vCard QR code compliance guide: GDPR, healthcare, finance, and legal controls

Short answer

A vCard QR code can be compliant, but only if you treat contact sharing as data processing and implement clear legal basis, purpose limits, access controls, retention rules, and audit trails.

How it works

When someone scans a contact card QR code, two data flows are involved:

1. Profile data in the card itself (name, role, email, phone, company)
2. Interaction data from the scan (time, device, rough location, referrer)

Compliance depends on collecting only what you need, documenting why you need it, and giving users the controls required by applicable law.

Core compliance checklist

Use this baseline across industries:

1. Define legal basis per use case (contract, legitimate interest, or consent)
2. Publish a clear privacy notice for contact-card and scan analytics processing
3. Minimize fields to business-necessary data only
4. Set retention windows for both card data and scan logs
5. Implement role-based access for who can export or view scan-level data
6. Log access and changes for auditability
7. Add DSAR handling (access, correction, deletion, export)
8. Control cross-border transfers with approved mechanisms

Industry-specific controls

Healthcare

• Keep contact-card tooling separated from systems containing PHI
• Do not include patient-specific details in contact-card fields
• Use stricter admin permissions and audit logs for exports

Financial services

• Enforce message and record-retention policies in line with firm obligations
• Restrict broad data exports and require approval for external sharing
• Keep an evidence trail for compliance review and supervision

Legal

• Avoid exposing client identifiers in profile fields
• Apply strict least-privilege access to contact and interaction history
• Maintain defensible records for confidentiality and conflict procedures

Limits and caveats

• A compliant setup in one jurisdiction is not automatically compliant globally.
• Consent is not always the correct legal basis; use it only where required.
• QR scan analytics are often pseudonymous, but still regulated personal data in many regimes.

Implementation pattern in Linkbreakers

• Use role-based workspaces to separate teams and limit access
• Store only required fields in contact cards
• Define retention and deletion procedures in internal policy
• Route legal/privacy requests to a documented DSAR workflow

Frequently asked questions

Do I always need explicit consent for a vCard QR code? No. In many cases, another legal basis may apply. The correct basis depends on purpose and jurisdiction.

Is scan metadata personal data? Often yes, especially when it can be linked to an individual directly or indirectly.

What is the minimum policy set I need? Privacy notice, retention policy, access control policy, and DSAR process.