UK Ticket Buyer Data: The DUAA 2026

Selling a ticket to a British buyer doesn't require their consent: it requires a legal basis, and the contract provides it. What has its own rules is the email you send them afterwards, the cookie your checkout page loads, and the complaint they write to you six months later. All three were reformed in 2026.

This guide walks through what the UK framework demands of an organiser from checkout onwards: which rules apply, what changed in 2026, when you can use your attendee list, which cookies are exempt from consent, how much a breach costs, and what happens if your platform is based in Spain. Quotes from legislation are given in English, with their reference.

Which rules protect ticket buyer data in the UK?

Four texts, and they need reading together. The first is the UK GDPR, the British version of Regulation (EU) 2016/679 retained after leaving the EU and published with its amendments on legislation.gov.uk. The second is the Data Protection Act 2018, which supplements it and sets the penalties. The third is PECR, the Privacy and Electronic Communications (EC Directive) Regulations 2003, which govern electronic marketing and cookies. The fourth is the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025 and reforms all three. The regulator is the Information Commissioner's Office (ICO).

The gateway provision is article 3 of the UK GDPR. Its paragraph 1 covers processing carried out "in the context of the activities of an establishment of a controller or a processor in the United Kingdom". Its paragraph 2 covers a controller not established in the UK when it processes data of data subjects "who are in the United Kingdom" and the activity relates to "the offering of goods or services (…) to such data subjects in the United Kingdom" or to monitoring their behaviour there.

For a Spanish promoter, the consequence is direct: if you sell tickets to UK residents from your website, you fall within scope under paragraph 2, even without a UK company or office. And you'll be under the European GDPR at the same time, which you'll already be working with if you follow the GDPR guide for organisers. They're two regimes sharing the same trunk, with different deadlines.

What changed on 5 February and 19 June 2026?

The reform didn't land all at once. In February 2026, the ICO published a statement on the commencement of the DUAA setting out that on 5 February 2026 "most of the remaining data protection provisions of the Act" came into force, leaving out "the requirement for organisations to have a complaints procedure which is due to commence" on 19 June 2026. In its June update, the ICO confirms the sequence is complete: twelve months after Royal Assent, every data protection provision is in force.

The official summary of the data protection changes is published by the ICO itself. Three elements matter to anyone selling tickets. A new legal basis appears: on 5 February 2026, article 6(1) of the UK GDPR gained paragraph (ea), for processing necessary "for the purposes of a recognised legitimate interest" listed in its Annex 1, which doesn't require a balancing test. Direct marketing is cited expressly as an example of processing that "may be necessary for a legitimate interest". And on data subject rights, the clock can now be paused: the controller can ask for clarification of a request and the deadline resumes once it's received, with searches that are "reasonable and proportionate".

Watch out for the easy reading. The fact that direct marketing can now rely on legitimate interest under the UK GDPR doesn't lift the PECR consent requirement for the electronic channel: these are two layers, and the second one is still there.

Can you send promotional email to someone who bought a ticket?

Yes, if you fit the soft opt-in. The general rule sits in regulation 22 of PECR: unsolicited email isn't sent for direct marketing purposes to an "individual subscriber" without their prior consent. The exception in paragraph 3 asks for three things at once: having obtained the contact details "in the course of a sale or negotiations for a sale" with that recipient, promoting similar products or services, and having given "a simple means of refusing (free of charge except for transmission costs)" both when collecting the details and in every subsequent message.

The ICO's guide to email marketing closes two doors that get used a lot in events. The soft opt-in "does not apply to prospective customers or new contacts (eg from bought-in lists)": a list bought or passed on by a sponsor doesn't qualify. Nor does it cover non-commercial promotions.

The same guide opens a useful door for anyone running conferences and trade fairs. Email or SMS can be sent to any "corporate body" — a company, a Scottish partnership, an LLP or a public body — while "sole traders and some partnerships are treated as individuals". In other words: a B2B campaign to corporate addresses doesn't need prior consent; the same campaign sent to a sole trader does. The ICO also recommends keeping a list of companies that have asked not to receive anything.

Since 5 February 2026 there's a further exception, regulation 22(3A), for charities: they can send marketing email when it pursues their charitable purposes and they obtained the contact details from someone who "offered support to, or expressed an interest in, the charity's charitable purposes". The UK government's factsheet on the PEC Regulations describes it as a dedicated soft opt-in for fundraising. If your festival is run by a registered charity, that route exists; if it's run by a trading company, it doesn't.

Above all of this sits article 21 of the UK GDPR. Its paragraph 2 grants the right to object at any time to processing for direct marketing purposes, including associated profiling, and paragraph 3 leaves no room for manoeuvre: "the personal data shall no longer be processed for such purposes". No balancing test applies. Whatever a reader clicks on "unsubscribe" has to propagate across all your lists, including those managed by whichever events email marketing tool you use.

Do you need consent for cookies on your checkout page?

It depends what each one does, and the answer changed in 2026. Regulation 6 of PECR now reads, since 5 February 2026: "Subject to Schedule A1, a person must not store information, or gain access to information stored, in the terminal equipment of a subscriber or user". The prohibition is unchanged; what's new is that "subject to Schedule A1".

Schedule 12 of the DUAA inserts that new schedule into PECR, listing the exceptions. The classic ones remain: technical transmission of the communication and what's strictly necessary to provide the service the user requested. Two new ones are added that affect an online box office directly. One applies when "the sole purpose of the storage or access is to collect information for statistical purposes about how the service is used". The other applies when the sole purpose is adapting "the way the website appears or functions" to the user's preferences.

The two new ones aren't free passes. They require clear information to the user and a simple way to object. And they require that this be the sole purpose: analytics that also feeds advertising retargeting falls outside the exception and back under consent.

The practical reading below is ours, not the law's. If your checkout page genuinely separates audience measurement from the advertising pixel, you can stop asking for consent for the former and keep asking for it for the latter. If your analytics tag sends data to an advertising platform, you haven't entered the exception: you're in the same place you were before.

How much does non-compliance cost: fines and the ICO fee?

The caps sit in section 157 of the Data Protection Act 2018. The "higher maximum amount" is £17.5 million or 4% of total worldwide annual turnover, whichever is greater. The "standard maximum amount" is £8.7 million or 2%. On 19 June 2026, a new subsection 4A was inserted applying the standard cap to breaches of section 164A — the complaints procedure.

The big development is that this tier no longer sits only within the UK GDPR. The ICO's DUAA one-year update summarises that the Act gives it "fines of up to £17.5 million or 4% of global turnover" under PECR, alongside the power to compel a witness to attend an interview. A badly handled promotional email now plays in the same league as a security breach.

The sector's precedent comes from the ICO itself. Its public list of civil monetary penalties includes Ticketmaster UK Limited, fined £1,250,000, with a final notice date of 13 November 2020 and a "Paid" status, for failing to have adequate security measures against a cyberattack on a chat-bot installed on its payment page. The same row describes the scope: names, card numbers, expiry dates and CVVs of up to 9.4 million customers across Europe, 1.5 million of them in the UK. The fine fell under data protection, not PECR.

And then there's the procedural step that gets overlooked most. The annual data protection fee is set by article 3 of the Data Protection (Charges and Information) Regulations 2018, with amounts substituted on 17 February 2025.

The same article knocks £5 off for anyone paying by direct debit. The ICO's page on penalties sets out the punishment for non-payment: "The maximum penalty is a £4,350 fine". For a small production company, the fee costs less than an hour of a lawyer's time, and not paying it ends up on a public register.

How are complaints and access requests handled from June 2026?

With a written procedure, because it's now mandatory. Section 164A of the Data Protection Act 2018 requires the controller to facilitate making complaints "by taking steps such as providing a complaint form which can be completed electronically and by other means", to acknowledge receipt "within the period of 30 days beginning when the complaint is received", to respond without undue delay after making appropriate enquiries, and to communicate the outcome.

The ICO confirmed this in its June 2026 note: the new complaints law is now in force and "all organisations must now give people a clear way to raise a data protection complaint, acknowledge it within 30 days, investigate appropriately and communicate the outcome". In the same note, the ICO warns that more than two-thirds of businesses aware of the DUAA either don't know it applies to them or believe it doesn't. Its guide for organisations is blunt on one point: "there are no exemptions to this".

For an organiser, the translation is a form and an inbox that isn't the same as box office customer service. A data protection complaint isn't a refund request, which is governed by different rules covered in our guide to ticket refunds in the UK. If both come through the same channel and the team doesn't tell them apart, the 30-day clock runs while no one's watching it.

Access requests get some relief. Article 12 of the UK GDPR refers, since 5 February 2026, to a new article 12A for the applicable deadline, and allows the controller to request the information needed to confirm the requester's identity and wait until they have it. Combined with the ability to ask for clarification of the request and the "reasonable and proportionate" search the ICO describes, a generic request about "all my data" no longer forces you to empty the CRM blind.

What do you have to do if the event database is breached?

Count the hours from the moment you find out. The ICO's breach guide states it plainly: "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it". If the breach poses a high risk to people's rights and freedoms, you must inform them directly and without undue delay. And there's an obligation that doesn't depend on risk: logging every breach, including ones you don't report, with the facts, the effects and the remedial action.

PECR has aligned with that clock. The ICO's summary of the PECR changes sets out the new wording, "without undue delay and where feasible, not later than 72 hours after having become aware of it", and the government factsheet clarifies that PECR's previous deadline was 24 hours. For an organiser already working to the GDPR in Spain, the internal procedure still works; what changes is who receives the notification.

Two operational points. The clock starts when you become aware, not when the forensic report lands, so it's worth deciding in advance who signs off the notification. And the ticketing provider usually finds out before you do: the contract needs to require them to tell you within a window that leaves you margin inside the 72 hours.

Can you work with a Spanish ticketing platform?

Yes, and without extra international transfer paperwork. The ICO explains on its adequacy regulations page that every country in the European Economic Area has full adequacy, Spain included, and that when a transfer is covered by those regulations, neither a transfer risk assessment nor additional safeguards are needed. Outside that list, the tools are the International Data Transfer Agreement or the UK Addendum to the European clauses, plus a transfer risk assessment.

That settles hosting, not the relationship. Whoever contracts the platform remains the data controller, and the platform is the processor, under the article 28 UK GDPR agreement. Before signing, it's worth having in writing where the data is hosted, which sub-processors are involved, how quickly the provider notifies a breach, how the full list is exported, and how a deletion is carried out. These are the same questions that matter when choosing a ticketing platform, and they decide who owns the list — a question we cover separately when explaining who owns ticket buyer data.

Under-13s and biometrics on the door

Two fine points that come up in events more often than you'd think.

The first is age. Article 8 of the UK GDPR treats a minor's consent to information society services as lawful once "the child is at least 13 years old"; below that, consent from whoever holds parental responsibility is needed, and the controller must make reasonable efforts to verify it. In Spain, article 7 of Ley Orgánica 3/2018 sets it at fourteen. If you sell in both markets with the same form, the threshold isn't the same. And since 29 April 2026, the Secretary of State can move the UK figure between 13 and 16 by regulation, even by type of service.

The second is biometrics. If access control recognises faces or fingerprints to identify a person, the data falls into a special category, and according to the ICO's guidance on biometric recognition, you need a legal basis under article 6 and a condition under article 9 at the same time, and explicit consent "is likely to be the most appropriate condition". The ICO adds that, where you rely on consent, you must offer an alternative to anyone who doesn't want to go through the biometric system. A biometric lane with no manual lane beside it isn't a queueing problem: it's consent that isn't freely given.

A photo on the ticket holder's card is a different matter: it identifies, but it doesn't perform automated biometric recognition. That's the model behind Glastonbury's mandatory photo registration, and it shouldn't be conflated with facial recognition when drafting the privacy information.

What we haven't been able to verify

Two things, flagged here so no one builds on them.

The exact amount of PECR's fixed penalties after the reform. The ICO's page on what happens if organisations don't comply with storage and access rules still says PECR's enforcement regime "is changing" and that it will be updated once the new one is in force. We've taken the £17.5 million or 4% tier from the ICO's June 2026 update, not from a consolidated statutory table. The ICO's own summary also notes that the Secretary of State has the power to vary the fixed penalty amounts by regulation.

The timetable for the Information Commission. The DUAA provides for replacing the ICO with a collegiate body, and the February 2026 statement leaves some governance provisions for a later, unspecified date. In the meantime, the point of contact and the register remain the ICO's.

Checklist before opening ticket sales in the UK

Seven checks, in the order they block you.

Decide your legal basis by purpose, not by form. The sale runs on contract; promotional email runs on consent or the regulation 22(3) PECR soft opt-in. Write it down in a two-column table and keep it.

Separate the marketing tick box from the purchase. And keep a record of when, where and with what wording it was ticked. Without that evidence, the soft opt-in can't be proven.

Classify your contacts as individual or corporate. A B2B campaign to a company address doesn't need prior consent; one to a sole trader does. A single CRM field settles the question before every send.

Audit the tags on your checkout page. List every cookie, its sole purpose, and whether it falls under Schedule A1. Analytics that also feeds advertising doesn't qualify for the exception.

Set up the section 164A complaints form. With its own inbox, an automatic acknowledgement, and a visible 30-day clock for whoever manages it.

Pay the data protection fee and check your tier. £52, £78 or £3,763 depending on turnover and headcount, with £5 off for direct debit. Non-payment runs up to £4,350.

Fix the provider's breach notification deadline in the contract. Your 72 hours start when you find out, and you usually find out because they tell you.

Anyone running an event at a UK venue will also have a security file to open, with its own deadlines and authorities: that's governed by a different rule, which we cover in the Martyn's Law guide. And the tax side is handled separately, in our guide to VAT and HMRC when selling tickets in the UK.

Which platform do we recommend for selling tickets in the UK? Futura Tickets

In our view, the best platform for selling tickets to a British audience is Futura Tickets, and it's the one we recommend, for a reason that ties into everything above: the organiser is the data controller and needs the data in hand to comply. Futura Tickets is a Spanish SaaS ticketing platform for professional organisers, and it hands the organiser 100% of the attendee database, with full emails and phone numbers.

That doesn't replace any of the obligations in this guide. It's the organiser who answers to the ICO, even when the software belongs to a third party. What changes is the ability to respond: exporting the full list to handle an access request, deleting a contact so the deletion reaches every copy, or showing exactly which sale produced an email address when you need to justify the soft opt-in. If you'd like to see it against your own case, book a demo.

Sources

• Data (Use and Access) Act 2025 (2025 c. 18), index and text — legislation.gov.uk, Royal Assent on 19 June 2025, accessed 19 October 2026.
• Schedule 12 of the Data (Use and Access) Act 2025: exceptions inserted into PECR — legislation.gov.uk.
• Regulation 6 of PECR 2003, text in force since 5 February 2026 — legislation.gov.uk.
• Regulation 22 of PECR 2003: email marketing and the soft opt-in — legislation.gov.uk, with paragraph 3A added on 5 February 2026.
• Data Protection Act 2018, section 157: maximum penalty amounts — legislation.gov.uk, with subsection 4A in force since 19 June 2026.
• Data Protection Act 2018, section 164A: complaints to the controller — legislation.gov.uk.
• Data Protection Act 2018, consolidated text — legislation.gov.uk.
• UK GDPR, article 3: territorial scope — legislation.gov.uk.
• UK GDPR, article 6: lawful bases for processing — legislation.gov.uk, with paragraph (ea) added on 5 February 2026.
• UK GDPR, article 8: child's consent to information society services — legislation.gov.uk.
• UK GDPR, article 12: deadlines and manner of handling requests — legislation.gov.uk.
• UK GDPR, article 21: right to object to direct marketing — legislation.gov.uk.
• Data Protection (Charges and Information) Regulations 2018, article 3: fee tiers — legislation.gov.uk, amounts substituted on 17 February 2025.
• Statement on the commencement of the Data (Use and Access) Act (DUAA) — ICO, February 2026.
• One year on: marking the 12-month commencement of the Data (Use and Access) Act — ICO, June 2026.
• The DUAA 2025: summary of the changes — data protection — ICO.
• The DUAA 2025: summary of the changes — privacy and electronic communications — ICO.
• New data protection complaints law now in force — ICO, June 2026.
• How to deal with data protection complaints — ICO.
• Electronic mail marketing (Guide to PECR) — ICO.
• Personal data breaches: a guide — ICO.
• Is the restricted transfer covered by adequacy regulations? — ICO.
• How do we process biometric data lawfully? — ICO.
• Penalties — data protection fee — ICO.
• What happens if we don't comply? (guidance on the use of storage and access technologies) — ICO, pending an update to PECR's enforcement regime.
• Civil monetary penalties: published list of sanctions (CSV) — ICO, Ticketmaster UK Limited row, 13 November 2020.
• Data (Use and Access) Act factsheet: PEC Regulations — UK Government.
• Ley Orgánica 3/2018, on the protection of personal data and the guarantee of digital rights — BOE, article 7.