Publishing Winners Lists – post GDPR

If you’ve run a prize promotion before, you’ll be familiar with the fact you need to provide details of the winners of any major prizes – either by publishing them, or making them available on request. This rule ensures transparency and is driven by the CAP Code.

The details usually provided are: full name, county and prize.

Sounds like a breach of GDPR right? And in fact the legal stance on it has recently changed, so over to our legal expert Helen for the latest…

Is publishing winners lists a breach of GDPR?

In light of GDPR… The ASA and CAP have now considered the rule carefully and made some amends – which you should be applying NOW.

You’ll be pleased to hear that not a lot has changed. Publishing winners’ details is not considered a breach of GDPR. You can still publicise winners as long as you are sensitive to requests to publish less information, for example if the winner has a distinctive name and/or the prize is embarrassing or high value and they don’t want to attract attention to it.

Here’s the exact wording of the old and amended CAP Code…

The OLD CAP Code

Rule 8.28.5 of the CAP Code previously said:

“Promoters must either publish or make available on request the name and county of major prizewinners and, if applicable, their winning entries except in the limited circumstances where promoters are subject to a legal requirement never to publish such information. Promoters must obtain consent to such publicity from all competition entrants at the time of entry. Prizewinners must not be compromised by the publication of excessive personal information.”


The amended version of 8.28.5  was released in a regulatory statement on 28 March 2019. CAP has also updated its guidance.

“Promoters must either publish or make available on request information that indicates that a valid award took place – ordinarily the surname and county of major prizewinners and, if applicable, their winning entries. Promoters must inform the prizewinner of their intention to publish the information and give the prizewinner the opportunity to object to their information being published or to reduce the amount of information published about the prizewinner. In such circumstances, the promoter must nevertheless still provide the information and winning entry to the ASA if challenged. The privacy of prizewinners must not be prejudiced by the publication of personal information and in limited circumstances (for example, in relation to National Savings) promoters may need to comply with a legal requirement not to publish such information.”

CAP is now taking the view that legitimate interest under the GDPR, rather than consent, is the lawful ground for processing personal information about prize winners.

How to react to someone sensitive about being published

If a winner is unhappy with their details being shared publicly, the promoter does not have to respond to fishing expeditions from compers for example, but it must still provide the details to the ASA if challenged.

There are various reasons the winner might find the prize embarrassing and may not want their details published… For example, the prize might relate to a personal hygiene item and if they have a distinctive surname the winner would not want the association.

In such a case, the promoter may decide to provide no information, initials or first name only. However, the full details would have to be available to the ASA.


Need any help with your promotion? Call us on 01844 202045.


0 742