Blog

GDPR for artist management agencies: contacts, mailers and artist data

2 November 2026 · ArtistHub team

Artist management agencies handle a lot of personal data: artists' contact details, passports for visas, bank details, health information when illness affects performances, and thousands of presenter contacts. If you operate in the EU or UK, or deal with people there, the General Data Protection Regulation (GDPR, or the UK GDPR) applies. This article is a practical overview for agencies. It is not legal advice; for specific questions, consult a data protection specialist or your national authority.

The European Commission's data protection pages explain the framework, and national authorities such as the UK's Information Commissioner's Office (ICO) publish guidance for organisations.

The core ideas

GDPR is built on principles including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security. For an agency, these translate into practical questions:

• Do we have a lawful basis for each type of data we hold?
• Do people know how we use their data?
• Do we hold only what we need?
• Is it accurate and up to date?
• Do we delete it when it is no longer needed?
• Is it secure?

Artist data

You hold artist data to perform your management agreement: contact details, materials, calendars, contracts, fees, bank details, and sometimes passport and visa details. Explain in your agreement or a privacy notice what you hold and why (agreement template).

Special care is needed for sensitive information. Health information, for example about an illness that forces a cancellation, is a special category of data under GDPR with stricter rules. Record only what is necessary and limit who can see it.

Presenter contacts

Your contacts database of casting directors, planners and administrators is personal data too. Record where each contact came from, keep it accurate, and respect objections. Business contacts are still people with rights (contacts database guide).

Mailers and marketing

Roster mailings to presenters are a form of direct marketing. In addition to GDPR, electronic marketing rules (such as the ePrivacy rules in the EU and PECR in the UK) may apply. Practical steps:

• Send relevant, professional content to people who would expect it.
• Include a clear way to unsubscribe in every message.
• Honour unsubscribes promptly.
• Keep records of consent or other lawful basis where required.

See email campaigns for managers.

Sharing with partners

Agencies regularly share artist data with presenters, local agents, travel agents and visa specialists. Share only what each needs: a presenter needs the biography and logistics, not bank details. When sharing with partner agencies, agree how data is handled (working with local agents).

International transfers

Sending personal data outside the EU or UK, for example to a presenter or agent in another country, can trigger rules on international transfers. Check the guidance from your authority and take advice for regular transfers.

Retention

Decide how long you keep each type of data. Contracts and financial records may need to be kept for tax and legal reasons; old presenter contacts and former artists' personal data may not. Write a simple retention schedule and review it yearly.

Security

• Use a system with access controls rather than shared spreadsheets.
• Give staff only the access they need, especially to financial and sensitive data.
• Protect devices with passcodes.
• Avoid sending passport scans by unencrypted email where you can.
• Have a plan for what to do if data is lost or exposed.

Data subject requests

People can ask to see the data you hold about them, correct it or, in some cases, have it deleted. Keep data organised so you can respond, and know who in the agency handles requests.

How a CRM helps

Keeping data in one system, rather than in inboxes and spreadsheets, makes compliance far easier: you know what you hold, you can control access, and you can find and update records on request. ArtistHub keeps contacts, artist records, contracts and mailers in one place.

A short GDPR checklist for agencies

1. List the personal data you hold and why.
2. Write or update your privacy notice.
3. Record sources of presenter contacts.
4. Add unsubscribe links to every mailing.
5. Restrict access to sensitive and financial data.
6. Set retention periods.
7. Know how to handle a data request or breach.

Common mistakes

• Keeping passport scans and bank details in email threads.
• Sending mailings to every contact ever collected, with no unsubscribe link.
• Sharing full artist records with presenters who need only a biography.
• Keeping former artists' personal data indefinitely without a reason.
• Giving every staff member access to everything.

Where to start if you have done nothing yet

Begin with an inventory: list where personal data lives today, such as inboxes, spreadsheets, shared drives, phones and your CRM. Then move the essentials into one controlled system, delete what you do not need, and write a short privacy notice for artists and contacts. That alone puts most small agencies in a much better position.

FAQ

Does GDPR apply to business contacts at opera houses?

Yes. Business contact details of individuals are personal data under GDPR.

Do I need consent to email presenters?

It depends on the jurisdiction and circumstances; electronic marketing rules may apply alongside GDPR. Check guidance from your national authority.