What should an event team do after an attendee data breach?

Someone sends your event inbox a screenshot of an attendee spreadsheet they should never have seen. Doors open tomorrow, your production manager wants a decision, and nobody knows whether the file contains only ticket names or the access requests people sent you privately.

The first thing you want to do is stop further exposure while preserving the evidence that will tell you what happened. Put one person in charge, establish whose information is affected, assess the harm to those people, and make the reporting and attendee notification decisions under the laws that actually apply. You don't need every answer before taking protective action.

This guide walks through an event data breach response, including supplier coordination, UK, EU, Australian and US reporting considerations, attendee messages and the decision to resume normal operations. The legal references are starting points for your adviser, checked in October 2026. They aren't a substitute for advice on your incident, and other countries or sector rules may apply.

Put someone in charge before everyone starts fixing things

You need a person who can make decisions about the response and get help quickly. For a small event business, that may be the owner. For a larger operator, it may be a senior manager working with your privacy adviser and technical lead. Make the assignment explicit so your venue, ticketing provider and support staff know where to send information.

Give that person a deputy. An incident that starts during a soundcheck can continue through the night, and the person managing the response still needs to sleep. Agree how decisions will pass between them and where the current facts are recorded. Avoid making an exhausted founder the only person who knows which supplier has replied.

Separate the work by responsibility. Someone investigates the systems and contains access. Someone assesses privacy obligations and contacts the relevant adviser. Someone prepares attendee communications and briefs support. One person may cover several jobs, but each decision still needs an owner. Your social media manager shouldn't have to decide whether a regulator must be notified.

Use a communication route you have reason to trust. If the incident involves your email account, continuing to discuss passwords and affected people in that account may disclose more information. Ask your technical specialist to establish a suitable alternative. Verify urgent supplier calls using contact details you already hold, rather than numbers supplied in a suspicious message.

Open an incident record immediately. Record who raised the concern, when they raised it, what they observed, the systems involved and what you did next. Use dates, times and time zones. Keep observations separate from conclusions. "A recipient showed us the file" is evidence. "Only one person saw it" is a conclusion that needs more support.

You also need someone keeping the event running. If the same manager must investigate a breach and supervise admission, both jobs can suffer. Assign operational cover and identify which event decisions need the response lead's approval, including any workaround that collects or shares attendee information.

Stop further exposure and preserve what happened

Containment depends on the incident. A publicly accessible document may need its sharing permissions removed. A compromised staff account may need its sessions revoked and access secured. A lost device may require action through its management tools. Get the appropriate specialist involved so the action stops the exposure without unnecessarily destroying evidence.

Don't ask a well meaning staff member to wipe a laptop or delete a mailbox because it feels decisive. Those records may show when access began, what was opened and whether an attacker changed anything else. Equally, don't leave an active disclosure running while everyone debates the ideal evidence collection process. Have the technical lead coordinate both tasks.

The OAIC's guidance on responding to data breaches advises immediate containment and warns against destroying evidence. It also explains that containment, assessment and notification may happen together or in quick succession. That matters when an attendee needs to act before your investigation is complete.

For an exposed attendee file, establish where the original lives, how it was shared and which copies exist. Remove access through the original route, preserve the relevant sharing and activity records, and ask the service provider what its logs can establish. A screenshot of a permission setting after you changed it won't prove what the setting was beforehand.

If an unintended recipient contacts you, use a verified route to explain what happened and request appropriate deletion and confirmation. Ask whether they opened, downloaded or forwarded the material. Preserve their response. Their cooperation is useful evidence, but it doesn't automatically establish that no other person accessed the file.

Keep the investigation material restricted. You don't need to attach the leaked spreadsheet to every supplier email to explain the problem. Refer to the file through the secured investigation process and share only what each specialist needs. A response can create another disclosure if everyone starts forwarding the original evidence around.

Find out whose information was actually affected

A breach isn't limited to a hacker stealing a database. The ICO's personal data breach guide includes accidental disclosure, unauthorized changes, lost information and certain losses of availability. An altered admission list or inaccessible access arrangements can matter even when nobody has published a file online.

Start with the affected activity. Was this the ticketing account, an exported door list, a sponsor lead file, an accommodation request or an email conversation? Trace the information through that activity instead of assuming the entire audience database was involved. Also check whether records for previous events were in the same location.

List the actual fields. Names and email addresses are different from passwords, identity documents, payment details or health information. Booking references, ticket codes, seating details and private correspondence may create their own risks. Don't summarize a mixed file as "basic contact information" because the first columns happen to contain names and emails.

Count people separately from rows. One buyer may appear in several orders, and a group booking may contain guests whose details differ from the purchaser's. Preserve an honest estimate while the team checks duplicates. If your first report uses an approximate number, say so and record how you calculated it.

Then establish the period of exposure. Record when unauthorized access may have become possible, when you detected it and when you stopped it. Identify gaps in the evidence. If the provider retains only limited activity logs, explain that limitation in the record rather than treating missing logs as confirmation that nobody accessed the information.

Consider a fictional conference where the production team accidentally shares its full working file with an exhibitor. The exhibitor expected company names for badge printing. The file also contains attendee emails, ticket references and a separate tab of assistance requests. Your assessment needs to include every relevant tab and attachment, not merely the information the exhibitor says it wanted.

Your event privacy notice can help identify the uses and recipients you told buyers about. Compare it with the actual incident. The notice doesn't establish what happened, but a difference between the stated process and the working file can reveal another part of the investigation you need to check.

Get the supplier facts without handing over responsibility

When a provider reports a problem, ask for a factual account covering your event's information. A general security notice may describe an incident affecting many customers without establishing which of your records were involved. Request the affected services, data categories, exposure period, containment actions, evidence available and the contact handling further updates.

Ask when the provider became aware and when it informed you. Preserve the original notification and subsequent changes to it. If the provider's assessment moves from "possibly affected" to "confirmed affected," you need to understand the evidence behind that change and reassess your own decisions promptly.

Check the legal roles for the particular activity. Under EU GDPR, a controller decides the purposes and means of processing, while a processor handles information on the controller's behalf. Articles 4 and 33 of the regulation explain those roles and require a processor to notify its controller of a personal data breach without undue delay. A service contract may set additional operational requirements.

Your business may be the controller for attendee administration while another business controls a separate use. Don't assume every supplier is a processor, or that the ticketing provider's response covers your duties. Have your adviser check the activity, terms and applicable law. Joint arrangements require coordination as well.

Agree who will contact attendees about which facts. Two businesses sending contradictory messages can leave people unable to tell what happened or which action to take. Coordination should improve accuracy and delivery; it shouldn't become a reason to wait indefinitely for a partner to approve a statement about your responsibilities.

Our guide to sharing attendee data with event suppliers covers the arrangements to establish before sending information. During an incident, use those agreements to locate contacts and records. If you discover that nobody agreed a response contact or notification process, fix the immediate coordination problem and record the contractual gap for later review.

Assess what the breach could do to people

The key question is what could happen to the affected person because of this incident. Your lost sales, management time and reputation matter to the business, but they don't replace the assessment of harm to attendees. A quiet social feed doesn't establish that a breach is harmless.

Work through the information, the recipient and the circumstances together. An email address connected to a large public trade show may create a different risk from an email address connected to a confidential support event. Details that seem ordinary in isolation can reveal something sensitive when combined with an event name or an access request.

Ask whether the information supports fraud, account access, unwanted contact, discrimination or a physical safety concern. Ticket codes may enable attempted misuse at admission. A known booking amount may make a fake refund request more convincing. An assistance note may reveal information the attendee deliberately shared with only a small operations team.

Consider who received it. A verified professional recipient who promptly reports an accidental disclosure and cooperates with deletion presents different evidence from an unknown person who advertises the file publicly. Neither the recipient's job title nor their reassurance alone settles the assessment. Record what you verified and what remains uncertain.

Check whether any protective measures actually worked. Encryption may change the risk if the information remains unreadable to unauthorized people, but establish whether the relevant keys were protected too. A password on an account won't help if the attacker used a valid signed in session. Ask for a technical explanation you can understand and record.

Protective actions should follow the risk. If usable ticket codes were exposed, assess replacement codes and how door staff will recognize the valid versions. If account credentials were involved, coordinate the appropriate account recovery steps. Don't tell every attendee to cancel a payment card when you haven't established that payment details were affected.

Write down the conclusion, its evidence, the reviewer and what would change the decision. The ICO requires a record of personal data breaches even when notification isn't required. Revisit that assessment when new facts arrive. An early, reasonable conclusion can become outdated when a provider discovers additional records or evidence of copying.

Record the decisions that the next shift will need

A useful incident record explains a decision well enough for someone else to take over. "Supplier contacted" tells the deputy very little. Record the contact, the question asked, the response received and what remains outstanding. Include the next follow up time so the person taking over knows when to chase it.

For a containment decision, record the affected account or file, the action authorized, who performed it and how they checked the result. For an attendee communication decision, record which people receive the message, which version was approved and who checked delivery. Link to evidence held in the restricted investigation location rather than copying it into several documents.

Record rejected options when they explain an important choice. If you kept a system available to preserve essential service while restricting access, explain the safeguards and specialist advice. If you rejected a proposed door workaround because it would expose private notes, record the alternative approved for staff. This makes the reasoning reviewable later.

Avoid turning the record into a transcript of every conversation. The response lead needs material facts, decisions and unfinished tasks, with enough supporting evidence to investigate further. Keep personal speculation about an employee's intentions out of the factual chronology. Establish what their account did and examine the working process before deciding why it happened.

At handover, the outgoing lead should walk the deputy through the current exposure, immediate attendee risks, notification status and pending evidence. Ask the deputy to identify the next decision in their own words. A shared folder helps, but it doesn't replace confirming that somebody has accepted responsibility for the work.

Apply the notification rules for each relevant jurisdiction

An international audience doesn't give you one universal reporting deadline. Ask your adviser which laws cover the organizer and the affected processing, which authorities are relevant and whether separate contractual or sector duties apply. Residence can matter, but a list of attendee countries alone won't settle every legal question.

Keep a notification record with the applicable rule, triggering event, decision owner, deadline and status. Include notifications to regulators, affected people and other required recipients separately. Record evidence of submission and delivery. A draft sitting in someone's email account isn't a submitted regulator report.

UK GDPR

For a breach covered by UK GDPR, assess the risk to people's rights and freedoms. The ICO's current reporting guidance says to notify it without undue delay and, where feasible, within 72 hours of becoming aware when a risk is likely. If you decide the risk is unlikely, document why notification isn't required.

The attendee threshold is different. Where the breach is likely to create a high risk to people's rights and freedoms, notify the affected people without undue delay. Don't interpret the regulator reporting period as permission to withhold an urgent protective warning from attendees who need it sooner.

If the reportable incident isn't fully understood, report the facts you have and supply additional information without undue delay. The ICO explicitly supports reporting early and updating later. Record the awareness time and have your adviser examine any uncertainty about when that threshold was reached. A weekend doesn't make the incident wait until Monday.

EU GDPR

For processing covered by EU GDPR, Article 33 requires notification to the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness, unless the breach is unlikely to result in a risk to people's rights and freedoms. Explain a delay when notification takes longer. Identify the competent authority rather than assuming your UK report covers the EU.

Article 34 generally requires communication to affected people without undue delay when a high risk is likely, with specified exceptions that need assessment. Articles 33 and 34 set out required information. Article 33 also allows information in phases without undue further delay when it cannot all be provided together. Have your adviser confirm the reporting arrangements for cross border processing.

Australia

For entities covered by Australia's Notifiable Data Breaches scheme, the question is whether an eligible data breach has occurred. The OAIC's explanation of notifiable breaches describes unauthorized access or disclosure, or loss in relevant circumstances, likely to cause serious harm. Effective remedial action can affect whether notification is required.

The assessment period isn't permission to delay notification. The OAIC's detailed scheme guidance requires all reasonable steps to complete assessment within 30 calendar days after awareness of grounds to suspect an eligible breach. Once reasonable grounds to believe it occurred exist, notify the Commissioner and people at risk of serious harm as soon as practicable. Don't wait for the assessment period to expire.

United States

Don't import the GDPR reporting period into a US incident. The FTC's data breach response guide directs businesses to check applicable federal and state requirements with legal advice. The relevant information, affected residents and type of business can change who must be notified, what the notice contains and when it is due.

Ask counsel to identify the actual rules and recipients for your incident. Payment arrangements, insurance terms and other contracts may also require contact. Reporting a suspected crime or contacting an insurer doesn't automatically satisfy attendee or regulator notification duties. Keep each obligation visible until someone verifies it has been met or records why it doesn't apply.

Tell attendees what they need to know and do

The attendee reading your message wants to understand what happened to their information and whether they need to act. Start there. Avoid opening with several paragraphs about how seriously your company takes security while postponing the facts people need.

Explain the incident in plain language, the information involved, the relevant dates as known, the likely consequences and what you've done or are doing. Provide a working contact and specific protective advice. Your adviser should check the required content for the applicable law. A reassuring tone can't compensate for missing information.

Be accurate about uncertainty. "We haven't found evidence that payment details were accessed" describes a current finding. "Your payment details are safe" makes a much wider promise. Use the narrower statement only when the investigation supports it, and explain what you are still checking if that uncertainty matters to the recipient.

Avoid giving attackers a convenient script. You can explain that attendees should be cautious about unexpected payment requests without publishing sensitive technical details or a fresh copy of the affected file. Use a known official contact route and explain how people can verify a message. Don't ask them to email identity documents to a newly created address.

Send the notice through a route you have checked for the incident. Verify the recipient list and prevent people seeing one another's addresses. Check how group bookings are handled so a buyer's message doesn't silently exclude an affected named guest. Where email isn't workable, assess an appropriate alternative with your adviser.

A hypothetical message about the conference file might explain that an attendee administration spreadsheet was shared with an unintended external recipient, identify the relevant fields and describe the containment already completed. It would distinguish confirmed facts from the ongoing investigation and give affected people a genuine contact route. The precise wording depends on the established facts and legal requirements.

Prepare support before the notice goes out. Staff need the approved facts, protective advice, escalation route and process for reporting suspected misuse. They also need permission to say they don't yet know an answer. Improvised certainty from a friendly support agent can contradict the notification and make the next update harder to explain.

Pause unrelated promotional messages where they would confuse the response or use an affected account. Nobody wants to receive a cheerful ticket upgrade offer immediately after being told their booking information was exposed. Your event communication plan should identify who can pause sends and who approves the next attendee update.

Check what happened after sending. An undelivered notice needs follow up through a suitable verified route. A support reply describing attempted fraud needs escalation into the investigation. Keep these reports connected to the incident, assess whether they change your advice, and update the affected people when necessary. Sending the first notice doesn't finish the communication job for you.

Decide whether the event can continue safely

A data breach doesn't automatically answer whether your event should proceed. You need a separate operational assessment based on the affected systems, available safeguards and consequences for attendees. The decision may differ for ticket sales, check in, access support and the show itself.

If the admission list was altered, establish how staff will verify valid tickets and resolve disputed bookings. If access arrangements are unavailable, confirm how the relevant team will provide agreed assistance without announcing private details at the entrance. Don't call an operation recovered simply because staff can sign into the system again.

Assess the fallback before using it. A replacement spreadsheet copied to several personal phones may restore a door list while creating more uncontrolled attendee copies. Decide which fields staff need, how they will access them and what happens to the temporary records afterwards. Brief the team on the approved process before opening.

Acknowledge what you cannot deliver. If you cannot verify ticket validity or safely provide a promised service, escalate that limitation to the person deciding event operations. Consider the relevant contractual and consumer obligations with your adviser. Don't let an optimistic technical update become an unsupported attendee promise.

Keep the operational decision in the incident record, including who approved it and what evidence they relied on. If new information changes the risk, revisit it. Continuing the event and continuing the investigation can happen together, provided someone remains responsible for both and urgent attendee protection doesn't depend on the show finishing.

Pay for the help the incident needs

An event budget rarely has spare money waiting for an investigation. You may need technical help, privacy advice, additional support cover or replacement ticket operations at the same time as production invoices fall due. Put someone in charge of approving those costs so urgent protective work doesn't stall in the normal purchase process.

If you have relevant insurance, contact the insurer through the established route and check the policy requirements promptly. Some arrangements specify how advisers or response services are appointed. Ask what applies before assuming a supplier you hire independently will be reimbursed. Preserve invoices and approvals without letting a coverage discussion postpone action that is immediately necessary.

Be clear about what you're buying from a specialist. Do you need help containing access, examining evidence, assessing legal duties or restoring operations? Agree the immediate task, responsible contact and next update. A broad promise to handle the incident can leave your team unsure who is actually submitting the regulator notification or checking attendee delivery.

Keep financial decisions separate from the assessment of harm. A message may be expensive to deliver, but that doesn't change whether the law requires it or whether attendees need protective advice. Equally, an expensive remedy isn't automatically useful. Choose support that addresses the information exposed and the actual risk to people.

Track the operational cost as you go, including extra staffing and interrupted work. You don't need to calculate the final loss before responding. You do need a reliable record for the insurer, your finance team and the later decision about preventing a repeat. Otherwise the cost disappears into overtime and emergency supplier bills without showing you what failed.

Verify recovery and change the process that failed

Before restoring normal access, ask the technical lead what caused the incident, which fixes are complete and how they were tested. Identify any uncertainty about continued unauthorized access. A password reset may be one useful action without resolving a compromised device, malicious mailbox rule or improperly shared export.

Verify the business process too. Can the intended staff access the right event records? Can former staff or the unintended recipient still access them? Do changed ticket codes behave correctly at check in? Test the relevant workflow with controlled records, and preserve the results instead of relying on a general assurance that everything looks normal.

Then review why the information was exposed. Perhaps the production team exported every field because nobody prepared a smaller door list. Perhaps an old supplier retained access after the event. Perhaps staff knew a suspicious message looked wrong but didn't know whom to call. Each cause needs a specific change and a person responsible for completing it.

Review unnecessary retained copies once evidence preservation and other legal requirements allow. Our guide to attendee data retention explains how to set retention by purpose. Apply those decisions to exports and supplier records as well as the main system. Don't erase investigation evidence merely to complete a cleanup task.

Give remaining actions deadlines and verify completion. Update contracts where the response revealed unclear responsibilities. Test the revised escalation route with the people who actually work your events, including temporary staff. Send any promised attendee update, correct earlier estimates where needed, and retain the notification and decision records appropriately.

Your response lead should be able to explain what happened, who was affected, what you did to protect them and which obligations you met. Where answers remain incomplete, keep the investigation open with a named owner and a next review time. Before closing it, check that promised updates were sent and outstanding actions have owners who understand what they need to complete.