To handle attendee data privacy for an event app in India, map what you collect and why, collect less, put a privacy policy in front of login, limit who can see and export data, agree retention and deletion in writing and prepare for requests. This is practical guidance, not legal advice.
The legal context in one paragraph
India’s Digital Personal Data Protection Act received assent on 11 August 2023. Commencement is phased: Data Protection Board provisions from 13 November 2025, further provisions from 13 November 2026, and all remaining provisions by 13 May 2027 (Wikipedia summary of the Act, 2025). Today is 19 October 2026, so the next phase is weeks away. Your counsel can tell you which obligations apply to your organisation, in what role, and from when. What follows is a working method that makes those conversations easier, because every step produces a record.
Sociana does not display certification badges, and you should be wary of any vendor who displays a certificate they cannot show you. Ask for specifics: where data is stored, how long it is kept, how deletion works, who the sub-processors are and how incidents are handled. Our trust pages describe what we do.
Step 1: map the data you collect
Open a spreadsheet and list every piece of personal data the event touches. For each, write four things: what it is, why you need it, who sees it and how long you will keep it.
| Data | Why | Who sees it | Retention |
|---|---|---|---|
| Name, mobile, email | Login, communication | Organisers, desk | Agreed period after event |
| Designation, city, zone | Groups, reports | Organisers | Agreed period |
| Travel and ID documents | Hospitality, security | Hospitality team only | Shortest workable |
| Dietary or health declarations | Catering, safety | Named staff | Shortest workable |
| Photos and selfies | Gallery, finder | Participants, organisers | Per consent |
If you cannot justify a row, delete it.
Step 2: collect less
Every field you ask for is a field you must protect. Ask only for what the event needs. For a conference, name, number, email and designation may be enough. For a conclave with hospitality, you may need travel and ID details; collect them in a dedicated hospitality form with stricter access, not in a general registration form.
Mark each field as required or optional and say why. Consider whether a code or ID can replace a more sensitive identifier.
Step 3: put the privacy policy in front of login
An occasion can place a Privacy Policy in front of the code step, so a participant must read and accept it before they enter. Write the policy for participants in plain language: what you collect, what for, who sees it, how long you keep it, how to ask questions and how to have data removed. Link to a fuller policy for those who want it.
Keep the acceptance record. If someone later asks what they agreed to, you can show the text and the date.
Step 4: control who can see what
Within the app, roles matter. An Owner has everything inside the occasion, a Manager does a defined subset and a guest sees only guest screens. Admin tools appear only for those roles. In the admin panel, roles scope access by organisation and occasion, and activity logs record who changed what.
Apply least privilege. Give the desk access to what the desk needs, the hospitality team to hospitality data and no one to everything, except a small number of named people. Review the list before the event and again after.
Step 5: limit what leaves the app
Exports are the main route by which data escapes. Only roles with report permission can export participant data. Decide who those are, and keep a log of exports. If you push data to a Google Sheet, own the sheet through an organisational account and share it with named people only. Do not send full participant lists by email or WhatsApp.
Where a partner such as a hotel needs data, share only the rows they need, for the time they need them.
Step 6: set retention and deletion before the event
Decide how long each category is kept after the event and write it down. Travel and ID documents should be kept for the shortest workable period; photos depend on consent. Plan the deletion step: who does it, when, and how you confirm. A deletion flow exists for accounts, but you still need an organisational process for exports, sheets and email attachments that sit outside the app.
Step 7: prepare for requests and incidents
Someone will ask what you hold about them, or ask you to delete it. Name a contact, publish an email address and agree a reply time. Prepare a short incident plan too: who decides, who informs affected people and who informs the vendor. Rehearse it once.
Step 8: brief the team
Most privacy incidents are human: a screenshot of a guest list posted to a WhatsApp group, a spreadsheet emailed to the wrong person, a shoulder-surfed phone at the desk. Give the team a one-page rule sheet: do not share lists, do not screenshot records, lock your phone, report errors immediately.
What this does not replace
This is a workflow, not a compliance programme. The Act has other elements, including notice, security safeguards, children’s data and the roles of fiduciary and processor, and your counsel should advise on these. If your audience includes minors, public officials or people in sensitive roles, take advice early.
How Sociana handles this
OTP login can place a Privacy Policy before the code step. Member imports and profile fields let you choose which fields to ask for, and the registration file stays the source of truth when the confirmation step is on. The admin panel and roles scope access and keep activity logs. Reports and exports restrict participant-data exports to roles with report permission. Sociana does not hold SOC 2 or ISO 27001 certification, and does not offer SAML single sign-on.
Unstoppable NAMI 2026 had participants accept a privacy policy at login, and collected employee code, city and zone at registration. The APMI conference kept its registration list as the whitelist so unregistered numbers saw Access Not Available. See the APMI case study and the Unstoppable NAMI 2026 case study.
Frequently asked questions
Do I need a privacy policy for a one-day event app?
Treat it as yes. A short policy that says what you collect and why is a courtesy to guests and a record for you. Ask your counsel for the exact requirements.
Is a guest list personal data?
Names, numbers and emails identify people, so handle them as personal data. Share the list only with those who need it.
How long should we keep attendee data?
As short as the purpose allows. Agree the periods per category before the event and write them down.
What if a guest asks to delete their data?
Have a named contact and a process. Remove the account, and clear their data from exports and sheets you control.
Related reading
Glossary: whitelist, super admin, owner and manager roles, registration review. Occasion hubs: conferences, association events and corporate annual meets. See templates and checklists for a data-mapping sheet.