Personal data is any information from which a natural person can be directly or indirectly identified. In the case of a business card, the personal data is pretty apparent – the data subject’s name, email, phone number and address, and any other information on the card which can be used to identify the person. The data subject can be directly identified by his or her name, but details such as a job title also allow indirect identification.  

Think about an immediate further communication with the owner of the business card, relaying why the data was taken and to obtain official consent for its usage. 

If your intention is marketing, then is a business card really needed? You could channel marketing consent through a form on a tablet or mobile phone, so that the information you take in from events is clearly reasoned and attached to an opt-in mechanism.