Start with a map of the information collected for your event: registration details, badge scans, meeting preferences and any biometric records. Then check each use against the framework that applies to your event.
Identify the applicable framework
SDAIA’s knowledge centre explains Saudi PDPL responsibilities and data-subject protections. In Dubai, the DIFC Commissioner supervises DIFC’s own Data Protection Law. Because rules differ by jurisdiction, ask the responsible legal adviser to determine which regimes cover the organizer, suppliers and processing.
Separate registration from marketing
For each field, record its purpose, recipients and access permissions. Saudi implementing regulation Article 29 requires consent before processing personal data for direct marketing and a mechanism to stop receiving it. Where the Saudi framework applies, check that requirement and keep marketing consent separate from registration.
Ask suppliers what an exhibitor receives from a badge scan, what sponsors receive, and whether matching profiles are reused for another purpose. Make each flow visible before accepting a supplier’s standard registration form.
Set retention by purpose
SDAIA’s knowledge centre states that there is no single fixed retention period; retention depends on necessity for the stated purpose and applicable requirements. Record the purpose, retention decision, deletion owner and treatment of supplier copies.
Control access and review suppliers
NIST describes multi-factor authentication as an added barrier when a password is compromised. Enable suitable MFA on administrative accounts, give staff access only for their duties and review permissions when work ends.
Ask suppliers to demonstrate the security controls covering your service, incident contacts and deletion process. Test relevant access restrictions. Treat a certificate or a claim of encryption as one part of that evidence review. Apply the same questions to AI tools, using our guide to evaluating an AI pilot for events.
Prepare an incident decision record
Before opening, assign who contacts the supplier, who assesses affected data and who obtains jurisdiction-specific advice about notifications. Rehearse a registration outage with the operations team. Record decisions and timings, and follow the notification rule that applies to your case.
