Is QR ordering GDPR-compliant? A UK venue checklist
Is QR table ordering GDPR-compliant?
QR table ordering can be run in a way that complies with UK data protection law, but compliance depends on how the venue uses it, not just on the software. The law that applies is the UK GDPR, read together with the Data Protection Act 2018. Cookies and similar technologies on websites are covered separately by the Privacy and Electronic Communications Regulations 2003 (PECR).
The good news for a pub or bar is that QR ordering, done properly, collects very little personal data. With DrinksQR, customers do not create accounts or log in. An order holds the table, the items, any notes the customer types and an optional first name so staff can call it out. That is a short list, and a short list is much easier to look after.
This page is general guidance for UK venues, not legal advice. If you have a specific question about your obligations, check the ICO's guidance or speak to a qualified adviser.
Who is the controller and who is the processor?
The venue is the controller and DrinksQR is the processor. The controller decides why and how personal data is used: you choose to take orders by QR, you decide what to do with them, and the customer is your customer. The processor handles the data on your behalf and on your instructions, which is what the ordering system does when it carries an order from the table to your bar screen.
That split matters because it decides who answers for what:
- The venue (controller) is responsible for having a lawful basis, telling customers what happens to their data, responding to their requests and deciding how long records are kept.
- DrinksQR (processor) processes order data only to provide the service, keeps it secure and supports you in meeting your obligations.
Under Article 28 of the UK GDPR, a controller must have a written contract with any processor, usually called a data processing agreement (DPA). It sets out what data is processed, for what purpose, the security measures and what happens at the end of the contract. Make sure one is in place before you go live. If you have questions about the terms, ask us through the contact page.
What personal data does QR ordering actually collect?
Very little, and that is deliberate. Data minimisation, one of the core UK GDPR principles, means collecting only what you need for the purpose. For taking a drinks order at a table, that means:
| Data | Why it is needed | Required? |
|---|---|---|
| Table | So staff know where to take the order | Yes (comes from the QR code) |
| Items, sizes and options | To make and price the order | Yes |
| Notes | Requests such as "no ice" or "bring two straws" | Optional |
| First name | So staff can find the right person at a busy table | Optional |
No email address, phone number, password or account is needed to order. Payment is taken at the table on your card machine, so card details are not entered into the ordering page.
One thing to watch is the notes field. If a customer types something like "nut allergy", that could count as information about their health, which the UK GDPR treats as special category data. Train staff to act on it for that order and not to copy it anywhere else. Allergen information itself belongs on the menu, and our allergens guide explains how to set that up.
What lawful basis applies to a table order?
For most venues the natural basis is that processing is necessary for a contract: the customer asks you to supply drinks and you need the order details to do it. The optional first name is given by the customer to make service easier, and it is still part of fulfilling their order. You do not normally need separate consent to take an order.
Consent does become relevant if you want to do something extra, such as sending marketing. DrinksQR does not collect contact details, so any marketing list you run would be separate and would need its own lawful basis and, for electronic marketing, compliance with PECR.
How long should order data be kept?
Only as long as you need it. The UK GDPR does not set a fixed period, so the controller decides and should be able to justify the choice. For a table order, ask yourself what the record is used for after the drinks have been served:
- Checking a disputed order or a refund later that week
- Reconciling sales against the card machine and till
- Understanding what sells, which can usually be done with figures that do not identify anyone
Write the period down in your records and your privacy notice. Names and free-text notes are the parts that identify people, so they are the parts to keep for the shortest time.
What do customers need to be told?
Customers have a right to be informed, so your privacy notice should cover QR ordering. You do not need a long new document. A few lines in your existing notice will usually do, covering:
- That orders placed by QR code record the table, the items, any notes and an optional first name
- Why you use the data (to take and serve the order) and the lawful basis
- That a service provider processes the order on your behalf
- How long you keep order records
- How to contact you to use their rights
Make the notice easy to find, for example through a link on your website and a short line on the table card or the menu. Our guide to printing table QR codes covers what to put on the card.
What rights do customers have over their order data?
Customers have the usual UK GDPR rights: access, rectification, erasure, restriction, objection and, in some cases, data portability. In practice, requests about a drinks order are rare, but you should know what to do if one arrives:
- Log the request and the date. You normally have one month to respond.
- Confirm who is asking. With only a first name and a table, you may need to ask for the date, time and items to find the right order.
- Find the record and decide whether the request applies.
- If you need help retrieving or deleting data held in the system, ask DrinksQR as your processor.
- Reply in plain language and keep a note of what you did.
Does my venue need to register with the ICO?
Most organisations that process personal data need to pay the data protection fee to the Information Commissioner's Office (ICO), under the Data Protection (Charges and Information) Regulations 2018, unless an exemption applies. Many pubs, bars and restaurants already process personal data through staff records, bookings or CCTV, so they may already be paying it. Rather than guess, check the ICO's self-assessment tool on its website, which tells you whether you need to pay and which tier applies.
What about cookies and analytics?
Under PECR, non-essential cookies, such as most analytics and advertising cookies, generally need the user's consent before they are set. Strictly necessary cookies, such as those that keep an order working, do not. The ICO's guidance explains where the line falls, and it is worth checking the current version because the rules have been updated.
On the DrinksQR website, analytics only load after consent, using Google Consent Mode v2, and rejecting is as easy as accepting. If your own venue website uses analytics or marketing pixels, the same standard applies to you: a clear banner, no pre-ticked boxes and a reject option as prominent as accept.
UK venue GDPR checklist for QR ordering
| Check | What good looks like |
|---|---|
| Roles understood | Venue is controller, DrinksQR is processor |
| Data processing agreement | Signed or accepted before go-live |
| Data minimised | No accounts; first name optional; notes used only for the order |
| Lawful basis recorded | Contract for taking orders, written in your records |
| Retention set | A defined period, shortest for names and notes |
| Privacy notice updated | QR ordering mentioned and signposted from table cards or website |
| Rights process | Staff know who handles requests and the one-month deadline |
| ICO fee checked | Self-assessment done, fee paid if required |
| Cookie consent | Analytics only after consent; reject as easy as accept |
| Staff briefed | Allergy notes acted on, not copied or shared |
For a wider look at how orders move from table to bar, see how QR ordering works, and the features page for the full list of what the system does.
Key facts
- UK GDPR and the Data Protection Act 2018 cover order data; PECR covers cookies.
- The venue is the controller; DrinksQR is the processor.
- Article 28 UK GDPR requires a written data processing agreement.
- A DrinksQR order holds the table, items, notes and an optional first name. No accounts.
- Customers normally get a response to rights requests within one month.
- Most organisations processing personal data pay the ICO fee: check the ICO's self-assessment.
- General guidance only, not legal advice.
Questions
Is QR ordering legal under UK GDPR?
Yes, QR ordering can be used lawfully under the UK GDPR and the Data Protection Act 2018, provided the venue has a lawful basis, tells customers what happens to their data, keeps it secure and does not keep it longer than needed. This is general guidance, not legal advice.
Do customers have to create an account to order?
No. With DrinksQR customers scan the table code with their phone camera and order without an app, account or password. The order records the table, items, any notes and an optional first name.
Who is the data controller for QR orders?
The venue is the controller and DrinksQR is the processor. The venue decides how order data is used and answers to customers; DrinksQR processes it on the venue's instructions under a data processing agreement.
Do I need a data processing agreement with my QR ordering provider?
Yes. Article 28 of the UK GDPR requires a written contract between a controller and its processor. Make sure one is in place before you start taking orders.
Do I need to pay the ICO data protection fee?
Probably, but check. Most organisations that process personal data must pay the fee unless an exemption applies. The ICO's online self-assessment tells you whether you need to pay and how much.
Does a QR ordering menu need a cookie banner?
Only if it sets non-essential cookies such as analytics. Under PECR, strictly necessary cookies do not need consent, but analytics and advertising cookies generally do. The DrinksQR website only loads analytics after consent.