Questions to answer before drafting an event privacy notice
Someone has pasted last year's privacy notice into the registration form, and nobody has checked whether it still describes what this event does.
The short answer
A privacy notice can only describe what your event actually does with personal information. Before drafting, gather the facts: what is collected, why, who receives it, how long it is kept, and who delegates contact.
Your organisation's data protection contact, or its legal adviser, decides what the notice must say and how it is worded. This page prepares the facts and the questions, not the notice.
What the planning team supplies and what it does not
The team knows the data flow: forms, suppliers, photography, sponsor arrangements. It does not decide what the law requires the notice to contain, or whether the wording is adequate.
The PDP Malaysia website refers to seven personal data protection principles under the Personal Data Protection Act 2010 (Act 709) but does not detail them on the page opened for this guide. Ask your data protection contact which official documents apply and in which language the notice must be provided.
Facts to collect first
- The full list of items collected, from your data inventory, including photographs and recordings.
- The reason each item is collected, in one plain sentence.
- Everyone who receives it: platform, badge printer, caterer, venue, sponsors, speakers.
- Whether any item is optional, and what happens if a delegate leaves it blank.
- How long each item is kept and who deletes it.
- A named contact delegates can write to with questions or requests about their information.
Questions for the data protection contact
- Which version of the notice applies to this event, and who approves changes to it?
- Where and when must delegates see it: on the form, on the confirmation message, at the registration desk?
- Do we need the notice in more than one language, and who approves translations?
- How should consent or acknowledgement be recorded, if at all?
- How should marketing contact be requested separately? See marketing permission separation.
- How should sponsor sharing be described? See sponsor data-sharing review.
- What should photography signage and the photo question say? See photo opt-out workflow.
- Who answers delegates who ask about their information, and how fast?
Keep the notice and the practice in step
A notice that says one thing while the badge file, the sponsor portal or the photographer does another is a risk your team created. Each time a supplier or field changes, ask whether the notice still matches.
Date every version and keep the old ones, so you can say what delegates were shown when they registered.
Worked example · Fictional example
Preparing a notice pack for a members' conference
Fictional organisation and figures, for illustration only.
A fictional engineering society completes the fact list and finds that the registration platform, a badge printer and an exhibitor lead-scan app all receive delegate details. The photographer will also publish images on the society's channels.
The secretariat sends the facts and eight questions to the society's data protection contact, who drafts the notice and decides where it appears. The secretariat then checks that the form, confirmation message and photography signage match what the contact approved.
Use this yourself
Privacy notice drafting question pack
Complete the left column yourself. Send the right column to your data protection contact or legal adviser.
| Facts the organiser fills in | Question for the reviewer |
|---|---|
| Items collected and why (from the inventory): | Is this the right set, and is any item excessive for the purpose? |
| Who receives each item: | How should recipients be described in the notice? |
| Retention period and owner per item: | Is the period acceptable and how should it be stated? |
| Languages of delegates: | Which languages are needed and who approves them? |
| Where delegates will see the notice: | Is the placement and timing adequate? |
| Photography, recording and sponsor sharing plans: | What wording and choices are needed? |
| Named contact for delegate questions: | Who is the contact and how are requests handled? |
Handle it in-house, or bring in help?
Your team can usually handle this when
- You have an approved notice template from your organisation and the event changes little.
- A data protection contact is available and replies quickly.
- The data flow is simple and fully known.
Outside planning help earns its fee when
- Several suppliers, sponsors or agencies receive delegate details.
- Nobody can say which version of the notice delegates saw.
- The notice, form and suppliers have drifted apart over several events.
Need the facts and questions assembled?
An Event Blueprint can document the data flow, the supplier handovers and the question pack so your data protection contact has what they need to review. The planner prepares the facts; the notice wording and the decisions stay with your organisation's contact.
Questions organisers ask
Can we reuse last year's notice?
Only after checking it against this year's data flow with your data protection contact. Suppliers, fields and photography plans often change between events.
Who writes the notice?
Your organisation's data protection contact or its legal adviser. The planning team supplies facts and keeps practice aligned with what is approved.
Should the notice be on the registration form?
Ask your reviewer where and when delegates must see it. The organiser's job is to make that placement happen and test it.
Related resources
Sources and check dates
- Jabatan Perlindungan Data Peribadi (PDP Malaysia), homepage, Personal Data Protection Department, Malaysia (checked 2026-10-07). Identifies the Personal Data Protection Act 2010 (Act 709) and refers to seven personal data protection principles without detailing them on that page. It does not state what any event notice must say.
Content record: Draft. Written from the cited sources and checked by automated rules; not yet independently reviewed.