Table of Contents
Table of Contents
TL;DR
- Event check-in can involve the processing of names, registration details, QR credentials, badge information, access permissions, and attendance records.
- Organizers should have a clear purpose for collecting and using attendee data and provide appropriate notice about how it is processed.
- Check-in staff and vendors should only have access to the information required for their role.
- Badge printing, QR scanning, access control, and attendance tracking should be designed to minimize unnecessary exposure of personal data.
- Data protection should continue after the event, including appropriate retention, access control, and deletion practices.
Event organizers should protect attendee data during check-in by limiting the information collected and displayed, restricting access to authorized personnel, securing check-in systems and devices, and having a clear approach to data retention. A QR scan or badge print may look like a simple operational task, but these activities can involve personal data when they are connected to an identifiable attendee. Organizers therefore need to consider not only how quickly someone can enter the venue, but also what information the check-in process exposes and who can access it.
Introduction
What happens to attendee data when someone scans a QR code at an event check-in desk?
The system may retrieve and process information such as the attendee’s name, registration status, ticket category, company, badge details, or access permissions. This means event check-in can involve personal data processing, making data protection an important part of the attendee entry process.
The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 provide requirements that organizers should consider when handling digital personal data.
This is why DPDP and event registration data should not be treated as separate concerns. The information collected during registration may continue to be used when attendees check in, receive badges, or access different areas of the event.
In this article, we’ll cover what attendee data may be processed during check-in, how organizers can limit access, protect QR codes and badges, manage data after the event, and use event technology responsibly.
What Attendee Data Can Be Used During Event Check-In?
The information required at check-in varies from one event to another.
A conference may only need an attendee’s name, registration ID, ticket type, and access status. An exhibition may need additional information for exhibitors, speakers, VIPs, or media. A high-security event may have additional identity-verification requirements.
Common examples of information that may be involved include:
| Check-in activity | Information that may be involved |
| QR code scanning | Registration ID or attendee identifier |
| Badge printing | Name, company, designation, photo |
| Registration verification | Registration status and ticket category |
| Access management | Entry permission and access category |
| Session attendance | Session participation record |
| Onsite registration | Name, contact details, and registration information |
The important point is that not every piece of registration information needs to be available at check-in.
For example, a staff member verifying a QR credential may only need to know whether the attendee is registered and what access they are entitled to.
Note: Giving that employee access to the attendee’s full contact information or unrelated registration fields may serve no operational purpose.
Does Scanning an Attendee’s QR Code Involve Personal Data?
The answer depends on how the QR code and the associated system are configured.
A QR code is simply a machine-readable format. But when scanning, it retrieves or verifies information associated with an identifiable attendee, and the surrounding activity can involve processing personal data.
Consider a conference attendee who receives a QR credential after registering. At the venue, the QR code is scanned, and the system confirms the attendee’s registration. The system may then record the person’s entry and trigger badge printing.
The organizer should therefore consider the entire data-processing activity rather than treating the QR code as an isolated technical feature.
The same principle applies to digital badges, mobile credentials, kiosks, and other check-in methods. The technology may change, but the organizer still needs to understand what information is being processed and why.
What Does the DPDP Act Mean for Event Check-In?
The DPDP Act requires personal data to be processed for a lawful purpose and provides for processing based on consent or certain legitimate uses. It also establishes requirements relating to notice, consent, security safeguards, rights, and responsibilities.
This matters because the purpose established when an attendee registers should not be ignored once they arrive at the venue.
For example, an organizer may collect an attendee’s name and email address to register them for an event. At check-in, the organizer may need the name and registration status to verify entry. That does not automatically mean every staff member should have access to the attendee’s entire registration profile.
Organizers should consider what information is actually required for each activity and whether the processing is consistent with the applicable legal basis and the information provided to attendees.
The DPDP Rules 2025, also introduce more specific notice requirements, including providing information about the personal data being processed and the purpose for processing it.
Organizers should therefore review registration and check-in practices together rather than treating them as completely separate processes.
How Much Attendee Data Should Be Visible at Check-In?
A useful question for organizers is simple:
Does the person performing this task actually need to see this information?
A check-in operator may need an attendee’s name, registration status, ticket category, or access permission. They may not need to see an email address, phone number, payment information, or other registration details.
The same principle can be applied to event badges.
A badge might need to show the attendee’s name and company so that other participants can identify them. Depending on the event, a designation, attendee category, or access indicator may also be useful. Other personal information may have no reason to appear publicly.
Reducing visible information also reduces the consequences of accidental exposure. At a busy registration desk, screens can be seen by nearby attendees, temporary staff, vendors, or other people moving through the area.
Who Should Be Able to Access Attendee Data at the Venue?
Event teams often involve several groups in check-in and access management. They should not necessarily have identical access to attendee records.
A registration manager may require broader visibility to resolve attendee issues. A QR scanning operator may only need enough information to confirm entry. A badge-printing operator needs the fields required to generate the credential. Security personnel may need to confirm access permission without viewing unrelated registration information.
Role-based access can help organizers make these distinctions.
It also becomes important when external technology providers or temporary event staff are involved. Before the event, organizers should know which parties can access attendee information, what they are expected to do with it, and whether they are processing the data on the organizer’s behalf.
What Should Organizers Consider When Printing Attendee Badges?
Badge printing creates another point where attendee information can be exposed.
Organizers should decide in advance what information needs to appear on the badge and whether all attendees need the same fields. They should also consider how the team handles failed prints, duplicate badges, and replacement badges.
For example, if a badge containing an attendee’s name and company is printed incorrectly, leaving it beside the printer creates an unnecessary exposure. A controlled process for handling rejected badges is a small operational measure, but it can make a difference when hundreds or thousands of badges are produced onsite.
Replacement badges also deserve attention. Staff should have a way to verify the attendee before issuing a new credential and, where applicable, manage the previous badge or access credential.
How Should Organizers Manage Check-In Data After the Event?
Data protection does not end when the last attendee leaves the venue.
Check-in information may remain in the registration platform, access-control system, event app, reporting tools, or exported files. Some records may be useful for legitimate reporting or operational purposes, while others may no longer be necessary.
Organizers should therefore establish a clear retention approach before the event.
Instead of keeping every record indefinitely, ask:
- Why is this information still needed?
- Who needs access after the event?
- Has the data been exported to another system?
- Are duplicate copies still being stored?
- When should information that is no longer required be deleted?
The answer will depend on the purpose, applicable legal requirements, and the organizer’s specific circumstances. What matters is that retention is a deliberate decision rather than the default setting of a technology platform.
How Can Event Technology Support Better Attendee Data Protection?
The way event technology is configured can affect how widely attendee information is exposed.
DPDP and event technology platforms should therefore be considered together when designing the registration and check-in experience.
An integrated event technology platform such as Dreamcast can connect registration, digital credentials, QR verification, badge printing, check-in, and access management without requiring organizers to repeatedly move attendee lists between separate systems. Having multiple activities within a connected event technology workflow can reduce unnecessary data transfers between multiple systems and vendors.
Useful capabilities can include role-based access, configurable registration fields, controlled badge printing, QR-based verification, access permissions, and centralized attendance records.
Note: However, technology does not by itself determine whether an organization’s data practices meet the DPDP Act. Organizers remain responsible for deciding why personal data is processed, what information is collected, who receives access, and how the information is retained.
What Should Organizers Review Before the Event?
A short data-protection review before the event can identify problems while there is still time to fix them.
Organizers should check whether:
- Staff only see the information required for their role.
- Registration and check-in notices accurately describe relevant processing.
- Badge designs avoid unnecessary personal information.
- QR credentials cannot be easily misused.
- Check-in devices and staff accounts are properly secured.
- External vendors have clearly defined responsibilities.
- Reprint and lost-badge procedures are controlled.
- Attendance records have a defined retention approach.
- Unnecessary exports and duplicate attendee files are avoided.
- There is a process for handling applicable attendee rights and consent withdrawal.
These checks are particularly important for large events, where a small process gap can affect thousands of attendee records.
Conclusion
Event check-in is more than a way to move attendees through the venue quickly. It can involve the processing of personal data, so organizers should limit data collection, control access, secure check-in systems, and review how attendee information is retained after the event. A well-planned check-in process can support both a smoother attendee experience and more responsible data management.
Disclaimer: This article provides general information and should not be considered legal advice. Organizers should assess their specific data-processing activities and seek qualified legal guidance where necessary.
FAQs
The DPDP Act provides a framework for processing digital personal data, so organizers should consider its requirements when attendee information is processed through digital registration, QR check-in, access control, or attendance systems.
A QR code is not automatically personal data simply because it is a QR code. However, when it is linked to an identifiable attendee and used to retrieve or verify their information, the associated processing can involve personal data.
They do not necessarily need to. Organizers should consider limiting access to the information required for each staff member’s role.
That depends on the event’s purpose. Names, companies, designations, photos, or access categories may be useful, but organizers should avoid displaying unnecessary personal information.
They should determine which records are still required, restrict unnecessary access, and retain or delete information according to applicable requirements and the defined purpose for processing.
Technology can provide tools such as access controls, configurable data fields, digital credentials, QR verification, and centralized attendee records. These features can support better data management, but organizers remain responsible for their own data-processing practices.
