UK GDPR for kids’ clubs: children’s data and practical steps

Scope: personal information in a UK children’s club

This guide concerns UK GDPR and UK data protection guidance, rather than England-only childcare rules. Children need particular care when their information is used. Their names, dates of birth, parent details, emergency contacts, bookings and attendance can be personal data; information about the adults involved also needs protection.

Start with a record of the information you collect and each purpose for using it. For example, taking a payment, planning safe participation and publishing a promotional photograph are different purposes. Children’s data is not all special category data simply because it relates to a child; health information needs a separate assessment.

• Lawful bases for children’s personal information · Information Commissioner’s Office
• What is special category data? · Information Commissioner’s Office
• Data minimisation · Information Commissioner’s Office

Choose and document a lawful basis for each purpose

Identify an appropriate Article 6 lawful basis before processing, explain it in your privacy information and document your reasoning. Consent is one possible basis, not a universal requirement. Assess the purpose, necessity and relevant circumstances rather than selecting contract or legitimate interests as a club-wide default.

A contract with a parent does not automatically establish the contract basis for the child’s information. That basis concerns a contract with the person whose data is processed. Assess parent and child information separately. If considering legitimate interests, assess necessity and the balance with the child’s rights and interests; a useful activity is not automatically a lawful one.

The ICO’s current guidance also describes recognised legitimate interest for specified purposes. Do not assume it covers ordinary club administration or removes the need to meet its conditions. Use the linked guidance for the basis you propose, rather than a generic checklist of supposedly approved uses.

• Lawful bases for children’s personal information · Information Commissioner’s Office
• A guide to lawful basis · Information Commissioner’s Office

Children’s consent and the specific online age rule

Where you rely on consent, give a genuine, informed choice for specific purposes and make withdrawal as easy as giving consent. Separate optional choices from necessary booking information. A photography preference or acknowledgement of a privacy notice is not automatically valid UK GDPR consent.

The age of 13 is not a general consent threshold for all club activities. Article 8 sets an additional rule where an information society service is offered directly to children and processing relies on consent: generally, a person with parental responsibility must give or authorise consent for an under-13. A parent-facing booking form does not by itself establish that this rule applies.

Outside that specific online context, consider the child’s understanding and capacity, and who can appropriately act for them. The assessment can differ across the UK. Do not assume the adult making the booking can consent to every use of a child’s information.

• Lawful bases for children’s personal information · Information Commissioner’s Office

Health information needs an Article 9 condition as well

Medical conditions, allergies and medication information can reveal health status and are special category data. Identify both an Article 6 lawful basis and a separate Article 9 condition before processing it. Some conditions also require associated Data Protection Act 2018 conditions or an appropriate policy document.

There is no single Article 9 condition automatically suitable for every club. Explicit consent may be appropriate in some circumstances, but only if its requirements can genuinely be met. Other conditions have their own limits. Obtain advice where you cannot establish a suitable condition rather than assuming collecting information for safety settles the issue.

Ask for the relevant participation or emergency information you need, rather than a complete medical history. Explain who will see it and why. Do not treat an ordinary photo as health or biometric special category data solely because a child is identifiable in it; the information and how it is used matter.

• Rules on special category data · Information Commissioner’s Office
• What is special category data? · Information Commissioner’s Office
• Data minimisation · Information Commissioner’s Office

Minimise collection and restrict access, sharing and exports

Collect information that is adequate, relevant and limited to your stated purposes. Keep it accurate enough for those purposes and give staff access according to what they need to do. A coach’s need for an emergency contact does not justify distributing every family’s details or complete medical records.

Consider paper registers, downloaded spreadsheets, personal devices and messaging groups as well as your booking system. Use individual accounts and appropriate access controls; review access when duties or staffing change. Protect printed records, devices and exports, and train staff to report a suspected loss or disclosure promptly.

Check the purpose and authority for sharing with another organisation. A parent supplying information does not automatically authorise unrestricted onward sharing. Security measures should match the risks; hiding a column in a document is not the same as limiting the information disclosed.

• Data minimisation · Information Commissioner’s Office
• A guide to data security · Information Commissioner’s Office

Set justified retention periods for different records

UK GDPR does not prescribe one retention period for every record. Document why you need each category, any relevant legal obligations, when the period starts and how you review or delete it. Booking, payment, incident and current care information may have different justifications.

Do not retain all medical information indefinitely, but do not automatically erase every health record the day a child leaves either. Information needed for a specific legal claim or obligation may warrant continued retention. Keep only what remains necessary, restrict its use and access, and maintain an appropriate lawful basis and special-category condition where applicable.

Include exports and paper copies in your schedule. Review records when participation ends and distinguish information still needed for a justified purpose from old operational copies. Deletion or genuine anonymisation should follow your assessment; changing a child’s name alone may not make a record anonymous.

• Storage limitation · Information Commissioner’s Office
• Rules on special category data · Information Commissioner’s Office

Photographs, preferences and marketing are distinct uses

Identifiable club photographs can be personal data. Decide the lawful basis and explain the purpose, audience and intended publication before using them. Consent can be suitable, but is not the only possible basis for all photography; the ICO’s school examples illustrate the distinction without giving a private club a school’s public-task basis.

Where relying on consent, make optional photography choices specific and separate from joining the club, record them and act on withdrawal. Consider children’s views and safety concerns even when an adult agrees. A parent’s permission is not a substitute for assessing your lawful basis and fairness.

Marketing emails and texts also require a separate assessment under PECR. A UK GDPR lawful basis alone does not settle whether you may send them; consent or a relevant exception depends on the circumstances. Read the current electronic-mail guidance before adding families to promotional lists.

• Taking photos in schools · Information Commissioner’s Office
• Lawful bases for children’s personal information · Information Commissioner’s Office
• PECR electronic-mail marketing rules · Information Commissioner’s Office

Give parents and children useful privacy information

Tell people who is responsible, what information is used for, the lawful bases, who receives it, retention periods or criteria, relevant rights and how to contact you or complain. Other information may be required depending on the processing. Use the ICO’s full checklist rather than assuming a short template covers everything.

Make the information clear and accessible to children as well as parents, taking account of age and understanding. Explain health information and photography uses plainly. The information required, and when it is provided, can differ where you collect it directly or obtain it from someone else.

Keep your notice consistent with actual forms, sharing, exports and staff practices. Review it when those change. Some ICO guidance is being updated following the Data (Use and Access) Act; source-check dates below record checks for this article, not qualified legal review or a guarantee that guidance will stay unchanged.

• Privacy information to provide · Information Commissioner’s Office
• Children’s data protection rights · Information Commissioner’s Office

Handle requests as the child’s rights, not automatic parental access

Children hold their own rights, including access, correction and erasure in applicable circumstances. A parent asking for their own data is different from requesting a child’s information. Check identity, authority, the child’s understanding and best interests; a parent does not automatically have unrestricted access just because they made the booking.

A child with sufficient understanding can exercise their rights themselves or authorise a representative. Consider confidentiality, relevant court orders and potential harm before responding to someone acting for them. Erasure is not absolute: consider the applicable conditions and exceptions rather than promising every record will be deleted on request.

For subject access, respond without undue delay and normally within one month. The ICO explains identity and authority checks, limited extensions and clarification rules; these are not an automatic extra month for every request. Locate the relevant information, consider information about other people and disclose securely. Have a named person responsible for handling requests.

• Children’s data protection rights · Information Commissioner’s Office
• Responding to subject access requests · Information Commissioner’s Office

Review your club’s responsibilities and service providers

A booking platform can help organise records, but using one does not transfer all your responsibilities. Establish who decides the purposes and means of each use of information. Where a service acts as your processor, the required contractual arrangements and suitable safeguards matter; other recipients may have a different role. Check the actual arrangements rather than the software label.

Organisations using personal information may need to pay the ICO data protection fee unless exempt. Use the ICO’s exemption guidance and linked self-assessment; do not assume every small club owes the lowest tier or that paying a fee certifies compliance.

RocketClass brings bookings, attendance and parent records together. Your club still needs its own decisions about lawful processing, information, access and retention. This guide does not certify GDPR compliance. Use the practical checklist below to organise a review, and seek advice on uncertain circumstances.

• List the personal information and purposes, including children’s and adults’ information.
• Document Article 6 bases and any Article 9 conditions before processing.
• Check consent requests, photography choices and any PECR marketing requirements.
• Explain actual uses in accessible privacy information for parents and children.
• Review staff access, external sharing, paper records and exported copies.
• Set justified retention periods and an owner for review and disposal.
• Prepare to handle rights requests and security incidents appropriately.
• Review service-provider arrangements and the ICO fee assessment.

• Contracts and liabilities between controllers and processors · Information Commissioner’s Office
• Data protection fee exemptions and self-assessment · Information Commissioner’s Office
• A guide to lawful basis · Information Commissioner’s Office
• A guide to data security · Information Commissioner’s Office