Privacy and information handling
Reviewing what an event shares with sponsors
A sponsor's agreement says they will receive the delegate list, and the secretariat has only now been asked to produce it.
Opens WhatsApp with a draft you can edit before sending. Nothing is sent automatically.
The short answer
Before any delegate information goes to a sponsor, write down exactly what is being shared, for what purpose, under what written terms, and who approved it. If the sponsor package promises a list, review that promise first.
Whether sharing is acceptable, and on what terms, is for your data protection contact or legal adviser. The organiser prepares the facts and holds the approval record.
Start with what has been promised
Read the sponsor agreement or package for any mention of delegate lists, lead scans, attendee data or contact with delegates. Promises made before the form was designed are the usual source of trouble.
The PDP Malaysia website identifies the Personal Data Protection Act 2010 (Act 709) and says it concerns persons processing personal data in commercial transactions. It does not address sponsor lists, so the question of what this means for your sponsors goes to your contact.
The forms sharing can take
| Form of sharing | Questions to settle |
|---|---|
| Full delegate list | What fields, who approves, and what were delegates told when they registered? |
| Opt-in list for a sponsor | What exactly did the delegate agree to, and is the record kept? See permission separation. |
| Lead scan at the sponsor's stand | Does the delegate choose to be scanned, and what does the sponsor get? |
| Sponsor sends a message through the organiser | Does the sponsor ever see the addresses? |
| Aggregate summary with no names | Is any group small enough to identify a person? |
| Session attendance for sponsored sessions | Is a count enough, rather than names? |
Review sequence
- List every sponsor and what the agreement says about delegate information.
- Match each promise to a form of sharing in the table above.
- Check the privacy notice and form wording: do they describe this sharing?
- Send the specific questions to your data protection contact and wait for the answer in writing.
- If the answer is no or not yet, tell the sponsor early and offer an alternative such as an aggregate summary, if approved.
- Record what was shared, when, in which format, and under what written terms.
What the written terms should cover, to confirm with your contact
- The purpose for which the sponsor may use the data.
- Whether the sponsor may pass it on.
- How the sponsor keeps it secure and for how long.
- What happens if a delegate asks the sponsor to stop contact.
- Who the sponsor contacts about delegate requests.
Where a planner helps
Sponsorship sales are not part of this review. A planner can coordinate the sharing workstream: gather the promises, prepare the question pack, hold the decision log and run the handover once approved. Record handovers with the handover pack builder and review fields with the field minimiser tool.
Worked example · Fictional example
A sponsor expects a full delegate list
Fictional organisation and figures, for illustration only.
A fictional industry association has three sponsors for a 500-delegate congress. One agreement says the sponsor will receive the attendee list after the event. The form says nothing about sponsors.
The secretariat sends the clause and form wording to the data protection contact and flags that no sponsor choice exists on the form. While waiting, it tells the sponsor the list cannot be promised yet, and offers to ask about an opt-in at the desk or a summary by job category. The decision and date are logged.
Use this yourself
Sponsor data-sharing decision sheet
One row per sponsor. Do not release anything until the last two columns are complete.
| Sponsor | Promised in agreement | Form of sharing proposed | What delegates were told | Data protection contact's answer | Written terms and approval date |
|---|---|---|---|---|---|
| Sponsor A | Attendee list after event | To be decided | Not stated on form | ||
| Sponsor B | Lead scan at stand | Delegate-initiated scan | Stand signage to be written | ||
Handle it in-house, or bring in help?
Your team can usually handle this when
- Sponsors receive nothing about individuals.
- Your contact has approved a standard sponsor clause.
- Opt-in choices were built into the form from the start.
Outside planning help earns its fee when
- Several sponsors expect lists and the promises differ.
- The form and notice were written before the sponsor package.
- Nobody has recorded what was shared at previous events.
Want the sharing question handled before it becomes urgent?
An Event Blueprint can bring sponsor promises, form wording and supplier handovers into one plan, and give your data protection contact a clear question pack. The planner coordinates the workstream. It does not sell sponsorship or decide what may be shared.
Questions organisers ask
Can we say yes to a sponsor now and sort out data later?
Avoid it. Say that any sharing depends on review, and keep the decision in writing. Promises made first are hard to withdraw.
Is a lead scan different from a list?
It can be, if the delegate chooses to be scanned and knows what happens. Ask your data protection contact how to describe and record that choice.
What if a sponsor refuses to sign terms?
Do not release delegate information. Tell your committee and contact, and offer an alternative that involves no personal details.
Related resources
Sources and check dates
- Jabatan Perlindungan Data Peribadi (PDP Malaysia), homepage, Personal Data Protection Department, Malaysia (checked 2026-10-07). Identifies the Personal Data Protection Act 2010 (Act 709) and says it concerns persons processing personal data in commercial transactions. It does not address sponsorship or event data sharing.
Content record: Draft. Written from the cited sources and checked by automated rules; not yet independently reviewed.