GDPR and digital sign-in: what you need to know
A GDPR-compliant digital sign-in must limit the retention period of personal data to what is strictly necessary, in particular for guests, and rely on a clearly identified host whose safeguards are known. This guide explains the concrete obligations that apply to the management of a group’s attendance, BNI or not.
Why sign-in is covered by the GDPR
As soon as an attendance sheet, paper or digital, contains a name, a signature, or an email address, it constitutes processing of personal data within the meaning of the GDPR. This applies to the members of a group, but also to guests, who are often more numerous and less supervised in terms of consent.
The GDPR does not forbid this processing, it frames how the data is collected, kept, and deleted.
The GDPR principles that apply directly
Data minimization
Only the data needed to manage attendance should be collected: name, signature, and possibly email to send the report. There is no need to collect a postal address or a phone number if it serves no purpose in the process.
Storage limitation
Members’ data, which is part of the lasting organization of the group, can be kept for the duration of membership. Guests’ data, on the other hand, is not meant to stay in the system indefinitely once the meeting has passed.
Security of processing
Access to attendance sheets, whether paper in a binder or digital in software, must be limited to the people who really need it, typically the secretary and the group administrators.
Automatic purge of guest data
A good practice, beyond the legal minimum, is to automatically delete guests’ personal data shortly after the meeting, 24 hours is generally enough to cover the needs of the report and immediate follow-up.
This short delay greatly limits the risk in case of a security breach, since guest data never accumulates over months or years. Only an anonymized history, with no identifiable personal data, is kept for statistical purposes.
Hosting the data
The GDPR does not formally require data to stay in Europe, but hosting outside the European Union makes it much harder to demonstrate compliance, in particular since the invalidation of the Privacy Shield between Europe and the United States.
For a BNI chapter or an association, what matters most is knowing which host actually stores the data, where its servers are, and what safeguards apply to any transfer outside the European Union (standard contractual clauses, for example). At Liwa, the data is hosted by Supabase.
What to check before choosing a sign-in tool
- Which host stores the data, in which country, and what safeguards apply to any transfer outside the European Union.
- How long guest data is kept after the meeting.
- Who has access to the data within the organization that publishes the software.
- How authentication works for administrator accounts, the ideal being two-factor authentication for sensitive access.
- What happens on cancellation: the data must be exportable and then deleted, not kept indefinitely by the publisher.
The special case of electronic signatures
A touch signature captured on a tablet is personal data in its own right, sometimes considered biometric data depending on how it is processed. The good practice is to store it as an image linked to the attendance, without extracting unique biometric characteristics from it, which avoids falling into a category of sensitive data requiring reinforced safeguards.
Who is responsible in case of a breach
Under the GDPR, the group or association that organizes the meetings is considered the data controller, the one who decides why and how the data is collected. The publisher of the sign-in software acts as a processor, in charge of ensuring the technical security of the processing according to the controller’s instructions.
In practice, this means a group remains responsible for the purpose of the collection, knowing why it asks for a signature and possibly an email, even if it delegates the technical side to a third-party tool. Checking the GDPR commitments of the chosen tool is therefore part of the group’s responsibilities, not only the publisher’s.
The questions to ask in case of an inspection
A group wanting to check its own compliance can ask itself a few simple questions: can it explain why each piece of data collected is necessary, does it know how long guest data stays stored, and can it show that access to attendance sheets is limited to the people who need it. These three answers cover most of what a GDPR inspection would look for in a sign-in process.
In short
A GDPR-compliant digital sign-in rests on three concrete pillars: collect only the necessary data, purge guests’ data quickly, and choose transparent hosting. These principles apply to any type of organization that manages attendance in meetings, not only BNI chapters.
Liwa Team