Data Protection for Clubs: What UK GDPR Actually Asks of a Volunteer-Run Group
Under Article 33 of UK GDPR, a club that loses or leaks member data in a way that puts people at risk has 72 hours to report it to the ICO. Most clubs find out what data they hold, and where, during those 72 hours. This guide is about finding out before.
TL;DR
UK GDPR applies to every club, however small or unpaid. In practice it asks for six things: know where member data lives, have a lawful basis for each kind of data (usually contract or legitimate interests, not consent), tell members in a short privacy notice, keep medical and safeguarding details to the named adults who need them, delete records on a fixed schedule, and have a plan for breaches (72 hours to report a risky one) and access requests (one month to answer).
Does data protection law really apply to a small club?
Yes, and the size of the club makes no difference.
A junior football club with 60 players, a swimming club with a waiting list or a Saturday language school with 40 families all hold personal data: names, dates of birth, parents' phone numbers, allergies, photos, attendance. That makes the club a data controller under UK GDPR. The ICO's data protection fee guidance exempts many not-for-profit organisations from paying the annual fee, and that is where a lot of committees stop reading. The exemption covers the fee. Every other duty still applies.
The good news is that the law does not expect a volunteer committee to behave like a bank. It expects you to be able to answer, in writing, what you hold, why you hold it, who can see it and when you will delete it.
Where does a club's member data actually live?
Start with a data map: a single page listing every place personal data sits. Do it at a committee meeting with the membership secretary, the welfare officer, the treasurer and one coach in the room, because each of them holds a different piece.
A typical first map surprises people. Take Brookfield Juniors Swimming Club, a fictional but typical club in Derby with 140 swimmers. When its committee sat down to list where member data lived, they found 11 places: the online joining form, the membership spreadsheet, the treasurer's banking app, a paper register in the poolside box, the welfare officer's email, two parent WhatsApp groups, three coaches' phones holding emergency contacts, and a shared drive folder called "OLD FORMS" with 2019 medical questionnaires still in it. None of it was hidden. It had simply accumulated.
The map is the whole job in miniature. Once you can see the 11 places, the next steps are obvious: close what you do not need, move what you do need somewhere with access controls, and delete what is out of date.
Which lawful basis should a club use?
This is where we disagree with the clubs that put "I consent to the club holding my data" at the bottom of every form. Consent is usually the wrong basis for running a club.
Consent under UK GDPR has to be freely given and can be withdrawn at any time. If a parent withdraws consent for the club to hold their emergency contact number, can the child still train? Of course not, which means the consent was never really free. The ICO's guide to lawful basis is clear that consent is one of six bases and not the default. For the data you need to run a membership (contact details, emergency contacts, attendance, fees) use contract or legitimate interests. Save consent for genuinely optional things: photos on the club's public pages, a fundraising newsletter, a member directory.
Health information is special category data and needs a second condition on top. For allergies, asthma and medication a coach needs to know in an emergency, that is usually protecting the child's vital interests or explicit consent from the parent recorded on the joining form. Write down which one you rely on. Our guide to member records, contact details and medical consent covers the form itself.
Who in the club should see what?
Fewer people than currently do. The most common failure we see is not hacking. It is a medical note visible to every coach and helper because it sits in a shared spreadsheet, or a child's home address in a group chat with 200 parents.
Set three levels. Every coach on a session sees names, the emergency contact and any medical information they need to act on. The welfare officer sees safeguarding records, and nobody else does. The membership secretary and treasurer see contact and payment details. When a volunteer steps down, their access goes the same week, not at the AGM.
Coaches we speak to often say something like: "I didn't realise I still had the whole squad's numbers on my phone from three seasons ago until a parent asked me to delete them."
How long should a club keep records?
Article 5 says no longer than necessary, which means you must decide what necessary is. A retention schedule for a junior club usually looks like this:
- Contact, emergency and medical details: delete within three months of a member leaving.
- Accident and incident records about a child: keep until the child turns 21, because a personal injury claim can be brought up to three years after their 18th birthday.
- DBS certificates: record the certificate number and date, but do not keep the certificate itself for more than six months.
- Financial records, including Gift Aid declarations: six years.
- Safeguarding concern records: follow your national governing body's guidance, which is usually much longer.
Then pick one date a year, the week after the AGM works well, when the membership secretary runs the deletions and minutes that it happened.
What should happen when something goes wrong?
Name one person, usually the secretary or welfare officer, as the first call. When data goes to the wrong place, they contain it (delete the message, ask recipients to delete it), write down what happened and when, and decide within 72 hours whether it is likely to put anyone at risk. If it is, report it to the ICO. If the risk to the people affected is high, tell them directly too. A spreadsheet of children's dates of birth and medical conditions posted into a parents' chat is a reportable breach. An email sent to one wrong parent and deleted on request usually is not, but it still goes in the breach log.
Subject access requests follow a similar rule. A member or parent can ask for a copy of everything you hold about them, and you have one month to answer. With a data map, that is an afternoon's work. Without one, it is a hunt through 11 places.
How does Bitir help?
Bitir replaces several of those 11 places with one. Members join a channel through an invite rather than having their numbers passed round, and phone numbers are not shown to other members. Each member's record holds contact, emergency and medical details, and channel roles decide which adults see them, so a session coach sees what they need and the welfare officer's notes stay with the welfare officer. When someone leaves a role, removing the role removes the access. The privacy notice can be pinned in the channel where every new family sees it, alongside the photo and video consent choices that really do need consent.
Questions organisers ask
Does UK GDPR apply to a small volunteer-run club?
Yes. UK GDPR applies to any organisation that holds personal data about identifiable people, whatever its size and whether or not anyone is paid. A club with 30 members, a contact list and a few medical notes is a data controller. Many not-for-profit clubs are exempt from paying the ICO data protection fee, but the exemption covers the fee only, not the rest of the law.
Do we need consent to keep members' details?
Usually not. Contact details, emergency contacts and attendance are normally held because they are needed to run the membership, which is the contract or legitimate interests basis. Consent is best kept for genuinely optional things, such as photos on social media or a newsletter, because members can withdraw it at any time. Health information is special category data and needs an extra condition, such as protecting a child's vital interests or explicit consent.
How long should a club keep records about children?
Set a period for each type of record. Contact and medical details can go within a few months of a child leaving. Accident and incident records are commonly kept until the child turns 21, because a personal injury claim can be brought up to three years after their 18th birthday. Safeguarding concern records are kept longer, following your governing body's guidance. Financial records are normally kept for six years.
What should we do if member data is shared by mistake?
Contain it first: delete the message or file, ask anyone who received it to delete it, and write down what happened and when. If the breach is likely to put people at risk, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware of it, and to tell the affected people without undue delay if the risk to them is high. Log every breach, including the ones you decide not to report.
Get member data out of the group chat
Keep contact, emergency and medical details on each member's record, let roles decide who sees them, and pin your privacy notice where every new family reads it.
Set Up Your Club