A QR code is not a vault
A QR code has two properties that should govern everything you put in one: it’s readable by anyone who sees it — a free scanner is all it takes — and it forgets nothing — the content is frozen in the pattern, endlessly copiable, impossible to “expire” or erase from a print run already distributed. A QR code is therefore not a secure channel: it’s a display. Anything that couldn’t survive being printed large on a poster has no place in the pattern.
The sorting: three cases
What passes: deliberately public data
The professional vCard (name, role, work phone and email), a link to your site, guest Wi-Fi, a product reference, a serial number: this information is designed to circulate. The code just makes it easier to capture.
What doesn’t pass: secrets and credentials
A plain-text password in a text payload, an API token, a private key, a “secret” URL containing a session token: the code adds no protection — it photocopies the secret. Simple rule: if the content guards access, it doesn’t go in a public pattern. (Nuance: a Wi-Fi code does hold a password — but it’s meant to be shared, physically bounded, and a guest network limits the blast radius; see Wi-Fi QR code.)
What’s off-limits: third-party sensitive data
Health data, biometrics, opinions, minors’ data, official identifiers: GDPR classifies these as sensitive, and encoding them in plain form in a universally readable pattern is a violation waiting to happen — the equivalent of publishing them. The only acceptable scheme would be an encrypted payload readable only by a dedicated app, which is beyond the “universal” QR code.
The GDPR angle for whoever generates codes
If you generate QR codes containing data about people — event badges with name and company, vCards for your sales team, named codes for a service — you are performing personal-data processing. Three compliance reflexes:
- Minimization: encode only what’s needed. A badge doesn’t need a personal phone number if name and role suffice.
- Purpose and information: people should know what their badge contains and why — the code’s readability by anyone strengthens that transparency duty.
- Retention: a printed code can’t be erased; plan how badges and materials get collected at end of use.
Case study: the event badge
A typical case: you’re running a trade show and printing 200 badges with QR codes. Two options — encode a full vCard (name, company, phone, email) or encode a simple URL https://yoursite.com/badge/{id}. The vCard is handy for networking but publishes every attendee’s phone and email to whoever scans a badge — including a competitor photographing badge backs. The named URL reveals nothing in the pattern: the data stays behind a page you control (restricted access, revocable). The second scheme honors minimization — and when the page is no longer needed, you shut it down, effectively “deactivating” the badges without collecting them back.
What about a code that points to a page?
A frequent nuance: encoding https://… puts no personal data in the pattern — the URL itself is just an address. Watch out, though, for URLs that carry data in their parameters (?name=…&email=…): whatever sits in the URL is encoded in the pattern and readable by all. Sensitive data stays behind the protected page, never in the encoded string.
Where local generation changes the picture
One last, often-missed point: generating a code containing personal data on an online service means transmitting that data to a provider — a data processor under GDPR, with the associated obligations. FlashScan Pro builds the payload and the image entirely in your browser: the encoded data never leaves your device (verifiable — see scanning without uploads). That doesn’t make the pattern’s content less public once printed, but it eliminates the leak at the generation step — where online services concentrate the data of all their users.
The end-of-life question nobody asks
A printed QR code outlives its purpose. The trade-show badge in the bin, the flyer in the recycling, the packaging on the shelf — every copy remains decodable indefinitely. If the pattern holds personal data, its “retention period” is effectively forever, which GDPR’s storage-limitation principle won’t accept. Two habits fix this: prefer encoded data that stays harmless over time (a URL you control, professional contact details), and plan destruction like you would for paper files — badges collected and shredded, obsolete stock pulped.
In short
Ask yourself: “if this content were printed as a street poster, would it be a problem?” If not, encode freely. If yes, the QR code isn’t the channel — use a secured link and, if needed, point the code at that protected link.