Managing Conference Attendee Data

Once registrations start arriving, you need somewhere to keep each attendee's details and booking form answers, usually a spreadsheet, database or online registration tool. Whichever you use, holding this information brings legal responsibilities.

Your legal duties

Most uses of attendees' personal data are governed by the UK GDPR and the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025, whose provisions are coming into force in stages. If you decide what data is collected and how it is used, you are likely to be the data controller.

Most organisations handling personal data must pay a fee to the Information Commissioner's Office (ICO) unless an exemption applies. Use the ICO's data protection fee self assessment to check.

In practical terms, you should:

• Define and record your purposes, such as booking administration, accounting and refunds.
• Collect only what those purposes require.
• Identify a lawful basis for each purpose. Consent is not automatically needed for routine booking administration.
• Use data fairly, in ways people would expect.
• Keep records accurate and set retention periods before collecting anything.
• Keep data secure and be able to demonstrate compliance.

Put a clearly signposted privacy notice on the registration form. It should explain who you are, your purposes, who receives the data, how long you keep it, attendees' rights and how to complain. If employers or assistants book for delegates, you may need to give this information to the delegates directly.

Attendees can request access to their personal data and information about how you use it. You must normally respond without undue delay and within one month; check the ICO's subject access guidance for exceptions and extensions. People can also ask you to correct or delete information in certain circumstances. Name who maintains the master record and who handles these requests.

Setting up your records

Use one row per attendee with consistent field names covering name, organisation, contact details, sessions booked, payment status and requirements. A unique reference number for each attendee helps you avoid duplicates and match people to payments and badges. Keep date and phone number formats consistent so sorting and filtering work. Check details carefully when transferring them from paper forms or emails, apply your retention schedule to those originals too, and securely destroy copies once they are no longer needed. Avoid uncontrolled copies of the spreadsheet.

Sharing names, employers or contact details with other attendees through delegate lists or badges is a separate use. Consider whether it is justified and tell people in advance; a booking does not automatically allow you to circulate someone's email address.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

Sensitive details and suppliers

Allergies and some accessibility information can reveal health data, and dietary information can sometimes reveal religious beliefs. This is special category data, which requires both an Article 6 lawful basis and an Article 9 condition, identified and documented before collection. Explicit consent may suit some cases but is not the only option. Ask for the meal or adjustment needed rather than medical histories, and give caterers and venue staff only the details relevant to them.

If a supplier processes personal data on your behalf, you must have a binding written contract containing the required data protection terms. Not every supplier is a processor; hotels, for example, may act as independent controllers for their own booking records. When choosing a registration platform, check its processor terms, security, subprocessors, deletion arrangements and any overseas access or transfers. UK law does not generally require attendee data to be stored in the UK.

Security, breaches and afterwards

Use security measures appropriate to the information and the risks:

• Strong, unique passwords and multifactor authentication.
• Encryption where appropriate, remembering that password protecting a file is not necessarily encryption.
• Updated software and secure sharing permissions.
• Restricted access, removed promptly when staff or contractors leave.
• Secure, regular backups.

The National Cyber Security Centre's small business guide offers free practical advice.

You must notify the ICO of a personal data breach unless it is unlikely to pose a risk to people's rights and freedoms. Report without undue delay and, where feasible, within 72 hours of becoming aware of it. Document every breach, including those you do not report, and tell affected people without undue delay where there is likely to be a high risk to them, subject to limited exceptions. See the ICO's breach reporting guidance.

After the conference, apply your retention periods and delete what you no longer need. If you want to promote future events to attendees, check both data protection law and the Privacy and Electronic Communications Regulations, which cover email and text marketing. Explain the intended use, establish an appropriate lawful basis and provide any required consent and opt out mechanisms.