1. When QR Codes Involve Personal Data
A QR code itself (the image) contains no personal data. Personal data enters the picture when:
- The scan event is logged with a device IP address (creating a pseudonymous record).
- The landing page collects personal information (name, email, location).
- The QR is personalised per individual (encoded with a customer ID).
Each of these scenarios triggers GDPR/UK GDPR obligations.
2. Lawful Basis for Scan Logging
Dynamic QR services that log scan events (IP address, user agent, location, timestamp) process personal data. The lawful basis is typically
legitimate interests — analytics for campaign optimisation. You must conduct a Legitimate Interest Assessment (LIA) and document it. IP addresses must not be stored longer than necessary for the analytical purpose (typically 30–90 days in aggregate form).
3. Data Minimisation in Form Captures
Forms linked from QRs should only collect what is needed for the stated purpose. Common violations:
- Collecting phone number when only email is needed.
- Collecting full DOB when only age verification (over 18 Y/N) is needed.
- Collecting location when a region is sufficient.
Apply data minimisation to every field in every QR-linked form before launch.
4. Privacy Notice on Landing Pages
Every QR landing page that collects personal data must display a clear, accessible privacy notice: who you are, what data you are collecting, why, how long you keep it, and how to exercise rights. This applies equally to a simple email capture form and a complex account registration flow.
5. Privacy by Design Checklist for QR Campaigns
- [ ] Is a redirect URL used? Does the redirect service's data processing agreement cover GDPR requirements?
- [ ] Are scan logs anonymised after the retention period?
- [ ] Does the landing page form collect only minimum necessary data?
- [ ] Is there a privacy notice on the landing page?
- [ ] For personalised QRs (encoded customer ID), is the processing covered by the existing privacy notice?
- [ ] Are campaign analytics aggregated before retention (not storing individual scan records long-term)?
Putting this into practice
Start with the smallest real test you can run. Generate the code, print it at the exact size you plan to use, and scan it with two different phones in the lighting where it will live. Check that the destination page loads quickly on a mobile connection and that the call to action next to the code tells people what they will get. If anything feels slow or unclear, fix it before you print a full batch, because reprints cost more than a short test. Keep a note of the size, material, and placement that worked so the next batch starts from a proven setup.
Common mistakes to avoid
The most common mistakes are easy to avoid once you know them. Long payloads make modules tiny, low contrast makes edges hard to read, and text placed too close to the border eats the quiet zone the scanner needs. Covering a corner finder pattern with a logo or a sticker breaks detection entirely, and a code placed behind glare or on a curved surface fails even when the print is perfect. Review each of these points on a proof copy, and treat any failure as a reason to adjust the design rather than a reason to blame the scanner.
Quick checklist
- Keep the payload as short as practical so modules stay large.
- Keep dark modules on a light background with strong contrast.
- Leave a clear quiet zone on all four sides of the symbol.
- Test the printed code at the real viewing distance and lighting.
- Confirm the destination page loads fast on a phone.
- Recheck the code after any change to the link, design, or placement.
Related tools and guides
- Run unfamiliar destinations through the [QR safety checker](/qr-safety-checker) before you share a code widely.
- Test every code with the [QR scanner](/qr-scanner) on more than one phone before you publish or print it.
- The [templates](/templates) collection offers ready-made layouts for common QR use cases.
- Use the [QR size calculator](/qr-size-calculator) to match the printed size to the expected scan distance before you commit to a print run.
- The [error correction simulator](/error-correction-simulator) shows how damage tolerance changes the density of the symbol at each level.
- Create a fresh code with the [URL QR code generator](/url-qr-code-generator) when the destination is a web page.
