What data should never be written on a badge?
Anything you would not print on the front of it. A badge is worn in public all day, readable by anyone who gets close with a phone, and it leaves the venue in a pocket. The chip is not a private compartment.
The assumption to abandon
People treat the chip as a hidden compartment because its content is not visible. It is not hidden, it is unlabelled.
Anyone with a phone can read a badge from a few centimetres, which in a crowded hall, a lift or a queue is a normal distance between two people.
Reading leaves no trace and requires no interaction, so the wearer has no way to know it happened.
The correct mental model is that the chip is a second printed face, readable by anyone close enough, without asking.
What never goes on
Personal contact details in clear: mobile number, personal email, home address.
Anything about the person that is not already on the printed face: role sensitivity, dietary or medical information, accessibility needs.
Anything that functions as a credential elsewhere: an employee number used for building access, an account reference, a booking reference that identifies a hotel room.
And anything about other people, such as a colleague's details bundled into a company badge.
Use an identifier instead
Write an opaque identifier that means nothing outside your event system. Someone who reads the badge learns a number.
Everything about the person then lives in the system, behind whatever access control you apply, and it can be corrected, restricted and deleted.
Make the identifier opaque rather than sequential. A number that increments tells a reader how many attendees there are and lets someone guess neighbouring badges.
And tell attendees what the badge holds and what is recorded when it is read. That is both good practice and the thing a privacy notice is for.
It outlives the event
Badges go home in bags and stay in drawers for years. A badge holding personal details is a small data leak with an indefinite life, out of your control and out of the wearer's mind.
An identifier is inert once voided, which is the strongest practical argument for the design.
If badges were written with personal content and are unlocked, erase them on collection. If they were locked, they cannot be erased, which is one more reason not to lock event badges.
And void every identifier at the close of the event regardless, since a badge that still resolves is still a credential.
Frequently asked questions
Can someone read my badge without me knowing?
Yes, from a few centimetres, leaving no trace. That is the assumption to design around rather than an unlikely attack.
Is a name on the chip a problem?
Less than contact details, and it is already on the printed face. The test is whether you would print it there.
Why should the identifier be opaque?
A sequential number reveals the scale of the event and lets someone guess other badges. An opaque value reveals nothing.
What about badges kept after the event?
They keep whatever was written on them indefinitely. An identifier becomes meaningless once voided, and personal data does not.