Who is responsible for complying with data protection regulations?
The data protection laws — the EU General Data Protection Regulation (GDPR) and the Swis Federal Act on Data Protection (FADP) — distinguish between controllers and processors.
- The controller determines the purpose and means of data processing. For events, this is usually the organiser. You decide which data you collect, why you collect it, and how you use it.
- The processor handles data on behalf of the controller. This includes, for example, providers of event software, badge printing companies, or catering services that have access to participant lists.
In short: as the organiser, you bear the main responsibility. At the same time, you must ensure that your service providers operate in compliance with data protection regulations.
Which guest data are you allowed to process?
You may only process personal data if there is a legal basis for doing so. Typical scenarios at events include:
Consent: For example, for newsletters, photos or video recordings, or previously stored data from a customer relationship.
Contract: Such as ticket bookings or participation agreements.
Legal obligation: For instance, to meet official safety requirements.
Legitimate interest: For example, to send information, control access, or optimise event planning. The legitimate interest applies as long as it does not override the interests of the participants.
In all cases, the guiding principle is that you should only process the data you truly need and solely for the purpose you have specified.
Fundamental principles you must follow
The GDPR (Article 5) and the Swiss FADP provide clear guidelines:
Transparency: Clearly inform your guests about how their data is processed.
Data minimisation: Collect only what is necessary – avoid unnecessary extra fields in the registration form.
Purpose limitation: Use data only for the purpose stated, not for later marketing activities without consent.
Security: Implement technical measures such as encryption and clearly define access rights.
Privacy by Design / Default: Configure access to your event management tools so that data protection is built in from the start, for example through restrictive access permissions.
Collaboration with service providers
When you involve external partners, clear rules are essential. With software providers or badge printing companies, you must conclude a data processing agreement (GDPR Article 28, FADP Article 9). This agreement specifies:
- which data are processed
- for what purpose
- how long they are stored
- which security measures apply
Particular attention is required when data are processed outside the EU or Switzerland. In such cases, you must ensure that an adequate level of data protection is in place and, if necessary, use standard contractual clauses.
Participants’ rights
Deine Gäste haben das Recht zu wissen, welche Daten du über sie speicherst, wofür du sie nutzt und an wen du sie weitergibst. Sie können eine Auskunft verlangen, ihre Daten berichtigen lassen oder die Löschung verlangen, sobald der Zweck entfällt. Auch die Datenübertragbarkeit (DSGVO Art. 20) gehört dazu. Diese Rechte gelten sowohl nach DSGVO als auch nach dem Schweizer Datenschutzgesetz.
Your guests have the right to know which data you store about them, how you use it, and to whom you disclose it. They can request access, have their data corrected, or request its deletion once the purpose no longer applies. Data portability (GDPR Article 20) is also included. These rights apply under both the GDPR and the Swiss Data Protection Act.
Data security in practice
A few concrete measures can help you protect participant data reliably:
- Use event tools with role-based access and permissions instead of sending Excel lists by email.
- Limit access to personal data to as few people as possible.
- Avoid printed participant lists, which can be easily lost.
- Ensure that data are centrally cleaned up and deleted or anonymised across all systems after the event.
It is best to discuss data protection policies and measures with your organisation’s Data Protection Officer. Also, keep an emergency plan ready. In the event of a data breach, you must notify the supervisory authorities and affected individuals immediately in accordance with GDPR (Articles 33/34) and the Swiss FADP (Article 24).
Typical risks and how to avoid them
Fotos und Videos ohne Einwilligung: Hole bei der Event-Anmeldung die klare Zustimmungen ein und informiere, wie du die Aufnahmen nutzt.
Datenweitergabe an Sponsoren: Gebe Daten an Sponsoren nur mit expliziter Einwilligung deiner Gäste und klarer Vertragsregelung weiter.
Unsichere Tools: Wähle Anbieter wie Oniva, die DSGVO- und DSG-konform arbeiten und ihre Serverstandorte und Sicherheitsmassnahmen offenlegen
Photos and videos without consent: Obtain clear consent during event registration and inform participants how the recordings will be used.
Data sharing with sponsors: Share data with sponsors only with the explicit consent of your guests and a clear contractual agreement.
Insecure tools: Choose providers like Oniva that comply with GDPR and the Swiss FADP, and that disclose their server locations and security measures.
Conclusion
Data protection is a mark of quality for professional events. By providing transparent information, limiting data collection to what is necessary, and using secure systems, you strengthen your guests’ trust in your event and organisation. With clear processes and the right tools, you can create an event experience that is not only enjoyable but also legally secure.
By the way, this link provides a template for a privacy notice for event registrations. Please ensure that you review this template with a data protection expert for your specific use case before publishing.