15.7 Global Data Privacy Regulations: Scope and Lawful Processing

Global Data Privacy Regulations: Scope and Lawful Processing

General Data Protection Regulation (GDPR)

Determine territorial scope before applying a checklist. GDPR may apply to processing in the context of an EU establishment, or to a non-EU organisation offering goods or services to people in the Union or monitoring their behaviour there. Citizenship or one unsolicited registration alone does not settle the territorial test. Document the analysis with the privacy lead.

For covered processing, identify the controller, purposes, categories of data and lawful basis. Consent is one basis; contract or legitimate interests may be relevant to some activities. Do not ask people to “consent” to every necessary operational term. If relying on consent, make it freely given, specific, informed and unambiguous, with an affirmative action and an easy withdrawal process. Separate unrelated optional purposes, including sponsor marketing, from event participation. Sensitive data and biometric identification need additional analysis.

Collect only what is needed and give a clear notice about recipients, retention, transfers and rights. Apply processor agreements where the vendor acts on the controller’s instructions; a supplier acting for its own purposes may instead be a separate controller. Verify roles rather than assigning every technology vendor the same label.

Rights requests normally require a response without undue delay and within one month, with permitted extensions and conditions. Erasure is not absolute: legal obligations and other exceptions can require retention. Record the request, verify identity appropriately, coordinate connected systems and explain any lawful restriction. Cross-border transfers require the applicable safeguards; choosing an overseas cloud platform does not by itself satisfy them.

California Consumer Privacy Act (CCPA / CPRA)

Assess whether the organiser is a covered business under the statutory scope and thresholds. The CCPA does not automatically apply to every event with a California participant. Covered businesses must provide required notices and honour applicable rights, including opt-out of sale or sharing. “Sale” can involve valuable consideration; statutory “sharing” concerns cross-context behavioural advertising. Analyse the actual sponsor data arrangement and exceptions before classifying it. If applicable, provide the required choice mechanisms and honour valid opt-out preference signals.

Consent, notice, contract terms, data minimisation and sale/share opt-outs perform different functions. Keep a data-flow register showing what moves from registration to the app, CRM, badge service and sponsors, the purpose of each transfer, responsible party, lawful authority and deletion process. Review defaults and sample exports before launch. A sponsor’s commercial request never overrides an attendee’s applicable rights.

Attendee Media Consent and Photography Policies

Events frequently photograph and record educational sessions, award banquets, and exhibition halls for promotional, commercial, and educational distribution. Planners must formalize photography and recording consent protocols:

• Notice and lawful basis: Explain recording purposes, where material will appear, retention and applicable choices before registration and again on site. A sign stating that entry equals consent is not automatically valid consent under every law.
• Practical alternatives: Offer a clear way to request no recording and communicate it respectfully to authorised photographers. A lanyard or seating zone can support the process but is not a guarantee, and avoid exposing sensitive reasons for a choice.
• Speaker and audience rights: Obtain the necessary speaker licences and assess rights for close-ups, testimonials, minors and commercial use separately. Train camera operators, plan camera-free areas where feasible and provide a contact for concerns.

---

Cybersecurity and Financial Compliance (PCI-DSS)

Events represent prime targets for cyber criminals due to rapid transaction volumes, transient Wi-Fi networks, and high concentrations of corporate executives and payment card transactions.

Payment Card Industry Data Security Standard (PCI-DSS)

Any organization that accepts, transmits, or processes credit card payments must strictly adhere to the Payment Card Industry Data Security Standard (PCI-DSS) established by major credit card brands.

• Scope Reduction via Hosted Payment Fields and Tokenization: Event organizers should never store, process, or transmit raw credit card primary account numbers (PAN) or CVV security codes on their own servers or local event databases. Doing so subjects the organization to the highest, most onerous PCI-DSS Level 1 compliance audits (requiring hundreds of complex security controls and penetration testing).
• Instead, registration engines deploy Hosted Payment iFrames or Hosted Fields managed directly by certified Level 1 payment processors (such as Stripe, Authorize.Net, or CyberSource). The attendee enters their credit card directly into an encrypted, isolated browser frame served from the processor's secure vault. The event platform receives only a secure, one-way alphanumeric token representing the transaction. This reduces the event organizer's compliance scope to the simplified Self-Assessment Questionnaire A (SAQ-A).

Protecting Attendee Personally Identifiable Information (PII)

• Encryption: Use supported, appropriately configured transport and storage protection selected by the security team. A universal TLS 1.3-only or AES-256-only CMP rule does not exist; configuration, key management, access and applicable requirements matter.
• Access: Use unique accounts, least privilege and appropriate multi-factor authentication for administrative access. Review access before the event and revoke temporary permissions afterwards.
• Vendors: Check service responsibilities, evidence, backups, recovery and incident contacts. A security badge or tokenisation claim does not eliminate the organiser’s remaining obligations.

Cyber Incident Response Planning

Despite robust defenses, organizations must prepare for potential data breaches, ransomware attacks, or unauthorized data exposures. A formalized Cyber Incident Response Plan establishes four critical operational phases:

1. Activate response: Notify the security and privacy leads, preserve evidence and use the incident plan. Authorised technical responders choose safe containment steps; untrained staff should not disconnect critical safety systems.
2. Assess: Identify the affected people, data, systems, timing and likely consequences. Coordinate processors, legal advisers, the acquirer and insurers as appropriate.
3. Notify where required: Under GDPR, notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to pose a risk to rights and freedoms. Communication to affected people generally applies where high risk is likely, subject to exceptions. Other jurisdictions have different triggers and deadlines.
4. Recover and improve: Restore verified services, record decisions and follow-up, address causes and test the revised controls.

Sources checked October 16, 2026

EDPB small-business data-protection guide; California privacy rights