Aipedia: Event and wedding planners

AI guest lists, RSVPs and dietary data: allergies, the ICO and insurance

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Allergy, dietary and accessibility details collected through AI RSVP tools are health data, so UK GDPR special category rules apply and errors can cause real harm. For planners, one mistyped allergy can turn a data problem into an injury claim.

Part of: AI in Event and wedding planners

In short

Planners use AI RSVP forms, guest list tools and seating planners that collect allergy, dietary and accessibility needs. That information is health data and special category data under UK GDPR Article 9, so it needs a lawful basis, a condition for processing and appropriate safeguards, and should not be pasted into public AI tools. Data errors can lead to allergic reactions, ICO complaints and client claims. Injuries are usually a public liability matter, data breach costs often sit with cyber cover, and PI responds to negligence claims for financial loss, subject to the wording.

How planners use AI for guest data

Guest management is repetitive and data-heavy. Planners commonly use AI to:

run online RSVP forms that collect meal choices, allergies and access needs;
merge guest lists from several sources and remove duplicates;
build seating plans and dietary summaries for caterers;
answer guest questions through a chatbot or automated email.

Every merge, summary or reformat is a chance for a dietary note to be dropped or attached to the wrong name.

The data protection duties

Allergy, dietary and disability information is health data, which is special category data under UK GDPR Article 9. It should not be put into public AI tools without a lawful basis and appropriate safeguards. The ICO's guidance on AI and data protection explains how the principles apply, including transparency, data minimisation and security.

In practice, planners should know what the RSVP tool does with the data, where it is stored, whether it is used to train models and how long it is kept. Guests should be told why their dietary information is collected and who receives it. Since 5 February 2026, UK GDPR Articles 22A to 22D on automated decisions have applied under section 80 of the Data (Use and Access) Act 2025; they are unlikely to affect guest lists, but would matter if a tool automatically refused bookings.

What can go wrong

Illustrative scenario. A planner uses an AI tool to combine RSVP responses with a spreadsheet of late additions and produce a dietary list for the caterer. The merge assigns one guest's nut allergy to another guest with a similar name. The allergic guest is served a dish containing nuts, has a reaction and needs hospital treatment. The guest claims against the caterer and the planner, the client complains about the handling of guest data, and a guest raises a concern with the ICO.

Other risks include guest lists exposed through a misconfigured shared link, and health details sent to suppliers who did not need them.

How the insurance splits

This kind of incident often touches three different policies, and the split matters. The usual position, subject to the wording, is:

Public liability usually responds to the guest's injury claim; see event organiser public liability. Many PI wordings contain a bodily injury exclusion, though some give limited cover where injury arises from professional advice.
Professional indemnity commonly responds to the client's financial loss from negligent data handling or planning, such as the cost of a disrupted event.
Cyber usually deals with breach response costs, notification and data liability; PI may contain cyber exclusions.

ICO enforcement and any penalty are generally outside PI. Whether fines are insurable at all is uncertain; see GDPR fines versus civil claims.

Practical controls

A planner can reduce both the safety and the data risk with these steps:

collect only the dietary and access details caterers and venues actually need;
use tools with suitable data terms, not public AI chatbots, for health data;
after every merge, check allergy entries against the original RSVP responses;
send caterers a list that shows names, tables and allergies together, and ask them to confirm it;
restrict access to guest lists and delete them when the event and any follow-up are complete;
update your privacy notice to explain AI tools used for RSVPs.

How Apex helps

Apex arranges PI, public liability and cyber cover for event and wedding planners, and a broker can map how each responds to a guest data incident. See AI in event and wedding planning and AI chatbots for wedding and event enquiries.

Sources

Frequently asked

Is a guest's allergy information special category data?

Yes. Allergy, dietary and disability information is health data, which is special category data under UK GDPR Article 9. It needs a lawful basis, an Article 9 condition and appropriate safeguards, and should not be entered into public AI tools without them.

Which policy covers a guest injured by an allergy mix-up?

The guest's injury claim usually falls under public liability. Many PI wordings exclude bodily injury, although some give limited cover where it arises from professional advice. The client's separate financial loss claim may fall under PI, subject to the wording.

Can I put the guest list into a generative AI chatbot to build a seating plan?

Only with care. Names alone are personal data, and dietary or access notes are special category data. Use a tool whose data terms you have checked, remove health details unless needed, and make sure guests have been told how their data is used.

Who is the controller of guest data, the planner or the client?

It depends on the arrangement. A planner who decides how guest data is collected and used, for example by choosing and configuring the RSVP tool, may be a controller or joint controller rather than simply acting on the client's instructions. Set out the roles in the client contract and privacy notice.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.