Sharing Kenyan attendee lists with sponsors
What Kenya's Data Protection Act asks of an event organiser before attendee details go to a sponsor or exhibitor, and how to keep the trail.
By Achekam · · 5 min read · For Events businesses in Kenya
Launching soon. The Industry CRM add-on described in this article is launching soon. This article describes it as it will work at launch.
A headline sponsor at a Nairobi expo signs the contract, pays the invoice and then asks the question every organiser hears sooner or later: "Can we have the delegate list?" Exhibitors ask too, usually on the last afternoon, when they want names to call the following week. The list is valuable, and handing it over feels like part of the service.
Under Kenya's Data Protection Act, 2019, that list is personal data, and the people on it have rights that do not disappear because a sponsor paid for access. Before any spreadsheet leaves the office, it helps to know what the Act asks of you, what happens if a shared list ends up where it should not, and how to keep a trail of who agreed to what.
This is general guidance, not legal advice. For a specific contract or a list you are unsure about, speak to a data protection adviser.
Every name on the list is a data subject
Kenya's Office of the Data Protection Commissioner defines a data subject as any individual who can be identified, directly or indirectly, via an identifier or personal data. At an event that covers far more people than ticket buyers:
- delegates and visitors who registered online or at the gate;
- speakers, panellists and moderators;
- exhibitor staff whose names went onto badges;
- visitors whose cards were scanned or collected at a stand;
- contacts at sponsors and suppliers whose details sit in your CRM.
A list with only names and employers still identifies people. A list with phone numbers, e-mail addresses and job roles identifies them precisely, and that is exactly the list a sponsor wants.
Collected for one purpose, used for that purpose
Section 25 of the Act sets out the principles of data protection. As published on Kenya Law, it requires personal data to be collected for explicit, specified and legitimate purposes, limited to what is necessary, kept accurate, kept no longer than necessary, and not transferred outside Kenya without proof of adequate safeguards or the data subject's consent.
Read those principles against a typical registration form. A delegate who filled in a form to get a badge and a lunch voucher gave their details for that purpose. Passing the same details to a sponsor's sales team is a different purpose. The practical lesson is to decide at registration what you will do with the details and say so plainly on the form, so that sharing with sponsors is a stated purpose people can accept or decline, not an afterthought.
Two more points from the same section matter when sponsors ask:
- Only what is necessary. If a sponsor only wants to know how many delegates came from the banking sector, give them the count, not the names.
- Lists leaving the country. Many sponsors are regional or global companies. If their marketing team sits outside Kenya, the list is leaving the country, and the Act asks for proof of adequate safeguards or the data subject's consent.
Direct marketing and registering with the Data Commissioner
The Act says no person may act as a data controller or data processor unless registered with the Data Commissioner, subject to thresholds for mandatory registration that the Data Commissioner sets. The registration regulations include an exemption for small entities, and smaller organisers sometimes assume it covers them.
The same regulations list purposes for which the small-entity exemption does not apply. Direct marketing is on that list, alongside hospitality, education, health care and others. An organiser whose business includes selling sponsors access to delegates, or e-mailing past attendees about the next show, is processing personal data for direct marketing. That is a reason to check your registration position carefully rather than rely on being small. The Data Protection Act on Kenya Law sets out the processing principles, data subjects' rights, registration of controllers and processors, and breach notification in one place, and is worth reading with your adviser.
If a shared list leaks
Once a list is in a sponsor's hands, you no longer control who forwards it. The Act requires a data controller to notify the Data Commissioner of a personal data breach that poses a real risk of harm without delay, within seventy-two hours of becoming aware of it, and to give reasons if notification comes later. The controller must also tell the affected people in writing within a reasonably practical period, unless safeguards make that unnecessary.
Seventy-two hours passes quickly over the weekend after a show. Before anything is shared, settle three things:
- Who in your team decides whether an incident is a breach, and who notifies the Data Commissioner.
- What the sponsor must tell you, and how fast, if the list is lost, misused or sent to the wrong person. Write it into the sponsorship agreement.
- Which version of the list went to which sponsor, on which date, so you can tell the affected people what was exposed.
How the Events pack treats visitor details
Achekam's Industry CRM includes an Events & trade shows pack that keeps Events, Sponsorships, Exhibitor booths and Vendor contracts as records of their own. Its post-event workflow checks that every sponsor and exhibitor was invoiced and paid, sends sponsor reports, and passes on visitor details only for people who agreed to share them.
There is one limit to be clear about. The Events pack is not a ticketing or registration system: it keeps no attendee list, check-in or badge scanning, and tickets are sold through invoices or the till. The attendee list, and the record of who ticked the box agreeing to be shared with sponsors, live in whichever registration platform you used. The pack puts the consent check into the wrap-up, but the evidence of consent comes from that platform, so the export you work from must carry it.
A sensible routine for each sponsor request:
- Export from the registration platform only the people who agreed to sharing, with the date and the wording they agreed to.
- Remove every field the sponsor does not need.
- Note on the Sponsorship record what was sent, to whom and when.
- Ask the sponsor to confirm where the data will be held and whether anyone outside Kenya will use it.
The rest of the wrap-up, from sponsor reports to unpaid booths, is covered in after the event: invoices paid and sponsor reports, and where registrations and ticket data belong when the pack does not hold them is explained in where tickets live if the pack is not ticketing.
Start with the next registration form
Consent is won or lost on the registration form, long before a sponsor asks. Write down the purpose of each field you collect, add a separate, unticked option for sharing details with sponsors and exhibitors, and keep a copy of the wording with the event's records. Then agree with each sponsor, in writing, what they will receive and what they must do if it goes astray. A list built that way is one you can share without second thoughts, and one you can explain if the Data Commissioner asks how it was put together.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
