GDPR and QR ordering: what data arises and what the business must arrange
QR ordering produces considerably less personal data than often assumed: the guest orders without an account, without an app and without stored payment details — what is processed is essentially the order content and the table number. The business remains the controller under the GDPR and signs a data processing agreement under Art. 28 GDPR with the system provider. A privacy notice of its own that mentions QR ordering belongs to it.
What data arises with QR ordering
| Data | When it arises | Personal reference |
|---|---|---|
| Order content and table number | with every order | none in itself — a table identifies no person |
| Name or room number | only if the business asks for it, in a hotel for instance | yes — use sparingly |
| Technical access data (IP address) | when the page is opened, as with any website | yes — short-lived, for operation and security |
| Guest account, movement profile, payment details | do not arise — there is no guest account | — |
The most important point is in the last row: an ordering system without guest registration is data-minimal by design. There is no profile to create, maintain or delete — the order belongs to the table, not to the person.
Who is who: business and provider
- The business is the controller under the GDPR: it decides which data it collects from guests, for example whether a hotel asks for the room number.
- The system provider is the processor: it processes data only on instruction. The basis is a data processing agreement under Art. 28 GDPR — at MenuMonkeys it is ready to be signed.
- The privacy notice of the business has to mention QR ordering: what is processed, on what basis (performance of a contract, Art. 6(1)(b) GDPR) and who the service provider is.
- Access and deletion requests remain duties of the business — with a system without guest accounts they are pleasantly short to answer.
What to look for when choosing a system
- Is there a data processing agreement, and can it be signed without rounds of negotiation?
- Is sensitive data stored encrypted?
- Does the system work without guest registration and without a tracking account?
- Are retention periods defined, so old order data is not kept forever?
Do guests have to create an account for QR ordering?
No. The guest scans, orders and is done — without registration, without an app, without stored payment details. That is exactly why QR ordering is less complicated in data protection terms than almost any ordering app.
Does my business need a data processing agreement?
Yes. As soon as a service provider processes data arising within the business’s area of responsibility, Art. 28 GDPR requires a data processing agreement. Reputable providers have one ready; at MenuMonkeys it is part of signing up.
Do I have to adapt my privacy notice?
Yes, to a manageable extent: QR ordering is named as a processing activity, with purpose, legal basis and the provider as processor. The provider’s template or your own data protection officer helps with the wording.