Attendee data in training: what to decide before the session
Who is the controller, what may be projected, how long to keep answers. The questions worth settling before you ask a room to respond.
Asking a room to answer a questionnaire means collecting personal data: an address, a name, and answers that reveal what somebody does not master in their job. That last category is more sensitive than it looks.
This is not legal advice. It lists the questions better settled before the session than after a request.
Who is the controller?
The first question, and often left vague. In in-house training it is generally the training provider who decides what is asked and why: they are the controller towards attendees. The tool is a processor.
The practical consequence: it is the provider, not the software vendor, who must inform attendees and answer their requests.
Inform at the point of collection
The notice has to appear where the data is asked for (on the form used to join the session) not in a privacy policy nobody will open. One sentence is enough: what is collected, by whom, why, and for how long.
What may be projected
This is the decision with the most concrete effect on attendees, and it is rarely written down. Projecting a named leaderboard in a room containing a manager and their team exposes each person's individual results to their line management.
An individual score displayed in front of the team is not a presentation detail. It is a disclosure, to an audience with power over that person.
The safe rule is simple: what is for the room is aggregate, what is named stays with the trainer. See running a live quiz.
What the client is entitled to receive
A client who paid for the training legitimately wants a debrief. That does not entitle them to their employees' individual results.
The useful report is aggregate: success rates, progress per competency, what to reteach. It answers their question (did the training work) without handing over a named assessment of their staff, which they did not commission and which exposes them as much as the attendees.
How long to keep it
A period decided in advance and actually applied beats a long vague one. Assessment answers exist to produce a report and document the session; past the period you set, they have no further use.
Attendee requests
An attendee may ask what is held about them, and for its deletion. The usual failure is not refusal, it is inability: nobody knows where the answers are, or how to find them two years later.
Planning that path in advance costs little; improvising it under a deadline costs a lot.
What SkillLens does
What is projected to the room is always aggregate and contains no names. The link given to the client is read-only and carries no personal data. An attendee can download what is held about them or erase it from their own screen, with a 30-day grace period before permanent deletion. The detail is in the privacy notice.