GDPR: event registration form and email communications
<p>I need to set up a registration form for an event in which the main communication channel between the registered users and the organizers is the e-mail. E-mails could be sent before, during and after the event with informative purposes about such event (i.e. no marketing).</p>

<p>Basically the registration is not possible if the user doesn't want to receive e-mails. For instance, just after the sign up the user would receive a confirmation e-mail.</p>

<p>What should be the canonical way to grant the permission to send e-mails to the user according to GDPR in this case?</p>

<p>If I understood it well, putting a notice like <em>Signing up this event you also consent to receive informative emails from us about the event</em> would not satisfy the regulation about active consent.</p>

<p>Should it be better to give the user the option to agree to receive e-mails, e.g. through option-buttons (e.g. <em>Do you agree to receive e-mails from us to keep you informed about the event — ○ Yes / ○ No</em>) and then refuse to register the user displaying an error message like <em>Sorry, we cannot handle your registration if you don't allow us to send e-mails to you</em>?</p>

<blockquote>
  <p>Basically the registration is not possible if the user doesn't want to receive e-mails. For instance, just after the sign up the user would receive a confirmation e-mail.</p>
</blockquote>

<p>In this case <a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6(1)(b)</a> applies, the data processing is necessary for the performance of a contract. So you do not need separate permission. You cannot use the e-mail address for other incompatible reasons though.</p>

<p>I have the impression you talk about an online event. But if it would be a real-live event where people meet, I can imagine other reasons to use the email address. For example if some people get ill after the event, you might need to warn all attendees to immediately visit a doctor if they also have certain symptoms. Art. 6(1)(d) would apply in that case. If that is a legal obligation, Art. 6(1)(c) would apply too. In all those cases you don't need consent, however, you do need to <a href="https://gdpr-info.eu/art-13-gdpr/" rel="nofollow noreferrer">inform</a> users.</p>

<blockquote>
  <p>If I understood it well, putting a notice like Signing up this event you also consent to receive informative emails from us about the event would not satisfy the regulation about active consent.</p>
</blockquote>

<p>This will not be valid consent as specified by the GDPR, <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">Article 7(2)</a> specifies that a request for consent must be separate from other matters.</p>

<blockquote>
  <p>Sorry, we cannot handle your registration if you don't allow us to send e-mails to you?</p>
</blockquote>

<p>This is not allowed. If you ask for consent, it must be freely given. See <a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">Article 7(4)</a>. </p>

<p>You already said you will not send marketing mail, but if you would use e-mail for marketing reasons, special conditions apply, including the possibility to unsubscribe in every email.</p>

<p>If you would force users to receive marketing email, because you finance your event that way, your business model would be incompatible with the GDPR. Because there is no (technical) reason to receive such a mail, consent is required, and it must be possible to withdraw at any time (<a href="https://gdpr-info.eu/art-7-gdpr/" rel="nofollow noreferrer">Article 7(3)</a>).</p>

gdpr email online