Keeping your guests' details safe, in plain English

When someone registers for your event they hand you their name, their email, often their phone number and where they work. For a government briefing or a bank's client evening, that list of who attended can be sensitive on its own, never mind the contact details. You're holding something that belongs to them, and looking after it well is part of the job, even if nobody put it in your brief.

The reassuring part is that most of what goes wrong has nothing to do with anything technical. It's the everyday handling. The guest list emailed to a personal account so someone could work on it from home. The spreadsheet left open on a shared screen at the registration desk. The "reply all" that shows two hundred guests each other's email addresses. None of that needs a sophisticated attacker. It just needs a busy team and no agreed habits.

So a few plain habits carry most of the weight. Only collect what you'll actually use. If you're not going to act on someone's dietary preference or their company size, don't ask for it, because every field you don't hold is one you can't lose. Decide who on your team genuinely needs to see the full list, and let the others work without it. When the event is over and you've sent your thank-yous and your follow-ups, delete the personal details you no longer need rather than letting them sit in an inbox for two years.

Questions worth asking your suppliers

You'll usually be trusting a platform or a check-in system with this information, so it's fair to ask the people running it a few straight questions. Where is the data kept, and does it stay in Singapore or somewhere with comparable rules? Who at your company can see it? What happens to it after my event, and will you delete it if I ask? How quickly would you tell me if something went wrong? A supplier worth working with will answer those in plain language without getting defensive. If the answers are vague or they bury you in jargon, that's your answer.

For the work we do with government agencies and banks, this isn't a nice-to-have. We keep guest data within the access controls those clients require, we don't reuse it for anything they didn't agree to, and we clear it out on the timeline we've agreed rather than hoarding it. That's not us being generous, it's the baseline you should expect from anyone you let near your attendees' details. Singapore's PDPA sets the floor here, and the spirit of it is simple enough: treat people's information the way you'd want yours treated.