Retaining and deleting attendee data after a conference

After a conference, you may still need some attendee data for follow-up, financial administration or accreditation. Other information can be deleted. Deciding in advance what you need for each purpose, and for how long, helps you complete the work properly and prepare for the next edition.

The final session is over. The conference office is answering questions, the finance team is processing payments and the programme committee is reviewing feedback. Each team needs different information. Clear responsibilities help you avoid circulating the full attendee list for every task.

Define the purpose and retention period in advance

There is no single retention period for all conference attendee data. Under the GDPR, personal data must not be kept longer than necessary for its purpose, taking account of any legal obligations. This forms part of the GDPR principles explained by the European Commission.

Create a straightforward retention schedule when setting up registration. For each type of data, record the purpose, lawful basis, retention period or deletion criterion, and the person responsible. Agree this with the person responsible for privacy in your organisation. At registration, give attendees clear information about how their data will be used and how long it will be kept.

Separate administrative records from temporary information

Invoices and payment records may be subject to statutory retention requirements. Ask the finance team to identify which documents are needed. Those requirements do not mean you also need to keep dietary requests or every session choice in the same archive.

For accreditation, check the conditions of the relevant scheme. Establish which attendance records and supporting documents are required, who receives them and how long they must be retained. Registering for a session is different from having attendance confirmed.

Dietary requests, accessibility requirements and transport choices generally serve the delivery of this edition. Delete them once that purpose and any necessary follow-up are complete. Information that reveals something about a person's health particularly calls for restricted access and a carefully chosen retention period.

Make separate arrangements for future invitations

Establish separately whether you may use contact details for another invitation. Consent to storing data does not automatically authorise promotional email. Where required, ask for specific consent to these invitations and make unsubscribing easy. In the Netherlands, an exception may apply to existing customers under certain conditions; establish in advance whether it applies to your situation.

Limit the invitation list to the information needed for that purpose. Keep communication preferences up to date and make sure a new import respects previous unsubscribes. Previous dietary requests, session choices and payment statuses should not automatically carry over to a new registration.

Plan the close of the event and include every copy

Assign one person to oversee the final tasks, with each team completing its own responsibilities. A review shortly after the conference is a useful checkpoint. The retention period for each type of data determines when it is actually deleted; you do not have to delete everything on the same day.

During that review, check:

• Which attendee queries, payments or accreditation tasks remain open, and what data is needed to complete them.
• Which exports, shared files, email attachments and printed lists still exist, including those held by suppliers.
• Who still needs access to the archive and which temporary access permissions can end.
• Who carries out deletion, how it is confirmed, and what arrangements apply to backups and any restoration.

Include these arrangements in your agreements with data processors. Deleting a file from the registration platform alone does not address copies stored elsewhere.

Keep useful insights for the next programme

The programme committee can learn from attendance, interest in individual sessions and evaluation results. Wherever possible, prepare a summary without identifiable attendees. You can then discuss which topics deserve an additional session, for example, without continuing to use the full registration records.

Check whether people can still be identified through combinations of details or open-ended answers. Removing names alone does not make data anonymous. Keep any individual supporting records needed for accreditation separate from the committee's summary.

Put your arrangements into practice in registration

Activo helps you plan the practical setup of attendee registration and the work after the event. The Medical Conference Platform brings together functions including registration, payment and attendance recording. Discuss the reports you need and how your retention and deletion arrangements will be carried out. This gives the conference office and committee a clear division of responsibilities.

Frequently asked questions about attendee data