Table of Contents
Event organizers should not automatically share attendees’ personal data with sponsors. They need a lawful basis for processing and should clearly explain the purpose of sharing, what information will be shared, and how attendees can exercise their applicable rights.
So the answer is: Yes, event organizers may share attendee data with sponsors in certain circumstances, but registration alone does not automatically give sponsors unrestricted access to attendee personal data.
What happens when an event sponsor asks for access to attendee information collected during registration?
Sponsors may want attendee details for networking, lead generation, follow-up communication, or marketing, but organizers need to consider how that information can be used and shared.
Attendee information collected during registration is personal data when it relates to an identifiable individual. Sharing that information with sponsors, therefore, needs to be considered carefully, based on the purpose of sharing, the applicable legal basis, and what attendees were told during registration.
The Digital Personal Data Protection Act, 2023 (DPDP Act) sets requirements for processing digital personal data, while the Digital Personal Data Protection Rules, 2025 provide additional requirements around notice, security, and other data-processing practices.
In this article, we’ll cover when attendee data can be shared with sponsors, what organizers should tell attendees, how consent applies, what sponsors can and cannot do with the data, and how organizers can manage sponsor data access responsibly.
Table of Contents
Is It Possible to Share Attendee Data With Sponsors Under the DPDP Act?
Event organizers may be able to share attendee data with sponsors, but the answer depends on why the data is being shared, what data is involved, the applicable legal basis, and what attendees were told about the processing.
Section 4 of the Digital Personal Data Protection Act, 2023 (DPDP Act) states that personal data may be processed only for a lawful purpose and on the basis of consent or certain legitimate uses. Section 5 requires a notice to inform the Data Principal about the personal data being processed and the purpose for which it is proposed to be processed.
For example, an organizer collecting an attendee’s name and email address to complete event registration cannot simply assume that the same information can be provided to every sponsor for their own marketing activities.
Note: The sponsor’s intended use needs to be considered separately. The purpose, data being shared, and information provided to attendees should all align with the applicable requirements of the DPDP Act.
What Does the DPDP Act Mean for Sponsor Data Sharing?
The first question should be: Why does the sponsor need the attendee data?
Different purposes can require different approaches.
| Sponsor use | Example | Data-sharing approach |
| Networking | Connecting attendees with exhibitors | Explain the purpose and provide an appropriate choice |
| Lead generation | Sponsor follows up with interested attendees | Obtain appropriate consent where required |
| Event communication | Sending information about a sponsored session | Use data only for the defined purpose |
| Marketing | Promotional emails after the event | Should not be assumed from event registration |
| Event analytics | Understanding attendee demographics or participation | Consider whether aggregated data can be used instead |
| Prize or giveaway | Contacting a winner | Collect and share only the information needed for that purpose |
The key principle is that sponsor access should be linked to a defined purpose rather than treated as a blanket right to attendee information.
Does Registering for an Event Mean Attendees Agree to Sponsor Contact?
Not automatically.
The DPDP Act states that consent must be specific, informed, unconditional and unambiguous, with clear affirmative action, and must relate to the specified purpose.
Therefore, an organizer should avoid hiding sponsor data sharing inside a broad statement such as:
“By registering, you agree to receive communications from our partners and sponsors.”
A clearer approach is to explain the relevant purpose and give attendees an appropriate choice where consent is the applicable basis.
For example:
☐ I agree to share my name, email address, and company name with participating sponsors for networking and follow-up communication.
Important Note: The exact wording should reflect the actual processing arrangement and applicable legal basis.
What Should Your Registration Form Tell Attendees?
The registration notice is particularly important when sponsor-related data sharing is involved.
Rule 3 of the DPDP Rules requires the notice to provide an itemised description of the personal data being processed and the specific purpose or purposes of processing. It also requires a specific description of the goods, services, or uses enabled by that processing.
For sponsor-related processing, organizers should therefore consider explaining:
- What attendee information may be shared
- Why will it be shared
- What sponsors will use it for
- Whether the sharing is optional
- How attendees can exercise applicable rights
- How can consent be withdrawn
The explanation should be understandable before the attendee submits the registration form.
For broader guidance on event registration data collection, organizers should review each registration field and its purpose before deciding whether sponsor access is appropriate.
Should Organizers Share All Attendee Data With Sponsors?
A simple and clear answer is no.
Sponsors generally do not need unrestricted access to the complete registration database.
For example, a sponsor may need a name and email address to follow up with attendees who specifically opted into sponsor communication. Giving that sponsor additional information such as a residential address, dietary preference, accessibility information, or other unrelated registration details would require a separate and clearly defined purpose.
Organizers should therefore use data minimization when deciding what to share.
A useful question is:
What is the minimum information this sponsor needs to achieve the stated purpose?
If aggregated or anonymized event insights can meet the sponsor’s requirements, sharing individual-level information may not be necessary.
Can Sponsors Use Attendee Data for Their Own Marketing?
This requires particular care.
If an attendee agrees to receive communication from a specific sponsor or agrees to a clearly described sponsor-related purpose, that consent should be reflected accurately in the data-sharing process.
Organizers should not assume that a general event-registration consent automatically allows every sponsor to use attendee information for their independent marketing activities.
The DPDP Act also provides that where consent is the basis for processing, a Data Principal can withdraw that consent, and the Data Fiduciary must stop processing and cause its Data Processors to stop processing within a reasonable time, subject to applicable legal requirements.
Who Is Responsible When a Sponsor Receives Attendee Data?
Organizers need to understand the roles of the parties involved.
The DPDP Act defines a Data Fiduciary as the person who determines the purpose and means of processing personal data. A Data Processor processes personal data on behalf of a Data Fiduciary.
A sponsor may not automatically be a Data Processor simply because it receives attendee information. Its role depends on how the data is being processed and who determines the purpose and means of that processing.
This distinction matters because the organizer should know:
- Who determines why the data is being used
- Who receives the information
- What each party is permitted to do with it
- Whether a contractual arrangement is required
- How will the data be protected
- What happens when the data is no longer required.
What Should Organizers Include in Sponsor Agreements?
Sponsor agreements should clearly define each party’s data-related responsibilities when personal data is shared.
Depending on the arrangement, the agreement may address:
- Permitted data fields
- Purpose of processing
- Permitted uses
- Security responsibilities
- Access controls
- Restrictions on further sharing
- Retention and deletion
- Handling of attendee requests
- Data breach responsibilities
The DPDP framework places responsibility on Data Fiduciaries for processing carried out by them or on their behalf by Data Processors, including appropriate contractual arrangements and security safeguards where applicable.
How Can Event Technology Help Manage Sponsor Data Sharing?
The technology used to collect and manage registration information can help organizers control which attendee fields are available to different users.
Good event technology for attendee data management should provide appropriate access controls, configurable registration fields, consent records, data export controls, and clear separation between organizer and sponsor access.
A reliable event tech solution provider such as Dreamcast can also reduce unnecessary movement of attendee information between multiple systems. For example, a platform supporting registration, ticketing, badge printing and check-in can keep these processes connected while allowing organizers to determine which information is available for each operational purpose.
Note: Technology does not replace the organizer’s responsibility to determine the lawful purpose for processing or decide what information should be shared.
What If an Attendee Withdraws Consent?
Where consent is the basis for processing, attendees have the right to withdraw consent.
In simple words: If a company or organization is using attendees’ personal information because the attendees gave them permission (consent), they can change their minds and take back that permission at any time.
For example:
- Attendees agree to receive promotional emails by giving consent.
- Later, they decide they don’t want them.
- They can withdraw their consent, and the organizer or sponsor should stop processing their information based on that consent.
The DPDP Act states that consent withdrawal should be as easy as giving consent. Once consent is withdrawn, the Data Fiduciary must stop, and cause its Data Processors to stop, processing the data within a reasonable time, unless processing is otherwise required or authorized under applicable law.
Organizers should therefore have a process for updating sponsor-related consent and communicating relevant changes to parties processing the data.
DPDP Sponsor Data-Sharing Checklist
Before sharing attendee information with sponsors:
- Define the exact purpose of sharing
- Identify the specific data fields required
- Check the applicable legal basis
- Inform attendees clearly
- Obtain appropriate consent where required
- Keep sponsor access limited to necessary data
- Consider aggregated data as an alternative
- Define sponsor responsibilities in agreements
- Apply appropriate access and security controls
- Maintain a process for withdrawal and attendee rights
Final Words
Sponsor access to attendee data should be treated as a specific data-processing activity, not as an automatic benefit of sponsorship.
Organizers should define the purpose, collect only the information needed, explain the sharing clearly, obtain appropriate consent where required, and control how sponsors access and use attendee information.
For a broader understanding of the legal framework, see our guide to the DPDP Act 2025 for events.
FAQs
No. Sponsor access should be based on a defined and lawful purpose. Registration by itself does not automatically give every sponsor unrestricted access to attendee personal data.
Potentially, depending on the purpose, applicable legal basis, notice and consent requirements. Organizers should first determine why the sponsor needs the names and whether sharing them is necessary.
They may be able to do so where the relevant processing is lawfully permitted and attendees have been appropriately informed. Marketing or follow-up should not simply be assumed from general event registration.
Yes. If attendee information may be shared with sponsors, the registration notice should clearly explain the relevant personal data and purpose, with an appropriate choice where consent is required.
Simplify Event Planning Hassle-Free
