[et_pb_section fb_built=”1″ _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_row _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
80% of French<\/a> people consider data protection to be a sign of trust<\/strong> in a brand. Complying with the GDPR is therefore not just a legal requirement: it is a lever for reassurance and commitment. <\/p>\n In the context of a competition, the rules can seem unclear… especially when it comes to personal data. You can organise a campaign that is compliant, engaging and effective. <\/p>\n In this competition and GDPR guide, we outline the practices you can implement to launch a fun experience \u2013 online or in-store \u2013 while complying with GDPR requirements.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n The General Data Protection Regulation (GDPR)<\/a> came into effect on 25 May 2018. It regulates the collection, processing and storage of personal data within the European Union. Its aim is to give citizens greater control over their personal information<\/strong>. <\/p>\n The GDPR applies to companies, public bodies and associations that process data relating to European residents<\/strong>, regardless of their location.<\/p>\n Its key principles<\/strong> include transparency, data security and respect for individual rights. In the context of a competition, this means actively managing data security and collection, clearly informing participants and facilitating their access to their rights. <\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Organising a competition involves complying with certain data protection rules. The GDPR imposes obligations on what can be collected, how participants must be informed, and under what conditions their data may be used. Here are the key points to keep in mind to ensure compliance. <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n In the context of a competition, you must limit data collection to what is strictly necessary<\/strong>. The GDPR prohibits the collection of information that is not related to the competition or marketing objectives<\/a>. <\/p>\n Your surname, first name, email address, date of birth or postcode may be collected if you justify their usefulness<\/strong> (e.g. age verification, selection of winners, personalisation of offers). Sensitive or excessive data (family situation, income level, etc.) should be avoided unless there is a demonstrated interest. <\/p>\n According to the European Commission, you can process certain sensitive data, provided that you clearly inform participants<\/strong>. Transparency is essential to ensure that a competition complies with the GDPR. <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n In the context of a competition, you must obtain consent to ensure compliance with the GDPR<\/strong>. Any collection of personal data must be based on free, informed, specific and unambiguous consent. <\/p>\n Clearly inform users about the purpose of the processing<\/strong>: prize draw<\/a>, sending commercial offers, subscription to a newsletter. Provide clearly separate checkboxes (opt-in<\/a>) and allow explicit acceptance. Opt-out is prohibited. <\/p>\n Consent alone is not enough<\/strong>: you must also provide information about your identity, the recipients of the data and the rights of participants (access, rectification, opposition, deletion). Make these rights easily accessible via a link to a privacy policy on the landing page or the participation form. <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font=”–et_global_body_font|300|||||||” global_colors_info=”{}”]<\/p>\n As part of a competition, you must guarantee data security. The organiser implements measures to guarantee the confidentiality, integrity and availability of information. <\/p>\n Store data on secure servers hosted within the European Union and protect it from unauthorised access. Take precautions when processing sensitive data. In the event of a security breach that poses a risk, inform the relevant people. <\/p>\n Keep a record of processing activities<\/strong> if they are regular, large-scale or involve sensitive data. This document must include several key elements: <\/p>\n Finally, the appointment of<\/strong> a data protection officer (DPO)<\/a> is mandatory for public bodies or companies that process large volumes of sensitive data.<\/p>\n [\/et_pb_text][et_pb_image src=”https:\/\/www.socialshaker.com\/wp-content\/uploads\/2025\/07\/jeu-concours-et-rgpd.webp” alt=”competition and GDPR” title_text=”competition and GDPR” align=”center” _builder_version=”4.27.4″ _module_preset=”default” width=”85%” custom_margin=”44px||51px||false|false” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Data collected as part of a marketing game is retained for the time necessary to achieve the purpose<\/strong> for which it was collected, such as managing the game or awarding prizes.<\/p>\n A retention period of three months after the end of the game<\/strong> is reasonable. Beyond this period, the data must be anonymised or deleted, unless the participant agrees otherwise (newsletter, prospecting, etc.). This period must be specified in the privacy policy accessible from the participation form. <\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.25.0″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”]<\/p>\n Before launching a competition, ensure that each step complies with GDPR requirements<\/strong>. This requires a rigorous approach, from defining objectives to managing data. Using a platform makes the process easier by integrating all compliance elements (data security, form settings, consent collection) right from the design stage. <\/p>\n Here are the practices to adopt in order to design an effective and compliant operation<\/strong>.<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n The first step is to clarify the objective of the competition<\/strong> (acquisition, lead qualification, customer loyalty, etc.). Depending on this objective, only the necessary data should be collected. It is important to avoid excessive requests (age, telephone number, preferences). This approach ensures compliance with the principle of data minimisation by enhancing transparency and trust. <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font=”|300|||||||” global_colors_info=”{}”]<\/p>\n A GDPR-compliant competition includes a mechanism for obtaining explicit consent without compromising the user experience. It is recommended that legal notices and checkboxes be included in the registration form<\/strong>, using simple and understandable wording. <\/p>\n These boxes must be unchecked by default (opt-in)<\/strong> and allow users to distinguish between consent to participate in the game, consent to receive marketing communications, and consent to sharing.<\/p>\n The route must remain smooth and fast:<\/p>\n By making the process clear, transparent and pleasant, it is possible to maximise participation rates<\/strong> while complying with legal obligations.<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Not all companies have the resources to manage GDPR compliance in detail without a data protection officer. Using a marketing gamification<\/a> tool can improve security and efficiency<\/strong>. <\/p>\nWhat is the GDPR?<\/h2>\n
What are the GDPR rules for a competition?<\/h2>\n
1. What data can be collected through a competition?<\/h3>\n
2. GDPR: the importance of consent <\/h3>\n
3. Customer data protection<\/h3>\n
\n
4. How long are data collected through a marketing game retained?<\/h3>\n
How to organise a competition that complies with the GDPR?<\/h2>\n
1. Define the objective of the competition and the data to be collected<\/h3>\n
2. Create a suitable game route<\/h3>\n
\n
3. Use a tool that facilitates compliance with the GDPR<\/h3>\n