Guides · updated 20 August 2026
GDPR for kids' clubs, without the panic
A kids' club holds some of the most sensitive data a small business can hold: children's names, health notes, addresses and photographs. UK GDPR is not the monster it is made out to be, but children's data gets specific protections, and the ICO says plainly that children need particular protection. Here is what that means at club scale.
Know your lawful basis, and say it simply
Most of what a club does with data is covered by performing the contract with the parent (running the booking) and legitimate interests (running the club safely). Consent is the right basis for the optional extras: marketing emails, photographs, listing a child's name in a show programme. The mistake to avoid is asking for consent for things you would do anyway; consent you cannot let someone refuse is not consent.
Note the age line: where an online service does rely on consent, in the UK only a child aged 13 or over can give it themselves. In a kids' club you are almost always dealing with the parent, which is simpler: the parent books, the parent consents.
Medical data is special category data
Allergies, conditions and medication notes are health data, which UK GDPR treats as special category data needing extra care and an extra processing condition. In practice at club scale: collect only what the person running the session needs, show it to the people who need it and nobody else, and do not keep it after the child leaves. A spreadsheet of every child you have ever taught, with their medical notes, emailed between coaches, is the pattern to end.
Retention: keep it while there is a reason
The principle is storage limitation: keep personal data no longer than you need it. Decide, write down and follow simple clocks: booking and payment records for as long as tax law wants them, medical notes only while the child attends, incident records longer because claims can come late. What kills small organisations at audit is not the choice of period, it is having no answer at all.
Photos are personal data with feelings attached
A recognisable photograph of a child is personal data. Take consent for photography separately from the booking (a parent must be able to book without agreeing to photos), record the answer where the coach can see it, and honour a change of mind. The register is a good place for the flag: the person pointing the camera is the person who needs to know.
When a parent asks what you hold
Parents can ask for their and their child's data, and you have a month to answer. For a club the honest answer is usually short: contact details, bookings, payments, medical notes, consents. If producing that answer would take you days, that is a filing problem worth fixing before anyone asks.
Fair questions
Do I need to register with the ICO?
Most organisations processing personal data must pay the ICO's data protection fee, which for a small club is the lowest tier. Check the ICO's self-assessment rather than assuming you are exempt.
Do I need a privacy policy?
You need to tell people what you collect and why, in plain words, at the point you collect it. A short, true privacy notice on your booking page does the job; ten pages of template legalese nobody reads does not.
Where these figures come from
- The ICO's guidance on children's information: children need particular protection when their personal data is collected and processed. Source
- The ICO's guidance on special category data, which includes health data. Source
Checked 20 August 2026. If anything here is wrong or out of date, tell us and we will correct it.
Run your club on the tool we built for it.
Booking pages, registers with medical notes, waiting lists that run themselves and payments into your own Stripe account, for one flat price.