In December 2023, the Personal Data Protection Commission (PDPC) opened an investigation after a software misconfiguration on Ticketmaster Singapore’s platform caused users buying tickets to see other users’ accounts. The glitch exposed the names, phone numbers, email addresses, and order histories of approximately 400 individuals.
Following the investigation, the PDPC accepted a voluntary undertaking in April 2024, requiring Ticketmaster to completely overhaul its content distribution network configuration, testing protocols, and security architecture.
This was not a malicious hack. It was not a rogue employee selling data. It was a simple configuration error made during a routine software upgrade—with inadequate post-upgrade testing to catch it.
The lesson for Singapore event organisers is stark: you do not need a malicious actor to breach the Personal Data Protection Act (PDPA). A misconfigured registration platform, a shared spreadsheet, a photographer who didn’t obtain consent, or a lucky draw whose terms buried a sponsor data-sharing clause—any of these common event scenarios can trigger a PDPC investigation.
And the penalties are severe. The maximum financial penalty for a data breach is up to S$1 million, or up to 10% of annual Singapore turnover for organisations with a turnover exceeding S$10 million. In January 2026 alone, the PDPC fined People Central Pte Ltd S$17,500 for a breach exposing 95,000 individuals’ data, and Singapore Data Hub Pte Ltd another S$17,500 for exposing 689,000 records.
Most event organisers know the PDPA exists but have never mapped its specific obligations to their actual event workflow. Under Singapore law, your event must comply with 11 distinct data protection obligations. Here is where events typically fail:
| PDPA Obligation | What It Means for Your Event | Where Events Typically Fail |
| Accountability | Designate a Data Protection Officer (DPO); have documented policies. | No DPO appointed; no written data policy for the event. |
| Notification | Tell attendees why you’re collecting their data before collecting it. | Registration forms with no stated purpose. |
| Consent | Get explicit, informed consent for each purpose. | One buried checkbox for registration, marketing, and sponsor sharing. |
| Purpose Limitation | Only use data for the purpose collected. | Using event RSVPs to send unrelated future marketing. |
| Accuracy | Keep data accurate and correctable. | No mechanism for attendees to update their details post-registration. |
| Protection | Reasonable security arrangements to prevent unauthorised access. | Attendee lists stored in shared Google Drive folders or emailed spreadsheets. |
| Retention Limitation | Cease retention when no longer needed. | Attendee data sitting in CRMs and spreadsheets two years after the event. |
| Transfer Limitation | Ensure overseas transfers have adequate protection. | Using US-based platforms without assessing cross-border data safeguards. |
| Access & Correction | Allow individuals to access and correct their data. | No process to handle data access requests at events. |
| Data Breach Notification | Notify PDPC if a breach meets the severity threshold. | No incident response plan; discovering a breach days later. |
| Do Not Call (DNC) | Do not send unsolicited marketing to unregistered numbers. | Post-event marketing SMS blasts to all attendees without opt-in consent. |
Attending an event does not constitute consent to be photographed, filmed, or added to a marketing mailing list. These are three separate purposes—each requiring separate, specific consent. Yet, many organisers combine all of them into a single checkbox or assume attendance implies consent.
This is one of the most common PDPA violations at B2B corporate events. When a sponsor pays to access the event’s attendee data, and the attendees were not explicitly told at registration that their data would be shared, the event organiser has breached both the Consent and Purpose Limitation Obligations.
From 1 January 2027, private organisations using National Registration Identity Card (NRIC) numbers—whether full or partial—for authentication will face stepped-up PDPC enforcement, including directions and financial penalties. The PDPC and Cyber Security Agency (CSA) issued a joint advisory explicitly prohibiting the use of NRIC numbers as passwords or default credentials. Organisers running government-adjacent events or AGMs have until 31 December 2026 to phase this out.
The Retention Limitation Obligation requires organisations to destroy personal data once it is no longer needed for the purpose it was collected. In practice, event teams commonly leave past event data in live CRM systems for years, keep spreadsheets in open-access Dropbox folders, or fail to confirm their event platform vendor has cleared the data.
When you use a third-party registration platform, you become the Data Controller. The platform is simply a data intermediary. But most organisers never ask their vendor where the data is stored, who has access, or how they handle breach notifications. If your platform stores data on overseas servers, you have a Transfer Limitation Obligation to assess.
Photos and videos of identifiable individuals are personal data under the PDPA. A venue photographer capturing candid shots of attendees without consent is a PDPA risk.
Attendees enter lucky draws for a chance at a prize—not because they want ongoing marketing. Using lucky draw entry data to build a marketing database without explicit opt-in consent violates the Purpose Limitation Obligation.
Under the PDPA, an event registration platform provider processes personal data on your behalf as a data intermediary. However, as the event organiser, you remain the data controller and bear primary PDPA liability.
If your platform misconfigures a setting that exposes attendee data, your organisation faces the reputational and legal consequences. You cannot outsource PDPA accountability.
Before signing a contract with any event platform vendor, you must ask:
No other event registration platform in Singapore’s market can currently document all seven of these publicly besides Klobbi.
The PDPA is not a static framework, and Singapore’s enforcement posture is tightening significantly.
Organisations handling large volumes of personal data are now required to designate a Data Protection Officer. Significant breaches must be reported to the PDPC within three days. And with 82% of PDPC enforcement actions in 2023/24 stemming from cyber incidents and weak security measures, the compliance window for ad-hoc data handling has closed.
Use this checklist to audit your next corporate event workflow.
Pre-Event
On Event Day
Post-Event
Most event registration platforms were built for a global market that treats compliance as a checkbox. Klobbi was built strictly for Singapore’s regulatory reality.
When you run an event on Klobbi, your attendee data is encrypted end-to-end. Your event database is cleared on a strictly documented 30-day post-event destruction schedule to prevent data hoarding. The platform holds both ISO27001 certification and the CSA Cyber Trustmark at the advanced maturity tier.
For corporate event teams at banks, government-linked companies, and statutory boards—who are themselves subject to strict data governance standards and need their vendors to meet the exact same bar—Klobbi’s certifications are not marketing language. They are contractual assurance.
