Events
Every activation collects data now: a raffle stub with a mobile number, a QR sign-up for a sample, a photo booth that emails the shot, a registration form that asks about dietary needs. Under the Data Privacy Act each of those is personal information, and the brand answers for it even when the agency’s crew holds the clipboard.
What counts as personal information at a booth
The definition in Section 3 of the Act is broad: any information “from which the identity of an individual is apparent or can be reasonably and directly ascertained”, or that would identify someone “when put together with other information”.
| What the booth collects | Where it sits under the Act |
| Name, mobile number, email | Personal information |
| A photo or video in which a face can be recognised | Personal information, by the same definition |
| Age or birthday, marital status | Sensitive personal information, listed in Section 3(l) |
| Dietary needs that reveal health or religion | Can be sensitive: health and religious affiliation are on the same list |
| A government ID number taken when a prize is claimed | Sensitive: information issued by government agencies peculiar to an individual |
Sensitive personal information has a stricter rule. Section 13 prohibits processing it except in listed cases, the first being consent “specific to the purpose prior to the processing”. If the only reason to ask for a birthday is to confirm someone is of age, checking an ID without writing anything down collects less.
Consent that holds up
The Act defines consent as “any freely given, specific, informed indication of will”, and says it “shall be evidenced by written, electronic or recorded means”. Section 12 lists other lawful bases, such as a contract or legitimate interests, but marketing follow-up after an activation usually rests on consent. Each word in the definition has a job at the booth:
→ Informed means told first. Section 16 entitles people to be told, before their information enters the system or at the next practical opportunity, what is collected, why, how, who receives it, who the controller is and how to reach them, how long it is kept, and what their rights are. On a booth form, that is a short notice above the fields, not terms on a website nobody opens.
→ Specific means one purpose per tick. Entering a raffle and receiving marketing messages are two purposes. A separate tick box for each keeps the raffle entry valid when someone says no to the newsletter.
→ Freely given means the prize does not depend on the newsletter. Making marketing consent the price of a raffle entry makes it hard to argue the consent was free.
→ Evidenced means you can show it. A signed or ticked paper stub, or a timestamped digital form. If the booth cannot produce it later, it did not happen.
The booth test
Can the person at the booth explain, in one sentence, what happens to an entry after the event? If not, the notice on the form is not doing its job, and nobody signing it was informed.
Collect less, and decide when to delete
Section 11 requires personal information to be “adequate and not excessive in relation to the purposes for which they are collected and processed”, and retained “only for as long as necessary”. For an activation that usually means:
→ Raffle: what it takes to reach a winner. A name and a mobile number reach a winner. Addresses and ID details come later, from winners only, when the prize is claimed.
→ Sampling: nothing, unless there is a reason. Handing over a sample does not need a form.
→ Photo booth: delivery, not a database. If the shot is emailed, the email address serves delivery. Keeping it for marketing is a second purpose, and it needs its own tick.
→ A deletion date, set before the event. Decide when the raw entries are deleted, and put it in the notice. It is one of the things people are entitled to be told.
The brand, the agency and the list
At most activations the agency runs the booth and the brand owns the campaign. The brand is then typically the personal information controller and the agency processes data on its behalf. The Act is clear about where responsibility sits:
→ The brand stays accountable. Under Section 21, each controller “is responsible for personal information under its control or custody, including information that have been transferred to a third party for processing”, and must “use contractual or other reasonable means” to keep it protected.
→ Handing the work out is allowed, with safeguards. Section 14 lets a controller subcontract processing, provided it ensures “that proper safeguards are in place to ensure the confidentiality of the personal information processed”.
→ Put it in the contract. Who holds the entries on the day, where they are stored, who can see them, when they are handed to the brand, and when the agency deletes its copy.
→ Paper is data too. Stub boxes ride in vans and sit in storerooms after the event. Plan the custody of the paper the way you would plan it for a laptop.
Raffles add a second set of rules: the promo needs its own permit, and the list of winners goes to the DTI. Our guide to sales promotion permits covers that side, and measuring event ROI covers what to do with the leads afterwards.
General information, not legal advice. For campaigns that collect sensitive personal information or large volumes of data, involve your data protection officer before the form is printed.
Where PUNX fits
PUNX runs corporate events and brand activations from Makati: 50-plus people, founded 2023, with P&G, San Miguel, Petron, GCash and Sun Life on the client list. When you brief an events agency, ask who will hold the entries on the day, where they go afterwards and when they are deleted. The answer should come back in writing.
FAQ
Do you need consent to collect leads at a brand activation?
The Data Privacy Act allows several lawful bases, but marketing follow-up after an activation usually rests on consent. It must be freely given, specific and informed, and evidenced in writing, electronically or by recording, with a notice of what is collected and why given before the information is taken.
Is a photo booth picture personal information?
If the person can be identified from it, yes. The Act covers any information from which a person’s identity is apparent or can be reasonably and directly ascertained. Keeping the photo or the email address for marketing is a separate purpose that needs its own consent.
Can a raffle entry require consent to marketing?
It is better kept separate. Consent has to be freely given and specific, so a separate tick box for the raffle and for marketing keeps the entry valid when someone declines the newsletter.
Who is responsible for data an agency collects for a brand?
The brand, as personal information controller, remains responsible for personal information it transfers to a third party for processing, and must use contractual or other reasonable means to keep it protected. The agency, as processor, must also comply with the Act.
Related
Brand activation and events — what PUNX runs, and how
Sales promotion permits — raffles, games and contests
Event ROI — what to measure, and how to follow up
Lead capture in the brief?
Send us the form and the plan for the data. We will tell you what to cut, what the notice needs, and who should hold the list.
Start a project ↗