POPIA and event registration: what organisers need to know

Every event collects personal information: names, emails, phone numbers, companies, dietary needs, sometimes ID numbers for access control. In South Africa, that means the Protection of Personal Information Act (POPIA) applies. Organisations have had to comply since 1 July 2021, and the Information Regulator enforces it.

Here is what it means in practice for event organisers.

Collect only what you need

POPIA expects you to collect personal information for a specific purpose and no more than that purpose needs. For most events that’s name, company, role, email and phone. Ask yourself before adding each field: what will we use this for? An ID number, for example, is only justified if the venue’s access control really needs it.

Tell people why, and get consent

On the registration form, say clearly who is collecting the information, what it will be used for, and who it will be shared with (for example, the venue or the caterer). Add a consent checkbox that is not ticked in advance. Keep a record of when each person agreed.

Take extra care with dietary and health information

POPIA treats some information as special personal information, including religious beliefs and health. Dietary requirements can reveal both: halaal or kosher can show a person’s religion, and allergies are health information. Ask only what the caterer needs, make sure the person has agreed, and share just the counts and names the caterer needs, not your whole guest list.

Marketing emails need permission

Using attendees’ details to send marketing by email, SMS or WhatsApp generally needs their consent, unless they are already your customers and you give them a way to opt out every time. Keep event communication (joining instructions, programme changes) separate from marketing, and use a separate, optional checkbox for marketing.

Photos and video

A photo in which someone can be identified is personal information. Tell guests at registration and at the venue that the event will be photographed and how the photos will be used. Give people who prefer not to be photographed an easy option, such as a different-coloured lanyard.

Share carefully with suppliers

When a supplier handles personal information on your behalf (for example, a registration company, caterer or shuttle service), POPIA calls them an operator, and you should have a written agreement that they keep it secure and use it only for your event. If information is stored or sent outside South Africa, for example on overseas cloud services, check that it’s protected to a similar standard.

Keep it secure, and don’t keep it forever

• Limit who on the team can see the guest list, and what they can do with it.
• Avoid passing spreadsheets around by email and WhatsApp, where copies multiply and can’t be taken back.
• Decide how long you’ll keep attendee information after the event, and delete or anonymise it after that.
• If information is lost or accessed by someone who shouldn’t have it, POPIA requires you to notify the Information Regulator and the people affected.

Let people see and correct their information

Attendees can ask what information you hold about them and ask you to correct or delete it. Have a contact address for these requests, and answer them promptly.