Managing Personal Data at Events: Compliance & Security Strategies
In today’s stadium and arena environments, security and operations teams are under growing pressure to know not just who is inside their venue, but exactly where individuals are at any given moment. From fans and staff to contractors and vendors moving across highly controlled zones, real-time visibility has become essential to both safety and efficiency. As technologies such as biometric identification and RFID tracking increasingly enable this level of precision, they also generate vast volumes of sensitive personal data. This makes robust data governance, clear accountability, and compliant data handling practices—not just operational considerations, but fundamental requirements for modern event management.
From participant registration to post-event data retention, event organisers collect and handle vast amounts of personal information. Managing it responsibly, often across multiple jurisdictions, is not just a legal requirement. It’s part of what it means to run a professional event. At our annual client workshop in April, Wiz-Team’s data protection experts Brandon McCarty and Stepan Sargsyan shared practical guidance on what GDPR compliance and data protection really looks like for event organisers.
Knowing your role and obligations in data protection
Are you a controller or a processor? Most event organisations don’t spend much time thinking about their legal role in data protection. But getting it wrong can have real consequences.
As Wiz-Team’s Data Protection Officer Stepan Sargsyan explained, a clear starting point for any event organisation is understanding where its data protection responsibilities begin and end. In simple terms: if you decide what personal data to collect and why, you are the controller. If you are processing data on behalf of someone else, you are the data processor.
“In practice, event management organisations are almost always acting as data controllers. They decide what data to collect, from whom, for what purpose, and for how long to retain it. Their technology providers, including event management platforms such as Event-Works, act as processors, bound by data processing agreements that define the scope and conditions of that processing.”
Why does it matter? Because as a controller, you are responsible. You determine what goes into your privacy notice, you handle requests from participants who want to access or delete their data, and you are accountable if something goes wrong. That accountability starts with a question many organisations underestimate: on what legal basis are you collecting data in the first place?
Managing compliance across a global landscape
For organisations running events internationally, as most international sports federations, NGOs and global event companies do, the compliance picture gets considerably more complex. A common misconception is that GDPR only applies when the event takes place in Europe.
Third-party data sharing adds another layer. Sponsors, media partners and co-organisers often request access to attendee data. Each of those transfers needs a lawful basis, and if data is leaving the European Economic Area, appropriate safeguards must be in place.
What platform-level security looks like in practice
Good event management software should make compliance easier, not harder. During the workshop, Brandon and Stepan walked through some of the features in Event-Works that directly support data protection obligations:
- Automatic data deletion allows organisations to set retention periods at event or field level, so personal data is removed once it is no longer needed, without relying on someone to remember to do it manually.
- PII obfuscation takes a different approach: rather than deleting data entirely, it masks sensitive fields so they cannot be read or misused, while the underlying record is preserved for reporting and analysis.
“Obfuscating data allows organisations to retain valuable insights for reporting and statistics, especially for legacy data, while still maintaining GDPR compliance” shared Brandon McCarty, also Wiz-Team Data Protection Officer.
The platform also undergoes regular penetration testing and security scans with every major release. These are not nice-to-haves. For any platform handling sensitive participant data, they are a basic expectation. But technology only goes so far. The most sophisticated tools cannot compensate for poor practices or a lack of awareness among the people using them.
The human dimension: culture, training and shared responsibility
Most data breaches in the events sector are not the result of sophisticated attacks. They happen because of human error: access permissions configured incorrectly, a spreadsheet sent to the wrong person, data kept long after it should have been deleted. The risk is real, and it sits with people, not just systems.
“We are responsible for ensuring regulatory compliance by monitoring adherence to data protection laws, training teams internally, and raising awareness across the organisation” added Brandon.
Building good data habits takes time. It means training the teams closest to participant data, in registration, operations and guest services, and making sure they understand not just the rules but the reasons behind them. Clear internal policies, ongoing reminders and accountability at every level all play a role.
Organisations that treat data security as a genuine priority build trust with participants, partners and clients alike. In a sector where relationships are everything, that trust is worth protecting.
For anyone who wants to go deeper, Wiz-Team’s data protection team is available to support clients in reviewing their practices and making the most of the tools available in Event-Works. Get in touch at dpo@wiz-team.com.
Follow us on X, Instagram and LinkedIn to keep updated of Wiz-Team’s journey, supporting event delivery across the world.
