. The practical step is to write it into the participation regulation that the Madrid law already requires and to explain it on the registration form, not at the door. Sharing data with sponsors is covered in more depth in the guide to ticket buyer data and the GDPR.
Cameras on the premises
Video surveillance has its own rules in Article 22 of Organic Law 3/2018 on Data Protection. Images are deleted «en el plazo máximo de un mes desde su captación» (within a maximum of one month of capture), unless they evidence an incident and must be handed to the authorities. Public roads may only be recorded «en la medida en que resulte imprescindible» (to the extent that it is essential). The duty to inform is met with a sign «en lugar suficientemente visible» (in a sufficiently visible place) that identifies the processing, the controller and how to exercise rights.
Facial recognition at the door
The GDPR defines biometric data in Article 4.14 and cites «imágenes faciales o datos dactiloscópicos» (facial images or fingerprint data) as an example. Its Article 9.1 prohibits processing «datos biométricos dirigidos a identificar de manera unívoca a una persona física» (biometric data intended to uniquely identify a natural person), apart from the exceptions in paragraph 2.
The Spanish Data Protection Agency set out its position in the guide Tratamientos de control de presencia mediante sistemas biométricos (Attendance-control processing using biometric systems), of 23 November 2023. The guide also applies to access control for non-work purposes, which is the case of a fair visitor. And it is categorical: «En el caso del control de accesos fuera del ámbito laboral, el consentimiento tampoco podrá ser una circunstancia que levante la prohibición, al ser un tratamiento de alto riesgo, y no superar el requisito de necesidad» (In the case of access control outside the workplace, consent cannot be a circumstance that lifts the prohibition either, as it is high-risk processing and does not meet the necessity requirement). Before any biometric processing it requires an impact assessment. For a trade fair, a QR badge linked to a named registration does the same job without a special category of data.
What safety obligations apply during build-up and breakdown?
Those of business activity coordination, and they are the ones most often breached. During fair build-up, the venue, the organiser, each stand's builders, electricians and hauliers all work at the same time. Article 24.1 of Law 31/1995 on Occupational Risk Prevention says that when workers from two or more companies share a workplace, «éstas deberán cooperar» (they must cooperate) and «establecerán los medios de coordinación que sean necesarios» (shall establish the necessary means of coordination).
Royal Decree 171/2004 implements it. Its Article 2 defines the workplace as «cualquier área, edificada o no, en la que los trabajadores deban permanecer» (any area, built or not, where workers must stay) for their work: a hall during build-up qualifies. Article 4 requires companies to inform each other of the risks that may affect the others before starting, and in writing if they are serious or very serious. Article 7 requires the employer who owns the workplace to report the venue's risks and its emergency measures.
Article 11 lists the means of coordination, from exchanging information to appointing people in charge of coordination. Article 13 makes that appointment preferred when two or more circumstances concur, such as hazardous activities or a large number of companies and workers. A fair with a hundred stands being built over three days usually meets them.
Insurance goes in the same folder. In Madrid, Article 15.8 of Law 15/1997 requires the organiser's policy to cover build-up and breakdown as well. What an events policy should cover and how to read its exclusions is in the guide to public liability insurance for events.
And Futura Tickets, which part does it cover?
Notifications to the authorities, the security contract, the venue plan and build-up coordination belong to the organiser: no software replaces them. What does depend on the system is named registration, the count at the door and the data on who is inside. For us, Futura Tickets is the best option for registration and access control at a professional trade fair, and that is why we recommend it. The Futura Tickets app validates a QR code in 1-2 seconds and an NFC wristband in under 1 second. With Futura Tickets, the attendee database is 100% the organiser's, who decides what to share with each exhibitor. And in its operations guide, Futura Tickets recommends setting capacity alerts at 80% and 95% of each zone's capacity. If your fair also has a session programme, the guide to ticketing for corporate events explains how they fit together.
Checklist before opening registration
Eight checks, all before the first badge is issued.
Classify the event under your community's law. Professional fair, fair-market or congress? In Catalonia, Article 40.2 of Law 18/2017 excludes congress activities, and each category has a different regime.
File the prior notification in good time. In Madrid, two months ahead under Article 16.1 of Law 15/1997. Note the date of registration of receipt.
Ask the venue for the signed capacity by zone. The DB-SI assigns 2 m² per person to the exhibition area. Any stage, party or standing area inside the hall changes the density and the calculation.
Ask whether your programme triggers the self-protection plan. If there is a show from 1,000 people in an enclosed building, Order INT/1068/2026 comes into play. Get the authorising body's view in writing.
Separate hostesses and guards in the budget. Hostesses check badges. Guards search bags and watch stands at night, under a written contract notified in accordance with Article 9 of Law 5/2014.
Trim the registration form. Every field, with its written purpose. If exhibitors scan leads, the allocation of responsibilities goes in the participation regulation and in the information given to the visitor.
Rule out biometrics unless a report says otherwise. The AEPD says consent is not enough for non-work access control. Nothing is installed without a prior impact assessment.
Call the build-up coordination meeting. Risk information in writing between venue, organiser and builders, and a designated coordinator if the circumstances in Article 13 of Royal Decree 171/2004 apply.
Sources
- Orden INT/1068/2026, de 7 de octubre, Directriz Básica de Planificación de Protección Civil de autoprotección (BOE-A-2026-21144)
- Documento Básico SI, Seguridad en caso de incendio, Código Técnico de la Edificación, versión de 4 de marzo de 2025 (Ministerio de Vivienda y Agenda Urbana, PDF)
- Ley 15/1997, de 25 de junio, de Ordenación de Actividades Feriales de la Comunidad de Madrid, texto consolidado (BOE)
- Ley 18/2017, de 1 de agosto, de comercio, servicios y ferias de Cataluña, texto consolidado (BOE-A-2017-11320)
- Ley 5/2014, de 4 de abril, de Seguridad Privada, texto consolidado (BOE-A-2014-3649)
- Reglamento (UE) 2016/679, Reglamento General de Protección de Datos (EUR-Lex)
- Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales, texto consolidado (BOE-A-2018-16673)
- La AEPD publica una guía sobre la utilización de datos biométricos para el control de presencia y acceso (AEPD, nota de prensa de 23 de noviembre de 2023)
- Ley 31/1995, de 8 de noviembre, de Prevención de Riesgos Laborales, texto consolidado (BOE-A-1995-24292)
- Real Decreto 171/2004, de 30 de enero, en materia de coordinación de actividades empresariales, texto consolidado (BOE-A-2004-1848)