Privacy and information handling
Event information incident contact tree
A volunteer has just emailed the full attendee list to the wrong address, and nobody is sure who should be told first.
Opens WhatsApp with a draft you can edit before sending. Nothing is sent automatically.
The short answer
A contact tree names, in order, who is told when attendee information is lost, exposed or sent to the wrong person: the first responder, the event owner, your IT or privacy reviewer, the affected supplier and whoever approves any message to attendees.
It records contacts and sequence only. Whether anyone outside your organisation must be told, and when, is for your privacy or legal reviewer to decide.
Build the tree before the event
Names and mobile numbers have to be known before the day, not looked up during it. List a primary and a backup for each role, and check they are reachable on event days.
Keep the tree to one page and give it to the desk lead, the secretariat and each supplier's on-site contact.
Roles in the tree
| Step | Role | What they do | Primary and backup |
|---|---|---|---|
| 1 | Person who notices | Stops the action if they can, writes down what, when and who, and calls the event owner. | Anyone on the team |
| 2 | Event owner | Confirms the facts and starts the log; decides who is called next. | To be named |
| 3 | IT or privacy reviewer | Advises on containment and on whether anyone must be told. | To be named |
| 4 | Affected supplier contact | Provides facts from their side. | Named in each contract |
| 5 | Approver for attendee messages | Approves any wording to attendees; nothing is sent without approval. | To be named |
Facts to write down first
- What information, how many people, and in what form (file, email, printed).
- Who received it and whether it can be recalled or deleted.
- When it happened and when it was noticed.
- What has already been done, and by whom.
- Do not guess or speculate in writing; record what is known and mark the rest unknown.
Official starting point
Malaysia's Personal Data Protection Department lists data breach notification among its topics on its website. Ask your reviewer to read the current official requirements and tell you what applies to your organisation, rather than using this page to decide.
Worked example · Fictional example
A fictional association rehearses a wrong-recipient email
Fictional organisation and figures, for illustration only.
Persatuan Fiktif Jurutera Perkhidmatan has a 200-delegate event. A volunteer sends a list of 45 delegates' names and companies to a wrong address. The tree tells the volunteer to write down what and when and call the event owner.
The owner logs the facts, calls the reviewer within the hour and asks the recipient, in writing, to delete the message. The approver holds any attendee message until the reviewer has advised. The 20-minute rehearsal before the event shows that two backups had no mobile numbers, which are added.
Use this yourself
Information incident contact tree and log
Fill in names and numbers before the event. Use the log fields as soon as something happens.
- Event owner (primary, backup, mobile):
- IT or privacy reviewer (primary, backup, mobile):
- Approver for attendee messages (primary, backup, mobile):
- Each supplier's named on-site contact and mobile:
- Where the tree is kept on the day and who holds a copy:
- Log: what information, how many people, in what form:
- Log: who received it, can it be recalled or deleted:
- Log: date and time it happened, date and time noticed:
- Log: actions taken so far, by whom:
- Log: advice received from reviewer (name, time):
- Log: messages sent or approved, and by whom:
Handle it in-house, or bring in help?
Your team can usually handle this when
- A small event with a named owner and a reviewer who can be reached.
- You can rehearse the tree once before the event.
- Suppliers have named contacts.
Outside planning help earns its fee when
- Many suppliers, venues and committees share the data.
- No one owns the tree or has rehearsed it.
- You want the tree in supplier requirements and the event handover.
Want the tree built and rehearsed before the event?
An Event Blueprint can include the contact tree in the handover documents, with supplier contacts collected and a short rehearsal scheduled, so the right people are called in the right order. What must be reported, and to whom, stays with your reviewer.
Questions organisers ask
Does this page tell me when to report an incident?
No. It organises who to call. Whether anything must be reported, and when, is for your reviewer, who should read the current official requirements.
Who should be first on the tree?
The person who notices, then the event owner. Everyone on site should know the event owner's number.
Should attendees be told?
That is a decision for the owner and reviewer. The approver holds any message until advised.
Related resources
Sources and check dates
- Personal Data Protection Department Malaysia (JPDP) website, Jabatan Perlindungan Data Peribadi (checked 2026-10-07). The site names the Personal Data Protection Act 2010 (Act 709) and lists data protection principles and data breach notification among its topics. It does not decide whether a particular event's practice is compliant; that needs a qualified review.
Content record: Draft. Written from the cited sources and checked by automated rules; not yet independently reviewed.