Keeping your guests' details safe, in plain English

Register for an event and you hand over your name, your email, usually a phone number, and where you work. For a government briefing or a bank's client evening, the guest list is sensitive on its own, never mind the contact details. You're holding something that belongs to your guests, and looking after it is part of the job, even if nobody wrote it into your brief.

Here's the reassuring part: most of what goes wrong isn't technical at all. It's the everyday handling. The guest list forwarded to a personal account so someone can work on it from home. The spreadsheet left open on a shared screen at registration. The "reply all" that shows two hundred guests each other's email addresses. None of that needs a clever attacker. It just needs a busy team with no agreed habits.

A few plain habits carry most of the weight. Collect only what you'll use. If you won't act on someone's dietary preference or their company size, don't ask for it, because every field you don't hold is one you can't lose. Work out who on your team actually needs the full list, and let everyone else work without it. Once the event's done and the thank-yous and follow-ups have gone out, delete the personal details you no longer need instead of leaving them in an inbox for two years.

Questions worth asking your suppliers

Most of the time you're trusting a platform or a check-in system with this data, so ask the people running it a few straight questions. Where is it kept, and does it stay in Singapore or somewhere with comparable rules? Who at your company can see it? What happens to it after my event, and will you delete it if I ask? How fast would you tell me if something went wrong? A supplier worth working with answers all of that plainly and without getting defensive. Vague answers, or a wall of jargon, tell you what you need to know.

For the work we do with government agencies and banks, none of this is optional. We keep guest data inside the access controls those clients require, we don't reuse it for anything they didn't sign off on, and we clear it out on the agreed timeline instead of hoarding it. That isn't us being generous. It's the baseline you should expect from anyone you let near your attendees' details. Singapore's PDPA sets the floor, and the idea behind it is simple: treat people's information the way you'd want yours treated.