Section 4 DPDPA for Corporate Events: 5 Legitimate Grounds to Process Attendee Data

Applies to	Corporate Event Managers, Event Planning Companies, HR Departments & In-House Event Organizers in India
Primary law	DPDPA 2023 · Section 4
Penalty ceiling	up to ₹150 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-07
Source	DPDPAReady Compliance Team

Understanding Section 4: What Personal Data Means for Corporate Events

When you collect the first attendee registration for a corporate event in India today, you’ve stepped into Section 4 of the Digital Personal Data Protection Act, 2023. Every name, email, phone number, and dietary preference captured crosses into regulated territory—and event managers who mishandle this data face penalties up to ₹150 crore.

Section 4 establishes the foundation: personal data is any information that identifies (or reasonably could identify) an event attendee or participant. For event managers and HR professionals, this means distinguishing between data you incidentally handle during an event and data you deliberately collect and retain. A registration database for a 500-person corporate summit, a sign-in sheet at an HR training session, or an attendance tracker for a hiring fair—all trigger Section 4’s requirements the moment you decide to store the data beyond the event itself.

The critical principle is this: you cannot retain and process personal data without establishing a legitimate ground for doing so. Convenience, future possibility, or “it might be useful later” do not qualify as legitimate grounds under Section 4. You must know why you’re keeping each data element and ensure that reason is legally sound.

The Five Legitimate Grounds Under Section 4 for Event Data Processing

Section 4 of the DPDPA 2023 establishes that personal data means any information relating to a data principal and that processing must be grounded in one of five legitimate purposes: consent, contract performance, legal obligation, vital interest, or legitimate interest. Event managers must affirmatively establish which ground applies to each data element before collection.

Ground 1: Explicit Consent
The safest and most defensible ground. Obtain documented, unambiguous consent at the point of registration—“I agree to receive event updates and post-event communications from [Your Company].” Place this as a separate, unchecked checkbox (never pre-checked). For post-event use cases like alumni outreach or marketing communications, explicit consent is essential. Note: if the attendee is an employee and the event is mandatory, their consent may be implicit due to the employment relationship, but secondary uses (resale of contact data, third-party sharing, profiling) still require separate explicit consent.

Ground 2: Contract Performance
Processing data necessary to deliver the event itself—sending tickets, venue details, speaker information, invoicing, and confirming attendance. This ground is narrow: it covers only what is essential to execute the event experience. Post-event networking communications, customer feedback surveys, or upselling secondary products do not fall under contract performance unless the original registration terms explicitly included this commitment.

Ground 3: Legal Obligation
Processing attendee names and contact information to comply with:

• Income tax regulations (reporting event expenses or attendee benefits to the tax authority)
• DGFT and FEMA rules for events involving international participants
• SEBI requirements if the event covers investment products or financial advice
• Environmental, occupancy, or fire safety regulations (legal sign-in sheets)
• Labor compliance for HR-related events involving employee benefits or leave data

This ground is strong but requires documentation: you must be able to cite the specific law or regulation that mandates data retention.

Ground 4: Vital Interest
Narrow applicability for events. Examples: collecting emergency contact data, medical conditions disclosed for event safety accommodations, or incident investigation during or immediately after an event. This ground should not be claimed for routine business purposes. Misuse of “vital interest” for general event analytics or subsequent contact is a common Section 4 violation.

Ground 5: Legitimate Interest (Weaker Ground)
Processing attendee data for post-event communications, alumni networking, or aggregated analytics, provided the interest is proportionate to the privacy intrusion and attendees could reasonably expect this use. This is the most contested ground and is frequently challenged in compliance audits. To strengthen your claim under legitimate interest: publish a transparent privacy notice stating your intended use, provide an easy opt-out mechanism, and ensure you’re not profiling or using data for secondary marketing without consent.

For corporate events in India, grounds 1, 2, and 3 are the most defensible. Grounds 4 and 5 require detailed documentation and are the first areas regulators scrutinize.

Practical Section 4 Compliance Roadmap: 7 Steps for Event Managers

1. Map all data touchpoints. Document every system and process that captures attendee information—registration platforms, badge printers, survey tools, email marketing systems, CRM uploads, photo collections, and post-event analytics platforms. List the data elements each touches (name, email, phone, dietary data, employment status, etc.).

2. Classify each data element by ground. For every piece of data, write down: (a) what it is, (b) which Section 4 ground justifies keeping it, and (c) how long you will retain it. Example: Attendee name for badge printing → Contract Performance → delete 30 days post-event. Newsletter signup email → Explicit Consent → delete when unsubscribed or annually if dormant. Attendee department for tax benefit → Legal Obligation → delete per tax retention rules.

3. Publish a transparent privacy notice. Before attendees register, display a privacy notice clearly stating: what data you collect, which grounds you’re using, how long you’ll retain data, where data is stored, and attendees’ rights under DPDPA (access, deletion, portability). Update this annually. Many event platforms (Eventbrite, Splash, Hopin) include privacy templates—customize them to reflect your actual practices and Section 4 grounds.

4. Separate consent from other grounds. If you’re collecting data under Contract Performance or Legal Obligation, do not automatically enroll attendees in a marketing mailing list or secondary contact program. Provide an unchecked opt-in for non-essential uses. Unchecked boxes do not constitute consent; pre-checked boxes are non-compliant. Attendees must affirmatively choose secondary contact.

5. Set and document retention limits. Retention must be tied to the ground and necessity, not indefinite convenience. Event logistics data (name, email, badge info for on-day execution) → delete 30–60 days post-event, unless tax law extends this. Consent-based mailing list → delete upon withdrawal of consent or after two years of no engagement. Legal Obligation data → retain per the specific law’s mandated period (e.g., seven years for income tax). Create a data retention schedule and attach it to your privacy notice.

6. Implement basic security controls. Data protection is not just a privacy concern—it’s a prerequisite for justifying retention under Section 4. Weak security undermines your claim that you’re processing data responsibly. Implement: encrypted databases or tools (AES-256 or equivalent), restricted access (role-based permissions), strong passwords and multi-factor authentication, and a data breach response plan. Document these controls and include them in your privacy notice.

7. Conduct a pre-event Section 4 audit. Two weeks before the event, walk through your registration form, privacy notice, data storage system, and backend integrations (email, CRM, analytics) with your legal and IT teams. Confirm that: (a) each data field on the form has a documented Section 4 ground, (b) the privacy notice discloses all intended uses, (c) checkboxes for optional data or secondary contact are unchecked by default, and (d) your retention and deletion processes are in place and logged. Fix mismatches before attendees register. A post-event audit is too late to fix Section 4 breaches.

Special Case: Employee Data in Corporate HR Events

If the event is internal—employee training, onboarding, corporate offsite, or team-building—employee personal data is covered by employment law and Section 4 of the DPDPA. You may have a broader Legal Obligation ground (payroll, benefits, safety), but data beyond employment necessity (personal contact details, social media profiles, health or family information collected for social purposes) still requires a separate ground or fresh consent.

Example scenario: A software company holds an annual onsite offsite. They collect employee home addresses for travel logistics (Legal Obligation/Contract Performance). They also ask for dietary information for the catered meals (Contract Performance—necessary for the event). However, they want to photograph employees and publish photos on the internal intranet and external marketing channels. Photographing and publishing faces requires separate explicit consent, not just employment context. Social media handles for an internal “networking mixer” require Legitimate Interest or consent, not employment authority. Collecting personal emergency contact information is vital interest only and should be deleted once the event concludes.

HR teams often conflate “employment authority” with “Section 4 legitimacy”—they are not the same. Employment authority justifies some processing, but sensitive or secondary uses still need independent grounds.

Frequently Asked Questions

Q: Do I need consent for every attendee at a corporate event?
A: No. You need a legitimate ground—consent is one of five options. Consent is required only for secondary uses beyond event execution. For example: collecting name and email for sending event confirmation is Contract Performance; no consent needed. Collecting the same name and email for a three-year alumni mailing list requires explicit consent or a different ground like Legitimate Interest (with a privacy notice explaining this use). Always distinguish between data necessary for the event and data you’re collecting for future business purposes.

Q: What happens if I collect data without a Section 4 ground?
A: You’re in violation. The DPDPA enforcement authority can issue a compliance notice and impose penalties up to ₹150 crore for breaching Section 4 grounds requirements. Additionally, affected attendees can file complaints with the Data Protection Board if they believe their data was processed illegally. If you discover you’ve collected unauthorized data, stop collection immediately, delete the unauthorized data, and document the corrective action. Future compliance is a mitigating factor, but past violations still carry penalties.

Q: Can I share attendee contact lists with event sponsors or third-party vendors?
A: Only if your privacy notice explicitly states that you will share attendee data with third parties and attendees affirmatively consent to this sharing. “Sponsorship” or “vendor support” is not an independent Section 4 ground. If you share attendee contacts without explicit notice and consent, it’s a Section 4 breach. If the vendor agreement requires sharing (e.g., a venue partner needs attendee dietary data for catering), your privacy notice must disclose the vendor’s identity or category and the purpose of sharing. Generic statements like “we may share with partners” without specificity are not compliant.

Q: For HR events involving employees, how does employment authority relate to Section 4 compliance?
A: Employment law establishes a broader right to process employee data for employment administration (payroll, tax, benefits, performance). Section 4 narrows this: you can process employee personal data without fresh consent if it’s necessary for employment (payroll, mandatory safety training, legal compliance). However, when you process employee data for non-employment purposes—collecting personal phone numbers for social events, storing personal medical data beyond safety compliance, creating attendance analytics for marketing or profiling, or capturing diversity data for non-legal reasons—you must establish a separate Section 4 ground (explicit consent, legitimate interest with transparency, or vital interest in rare cases). When in doubt, treat it as requiring consent; employment authority does not automatically cover all employee data collection.

Q: How long can I keep attendee data after the event ends?
A: Retention periods are tied to your Section 4 ground and necessity. If Contract Performance, retain only as long as needed to execute the event and related logistics (typically 30–60 days), unless another ground applies. If Explicit Consent (mailing list), retain as long as the person hasn’t withdrawn consent; consider implementing an auto-delete policy after two years of no engagement (unsubscribe or no opens). If Legal Obligation (tax reporting, regulatory compliance), retain for the period mandated by law (often seven years for tax). Document all retention periods in your privacy notice and retention schedule. Deleting data on schedule is a key compliance practice; indefinite retention signals that you’re not taking Section 4 seriously.