Table of Contents
Every event starts collecting data long before the doors open.
Names, email addresses, job titles, dietary requirements, accessibility information, ticket purchases, photographs, app activity and networking preferences can all become part of the attendee journey.
For event organisers, that creates a responsibility as well as an opportunity.
An event privacy policy helps attendees understand how their personal information is handled. For organisations covered by Australia’s Privacy Act 1988 and the Australian Privacy Principles, privacy obligations can extend across collection, use, disclosure, security, access and retention of personal information.
Privacy therefore should not be something added to the registration page at the last minute. It should be considered when the event’s technology, registration process and supplier relationships are being designed. In our work on digital, virtual and hybrid events, it is one of the first conversations we have when choosing platforms.
Please note: this article is general information for event organisers, not legal advice. Privacy law can change, so check current guidance from the Office of the Australian Information Commissioner (OAIC) and seek legal advice for your specific situation.
Key takeaways
- Organisations covered by the Privacy Act must have a clear, up-to-date privacy policy, and it may already cover your events.
- Small businesses are not automatically exempt; several exceptions apply regardless of turnover.
- Collect only the attendee data you need and tell people why you are collecting it.
- Treat dietary and accessibility details carefully and restrict who can see them.
- Know what every event technology provider collects, stores and retains.
Is it a legal requirement to have a privacy policy?
It depends on whether your organisation is covered by the Privacy Act and Australian Privacy Principles, commonly known as the APPs.
An organisation that is an APP entity must have a clearly expressed and up-to-date privacy policy explaining how it manages personal information. The policy must also be made reasonably available, typically through the organisation’s website.
For an event organiser, the first question should therefore be: Does the Privacy Act apply to our organisation and the information we are collecting?
If it does, the organisation’s existing privacy policy may already cover its event activities. That does not necessarily mean you need a completely separate privacy policy for every conference or corporate event.
What matters is whether your privacy documentation accurately reflects what happens to attendee information.
Do small businesses need a privacy policy?
Not every Australian small business is automatically covered by the Privacy Act.
The OAIC currently describes a small business generally as one with annual turnover of $3 million or less. Most are not covered by the Privacy Act, but there are important exceptions. Certain businesses can still be covered regardless of turnover, including some organisations involved in health services, trading in personal information or Commonwealth contracts. The OAIC’s guidance for organisations explains who is covered.
This means an organiser should not simply assume: “We’re a small business, so privacy law doesn’t apply.” Check your organisation’s circumstances.
Even where a particular privacy law does not require a formal policy, transparent data practices can still be valuable. Attendees increasingly expect to know why their information is being collected, particularly when an event uses apps, digital networking, lead scanning or personalised technology.
What personal information do events collect?
The answer is often more extensive than organisers initially realise. A typical registration form may collect:
- name
- email address
- phone number
- organisation
- job title
- billing information
- dietary requirements
- accessibility requirements
- session selections.
Other event systems can add:
- check-in records
- app activity
- networking preferences
- photographs and video
- survey responses
- competition entries
- lead-scanning data
- interaction with digital experiences.
Mapping this data before choosing event technology can prevent unnecessary collection. A useful rule is to ask: Why do we need this information?
If the team cannot explain what it will be used for, reconsider whether it needs to be collected.
Our guide to creating an effective event registration form provides more detail on deciding what information genuinely needs to be requested.
Can I collect customer information without a privacy policy?
The answer depends on your organisation’s legal obligations, but having a privacy policy is only one part of transparent data collection.
For organisations subject to the APPs, notification obligations can also apply when personal information is collected. APP 5 requires reasonable steps to notify individuals of certain matters, or otherwise ensure they are aware of them, at or around the time information is collected.
For events, this is one reason registration forms should make data handling clear. Attendees should not discover after registering that their information will be used in ways they were not expecting.
For example, consider whether data will be:
- used to administer the event
- added to marketing databases
- shared with event technology suppliers
- available to sponsors or exhibitors
- used for networking features
- transferred to another system.
The attendee should be given appropriate information at the relevant point in the process. If you plan to send marketing emails after the event, the Spam Act also applies, and the ACMA explains how to avoid sending spam.
What should I include in an event privacy policy?
If your organisation’s privacy policy covers its event activity, attendees should be able to understand the relevant information without navigating pages of legal language. An effective policy may address:
What information is collected
Describe the categories of personal information your organisation handles.
Why it is collected
Explain the purposes for which information may be used. For an event, this might include registration, communication, ticketing, accessibility support and event delivery.
How information is collected
This could include:
- registration forms
- websites
- apps
- surveys
- competitions
- onsite interactions.
Who information may be disclosed to
Depending on the event, that could include technology providers, registration providers or other service providers.
How information is protected
Explain how the organisation approaches the security of personal information.
Access and correction
Explain how individuals can request access to or correction of their personal information where applicable.
Complaints and contact details
Attendees should know who to contact if they have a privacy question or concern.
The objective is clarity. A privacy policy should help someone understand what actually happens to their information, not simply provide a page of legal terminology.
TELL US MORE
What are the Australian Privacy Principles?
The Australian Privacy Principles provide a framework for how covered organisations and Australian Government agencies handle personal information. There are 13 APPs covering areas including:
- transparent privacy management
- anonymity and pseudonymity
- collection
- notification
- use and disclosure
- direct marketing
- cross-border disclosure
- data quality
- security
- access
- correction.
For event organisers, several of these areas can become particularly relevant because attendee information often moves between multiple platforms and suppliers.
A guest may register on one system, receive communications from another, check in through an app and later complete a survey through another platform. The attendee sees one event. Your organisation needs to understand the entire data journey behind it.
What about dietary and accessibility information?
Be particularly careful when collecting information that may reveal sensitive details about an attendee, such as health information.
Organisers often request dietary and accessibility information for legitimate operational reasons, but the question should still be limited to what is genuinely needed. Instead of collecting extensive personal or medical information, ask for the minimum information required to provide an appropriate experience.
Access should also be limited. A staff member managing event marketing does not necessarily need to see information collected specifically for catering or accessibility arrangements.
Collect for a purpose, share only where required and avoid keeping information indefinitely simply because it remains in the registration platform.
How should attendee data be protected?
For organisations covered by the APPs, APP 11 requires reasonable steps to protect personal information against misuse, interference, loss and unauthorised access, modification or disclosure. It also addresses destruction or de-identification where personal information is no longer needed, subject to applicable exceptions.
For an event team, practical questions include:
- Who can access the attendee database?
- Are shared spreadsheets appropriately controlled?
- Does every supplier need the full guest list?
- Where is exported registration data stored?
- What happens to temporary files after the event?
- Are staff using personal devices to store attendee details?
- How long does the organisation genuinely need the information?
Good event data security often comes down to reducing unnecessary access. The fewer uncontrolled copies of a guest database that exist, the easier it is to manage responsibly.
It also helps to know your response plan in advance. Organisations covered by the Privacy Act may need to notify affected individuals and the OAIC of certain data breaches under the Notifiable Data Breaches scheme. The OAIC’s quick reference guide for responding to data breaches is a useful starting point.
What happens when event technology providers handle the data?
Modern events can involve several third-party systems. These may include:
- registration platforms
- mobile apps
- livestream platforms
- CRM systems
- ticketing systems
- survey tools
- networking technology
- smart badges.
Understand what information each provider receives and what happens to it.
This becomes increasingly important with technology such as smart badges and wearable technology at events, where attendee interactions can potentially generate substantially more information than a traditional registration list.
Ask vendors:
- What data do you collect?
- Where is it stored?
- Who can access it?
- Do you use subprocessors?
- How long is data retained?
- How can information be deleted or exported?
- What happens if there is a security incident?
Technology procurement and privacy planning should happen together.
How does privacy work for virtual and hybrid events?
Virtual and hybrid events can generate an especially broad digital footprint. In addition to normal registration information, platforms may capture:
- login activity
- viewing behaviour
- session attendance
- chat messages
- poll responses
- networking activity
- downloads
- engagement metrics.
That information can be valuable for understanding attendee behaviour and improving future events. It also means organisers should know exactly what the platform collects.
If you are building a virtual or hybrid experience, review the event’s privacy approach at the same time as the broader hybrid event technology stack.
Do not wait until registrations open to discover what the technology is tracking.
Five practical ways to protect attendee privacy
A strong privacy approach does not need to make registration complicated. Focus on five fundamentals:
- Collect only what you need. Every additional field creates more information to manage.
- Explain why you need it. Give attendees appropriate information when collecting personal data.
- Control access. Do not automatically give every supplier or team member the entire attendee database.
- Understand your technology. Know which platforms hold the information and how they use it.
- Review retention after the event. Do not keep information indefinitely without a legitimate reason.
These steps help turn privacy from a compliance exercise into part of professional event management.
Treat attendee data with the same care as the attendee
Event organisers spend considerable time designing what guests see. Registration screens, signage, content, catering and production are all carefully planned. The information guests hand over should receive the same attention.
A clear event privacy policy, appropriate collection notices, sensible access controls and carefully selected technology help create trust while reducing unnecessary data risk.
Privacy is particularly important as events become more digital and personalised. More technology can create better experiences, but it can also create more data.
Planning a virtual, hybrid or digitally connected event where registration, audience technology and attendee data need to work together? Unbelievable Group can help create the complete digital experience, from event strategy and technology planning to content, production and audience engagement. Explore our digital experiences, virtual and hybrid events capabilities and talk to our team about building an experience that feels seamless for attendees while keeping data considerations part of the plan from the beginning.
Frequently Asked Questions About Event Privacy
Do events need a privacy policy in Australia?
Organisations covered by the Privacy Act and Australian Privacy Principles are required to have an up-to-date privacy policy. Whether the Privacy Act applies depends on the organisation and its circumstances.
Do small businesses need a privacy policy?
Many small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. Businesses should check their circumstances rather than relying only on turnover.
What personal information do events commonly collect?
Events may collect names, email addresses, phone numbers, employer details, ticket information, dietary requirements, accessibility information, session selections and digital engagement data.
Can attendee information be shared with event sponsors?
Do not assume registration data can automatically be passed to sponsors. How information can be used or disclosed depends on the circumstances, applicable privacy obligations and what attendees have been told or agreed to.
How long should attendee information be kept?
There is no single retention period for every category of event information. Organisations should consider why information is still required and any applicable legal requirements rather than retaining data indefinitely.
What should I check when using an event registration platform?
Understand what information the platform collects, where it is stored, who can access it, how long it is retained, which third parties may process it and how data can be exported or deleted.
