Data Is the New Crowd: Events Confront Privacy and Cyber Risk
Every large celebration now has a second crowd. Alongside the ticket-holders arriving at the gate, a parallel assembly of records moves through the event: bookings, payment details, accreditation photographs, accessibility requests, dietary notes, contact numbers, app profiles and access logs. This digital crowd is larger, longer-lived and more portable than the one on site. It begins forming at the point of sale and often persists long after the staging is dismantled. For organisers of festivals, conferences, ceremonies and public celebrations, managing it has become part of event delivery rather than a matter for the back office.
The shift is not simply a consequence of more technology. It reflects how completely the operating model of a modern event depends on digital systems. Ticketing, accreditation, mobile programmes, cashless payments, Wi-Fi, access control and broadcast production all rely on data being collected, verified, shared and stored. Each of those systems adds capability. Each also adds a dependency and a liability. The 2026 Global Events & Celebrations Awards category offers a useful lens on this work, because the craft involved is largely invisible on the day: the mapping, contracting, training and rehearsal that allow an event to run on data without putting its audience at risk.
Map the Data Before Signing the Contract
Privacy problems in events rarely begin with a malicious actor. They begin with a plan that was never drawn. A ticket platform collects purchaser details and passes some to an accreditation system; an app provider receives a delegate list; a payment processor holds transaction records; a venue or security contractor operates access control; a sponsor receives an audience segment. By the time the gates open, personal data may have travelled through a dozen organisations, some of which the organiser has never met.
The practical discipline is to map those flows before supplier contracts are signed. That means identifying what data each system needs, where it is stored, who can see it, how long it is kept and what happens to it when the event ends. A data-flow map produced during procurement is far more useful than one assembled after an incident, because it allows the organiser to challenge unnecessary collection, close gaps between systems, establish which party is responsible for what and expose where the same information is being collected twice.
Suppliers Sit Inside the Security Perimeter
A common assumption is that security is the responsibility of the technology provider. In practice, the organiser holds the relationship with the attendee and therefore carries much of the reputational risk when something goes wrong. Treating vendors and payment providers as part of the event security perimeter is a more honest framing, and it changes how contracts are written.
Three terms matter more than most. The first is a clear statement of responsibilities: which party secures which system, who monitors for intrusion, and who decides when to notify. The second is breach notification, including how quickly an organiser will be told and in what form, because an organiser cannot manage a response to an incident it learns about from the press. The third is data return and deletion, setting out what a supplier must hand back or destroy at the end of the engagement.
Supplier oversight should continue beyond signature. Asking a vendor how it tests its systems, who has administrative access and how it handles sub-processors is not an unreasonable request for an event handling tens of thousands of attendee records. Smaller events can apply the same questions proportionately; the principle does not depend on scale.
Collect Less, Explain Why, Delete on Schedule
Data minimisation is often treated as a legal obligation and rarely as a design choice. Yet it has practical benefits for events. Every field on a registration form must be secured, corrected, exported and eventually erased. Every optional question is an invitation to hold information the event does not need.
Applying minimisation to the attendee journey means reviewing each stage and asking what the information is for. Dietary requirements may be necessary for hospitality; they do not need to sit in a marketing database. Accessibility requests are essential to delivering a usable event and should be handled with particular care, shared only with the teams who need them. Identity verification for accreditation may require a photograph; it rarely requires a copy of a passport retained indefinitely.
Retention rules turn intention into practice. If the event states that registration data will be deleted a set period after the event, that commitment needs an owner, a calendar entry and a method. Data left in place because nobody remembered it exists is among the most common weaknesses in event operations, and among the easiest to fix.
Rehearse Failure as Well as Success
Incident response is a delivery discipline, not a document. Events should know in advance who will make decisions if a ticketing system is compromised, how the public will be told, which regulator or partner needs to be informed and how the programme will continue while systems are restored. A short exercise in which a system is declared unavailable, and the team works through the consequences, will reveal more than a written procedure.
Offline fallback belongs in the same plan. Access control that depends entirely on a live connection can halt entry if the network fails. Accreditation desks should be able to verify attendees from a printed or locally held list. Communications teams should have channels that do not rely on the platform that may be affected. Safety arrangements, from crowd management to medical response, should not assume that digital systems are available.
People Are Part of the Control Set
Most security failures involving events begin with a person rather than a system. A convincing email to a volunteer coordinator, a message to a supplier asking for a delegate list, a link clicked during a busy build-up: social engineering exploits the pressure and goodwill that events depend on.
Training does not need to be elaborate. Staff and volunteers should understand what personal data they handle, where it may be stored, and how to report a request that seems unusual. Freelancers and contractors should receive the same briefing as permanent staff, because the build-up often involves more people than the show itself. A short, repeated reminder during the busiest weeks is more effective than a single induction months earlier.
Personalisation Has a Price
The commercial argument for collecting data is straightforward. Richer attendee profiles support personalisation, targeted sponsorship and better measurement. Those are legitimate aims, and many attendees welcome recommendations that make a large event easier to navigate.
But the balance is delicate. A celebration depends on a degree of trust and goodwill that can be damaged quickly by data uses that feel intrusive or unexpected. Attendees who discover that their movement around a site was tracked for commercial purposes, or that contact details supplied for one purpose were passed on for another, are unlikely to describe the experience warmly. Sponsorship value built on that kind of surprise is fragile.
The more durable approach is transparency combined with restraint: explaining clearly what will be collected and why, offering genuine choices where they matter, and declining uses that would make the event feel less like a celebration and more like surveillance. Organisers who can describe their data practices plainly are better placed to keep the trust that the digital crowd, like the physical one, has given them.