Children's data for a club or activity business

A football club, a dance school, a holiday camp, a tutoring centre or a scout group holds children's names, dates of birth, medical conditions, photographs, parents' contact details and the safeguarding concerns that arise, and the law treats children's data as deserving specific protection, which means a notice for parents and for children old enough to read it, consent sought from the right person, medical and safeguarding data handled under the right conditions, and a line on photographs and on messaging that the organisation enforces. The pack (privacy notice, cookie notice and consent guidance) is drafted for the business for £595, fixed, in five working days.

Who this is for

Sports clubs, dance and drama schools, swimming schools, holiday clubs, tutoring businesses, youth groups and any organisation in England and Wales that runs activities for children and holds their data.

What matters in handling children's data

Why children's data is treated differently

The UK GDPR says in its recitals that children merit specific protection because they may be less aware of the risks and of their rights, Under Article 13 of the UK GDPR the business, being the controller, has to tell them (and their parents) what it does with their data in language they can understand, Article 12 requires the information to be clear and plain, and the Information Commissioner's guidance expects an organisation processing children's data to have considered the child's best interests, to collect only what the activity needs, to avoid profiling and marketing to children, and to apply the age appropriate design code under section 123 of the Data Protection Act 2018 where the organisation provides an online service children use; the notice is drafted in two layers, one for parents and one for children old enough to read it.

Parents, consent and the age at which the child decides

For most of what a club does (registration, the activity, safeguarding, emergency contact) the basis is the contract with the parent under Article 6(1)(b) and the organisation's legitimate interests or legal obligations rather than consent, but where consent is used (photographs, marketing, optional activities, an online service) the organisation should seek it from the parent for younger children and may accept it from the child where the child has sufficient understanding, with section 9 of the Data Protection Act 2018 setting thirteen as the age at which a child may consent to an information society service; the forms drafted with the pack say whose consent is sought for what, and the organisation should treat a parent with parental responsibility under the Children Act 1989 as entitled to information about the child unless a court order says otherwise, without adjudicating between separated parents.

Registration, medical information and the data that is special category

The registration form collects the child's details, the parent's contact and emergency details, medical conditions, allergies, medication, additional needs and sometimes ethnicity or religion for monitoring or dietary reasons, and the medical, needs, ethnicity and religion data is special category data under Article 9 of the UK GDPR processed under explicit consent (the parent choosing to disclose for the child's safety) or under the safeguarding and health conditions in Schedule 1 to the Data Protection Act 2018 with the appropriate policy document; the notice states the condition, who sees the medical information, how it is carried to the session (a sealed sheet or the app, not a group chat) and how it is kept.

Safeguarding records and the sharing the law requires

Concerns about a child's welfare are recorded by the designated safeguarding lead under the organisation's safeguarding policy, processed under the safeguarding of children condition in Schedule 1 to the Data Protection Act 2018 (which permits processing without consent where seeking it would prejudice the protection of the child), shared with the local authority, the police and the governing body where the law and the policy require, and kept for the long periods the safeguarding guidance sets, and the notice should say so in terms that do not deter a parent from raising a concern; the organisation's staff and volunteers are checked through the Disclosure and Barring Service where their role is eligible, which the staff and volunteer notice covers.

Photographs, apps and the messages between coaches and children

Photographs and video of children for the organisation's website, social media and the governing body's publications need the parent's consent (and the child's agreement where old enough), recorded on the form, revocable, with the image removed when it is withdrawn, with no name alongside the image and no image where consent is absent, and the organisation's photographers and parents at events briefed on what may be posted; the apps the organisation uses for registration, attendance, payments, team selection and communication are processors under Article 28 (with the age appropriate design code applying where children use them), and the organisation's policy should prohibit adults from messaging children directly on personal accounts, require communication through the parent or a group the parent is in, and say so in the notice, because the safeguarding risk and the data protection risk coincide.

Retention after the child leaves and the records that stay

The notice should state the retention: membership and registration records for the membership and a stated period after, medical information deleted when the child leaves unless an incident requires it to be kept, accident records for the periods the regulations and limitation periods require (which for a child run from the age of eighteen under the Limitation Act 1980), safeguarding records for the periods the guidance sets, photographs for as long as consent stands, and the governing body's own records under its own notice; it should cover the individual's rights (access, rectification, erasure, restriction, portability, objection), how to exercise them (the parent for a younger child, the child with sufficient understanding), the one-month time limit, and the right to complain to the Information Commissioner's Office, and the business's registration with the Information Commissioner's Office, under the Data Protection (Charges and Information) Regulations 2018, belongs in the notice, with the exemption for some not-for-profit bodies checked.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need parents' consent to hold children's medical information?

The parent's explicit consent when they disclose it for the child's safety, or the safeguarding and health conditions with the policy document the Act requires. The notice states which, and limits who sees it and how it is carried to sessions.

A parent has withdrawn consent for photographs. What do we do?

Remove the child's images from the website and social media within the period the policy states, record the withdrawal, and brief the coaches. Consent for photographs is revocable and the form says so.

Can our coaches message children about training?

Not directly on personal accounts. Communication goes through the parent or a group the parent is in, which the policy requires and the notice states. The safeguarding risk and the data risk are the same risk.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a tutor or school
• Photography and filming consent at events

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.