GDPR checklist for award organisers

Points 1–5: foundations and access

1. Determine roles service by service. The organiser is normally the controller. A software vendor is a processor only where it acts on documented instructions; other providers may be independent controllers. Every processing arrangement needs an Art. 28 agreement.
2. Define a legal basis per data flow. Not every processing operation needs consent: the entry itself rests on contract, marketing on consent. Document which flow rests on which basis.
3. Evidence contracts and consent. Record acceptance of the terms as contract formation. For purposes that genuinely require consent, be able to prove who agreed to which wording and when.
4. Check locations and transfers. EU hosting reduces transfer risk. Third-country services need a valid adequacy decision or appropriate safeguards and any required assessment, including ancillary and AI services.
5. Restrict jury access. Jurors should see only the entries assigned to them. Emailing spreadsheet copies to the whole jury is the opposite of data minimisation.

Why this matters specifically for awards

A prize competition processes an unusually sensitive combination: company data, personal contact details, third-party assessments and often photo and video material from the ceremony. If the process runs on email attachments and cloud folders, you can prove neither who had access nor when something was deleted.

What the PDF adds

• All ten points with commentary
• Which documents to have ready before you launch
• Typical gaps in a form-plus-cloud-plus-spreadsheet tool mix
• The minimum content of an Art. 28 processing agreement

Orientation for award organisers — not legal advice.

More dossiers