GDPR for Touring Companies and Venues

1. Data and insight sharing

Many touring companies and venues want to use the Impact & Insight Toolkit to understand the impact their work is having on audiences, and so we’ve prepared this guidance note to help you ensure that you operate legally and ethically, whilst also gaining maximum benefit from the insight you gather together.

Counting What Counts (CWC) has worked closely with Katy Raines from Indigo-Ltd in preparing these guidance notes, following a touring pilot project she ran with three opera companies and seven venues. It should be noted that neither CWC, nor Katy, are lawyers specialising in data protection. Therefore, these notes should be taken as advisory guidance to organisations, to be used alongside their own approach to data protection.

2. How is data used in the process of undertaking a Toolkit evaluation?

The process of undertaking evaluations typically happens as follows:

  • Customers give their personal details to the venue when booking a ticket for the touring company’s production.
  • This data (or some of this data) is used to email the attenders after the event has taken place, asking them to complete an evaluation.
  • The data gathered from those responses is then used alongside other data collected from peer reviewers and self assessors to form the full evaluation of the work for the benefit of both parties.

3. Types of data processed

Personal data – names, addresses and contact details of named individuals.

Insight data – responses to evaluations which, in most cases, does not include any personal data.

4. What are the privacy considerations of this process?

4.1 – At the point the data is captured, the venue operates under its own data protection guidelines for processing this data as outlined in the venue’s privacy policy. This privacy policy should include details of which forms of data are collected, what the potential uses of that data are (which should include mention of customer surveys), and under which legal basis. An example of this is shown in Appendix A.

In some cases, and where technology allows, some touring companies have an agreement with the venue that for their productions, customers will be asked an additional question as to whether their personal contact data can be shared with the visiting company in order to keep them informed of their activities.

In this case, the following should exist:

  • a clear consent-based option at the point of data capture for the customer to agree to their data being passed to the visiting company
  • inclusion of this practice in the venue’s privacy policy
  • a data sharing agreement between the venue and the company, outlining how this process will take place, how and when the data will be passed across from venue to company, and what the visiting company will do on receipt of the data.

NB. The sharing of this personal data, however, is NOT the same as sharing evaluation data (see point 4.4).

4.2 – How customers are selected for inclusion in an email to promote the survey should be determined by what is in the venue’s privacy policy. For example, if the venue uses a ‘legitimate interest’ as its basis for contacting any booker to ask for feedback via a survey, then, as long as the venue is content that it has undertaken the appropriate privacy assessments and included this use clearly in their privacy statement (as in example Appendix A), all bookers could likely be emailed with the survey. If, however, the venue operates a ‘consent’ model for who it sends surveys to, then only customers who have given the relevant consent may be emailed.

NB. Selection of the customers should not be contingent on the customer opting in to receive information about the visiting company as noted in 4.1.

4.3 – An email is sent to the selected bookers, inviting them to participate in an evaluation of the event. Best practice would suggest that this email should include the following:

  • Specific reference to the event they came to see, with the name of the touring company mentioned specifically.
  • An invitation to complete the survey, stressing that whilst participation is voluntary, the importance of receiving their feedback to the venue and touring company.
  • Reassurance that all responses are anonymous, and that the findings are only used by the venue, company and Arts Council England to understand how their work is being received by audiences, and to inform future planning.

4.4 – Insight data is gathered in the Culture Counts platform. If it contains no personal data (e.g. 6-digit postcode, name, address) then it is not personal data, and the resulting analysis can therefore be shared without reference to GDPR. If the insight data does include such personal data, then the following considerations need to be made:

  • The data sharing agreement between venue and touring company should make provision for such data being seen by the touring company but specifying that such data cannot be used by either party for anything other than further analysis on the data. It cannot, for example, be added to a database or used to contact the customer in any way.
  • The privacy policy of both venue and company should include data being shared by the venue, or received by the company (using a legitimate interest) in order to understand audience reaction to the work to inform future programming etc.

5. Best practice

The purpose of collecting and sharing survey data for touring companies and venues should be discussed at contractual stage, and clearly understood by both parties.

There are huge benefits in the venue and visiting company ‘aligning’ their objectives for a piece of work or tour, so that both parties can ensure they get the greatest value out of the survey.

Being clear about this from the outset and ensuring this is encapsulated in the data sharing agreement, should have maximum benefits for both parties.

Checklist for venues

  • Privacy policy outlines uses of data collected at point of sale, to include customer surveys.
  • Point of sale notification regarding data collection is clear regarding potential uses of data (including surveys).
  • Privacy policy includes sharing survey findings with artistic partners and funders.
  • Data sharing agreement setting out how personal and insight data will be shared between venue and touring company.

Checklist for touring companies

  • Privacy policy includes personal and insight data received from venues and how it will be processed; include retention policy (i.e. how long data will be kept).
  • Data sharing agreement setting out how personal and insight data will be shared between venue and touring company.

Appendix A: Extracts from example venue privacy policy to outline uses of data

Data collection

We may collect personal data from you when you buy a ticket, join or renew a membership, ask us to send you information, complete a survey, make a donation, pledge a legacy, attend an event, visit our premises, volunteer or participate in a project or group, supply goods/services to us, pay us for goods/services or apply for a job.

How we will use your data

We will use your information for the purposes listed below under one of the following legal bases:

  • Performance of a contract between us and you.
  • Your consent (where we require it).
  • To comply with a legal obligation or
  • Our Legitimate interest, or that of a third party.

The ways in which we use your data are listed below:


To invite you to give feedback on our programmes and services via customer surveys in order to improve our offer and feedback to our funders.

Legitimate interest

Sharing data with third parties

The personal information that you give us will never be supplied to anyone outside [Organisation A] for contact purposes without first obtaining your consent, unless we are obliged or permitted by law to disclose it, we need to use the services of ‘data processors’ to fulfil your requirements, to support analysis and research for [Organisation A] or the Arts Sector, or for reporting to our funders.


The ways in which we share data with third party organisations are listed below:


When you book for one of our artistic partners you may be asked if you would like us to pass your data across to them so that they can keep you informed of their activities. They will inform you once they have your data, along with details of their own privacy policy.Consent
With agreement about data management protocols, we may make anonymised data available to our artistic partners and other bodies such as The Audience Agency and the Impact & Insight Toolkit for analysis and research purposes. This assists with reporting to funders and strategic planning, helping us to make better business decisions.Legitimate interest

Powered by BetterDocs