What is Data Protection?

Data protection encompasses the laws, policies, and practical measures that govern how you collect, use, store, and dispose of personal information. For children's activity businesses, this is governed primarily by the UK GDPR and the Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO). You are likely a "data controller" — meaning you decide why and how personal data is processed — which carries specific legal obligations.

The data you typically hold includes children's names, dates of birth, and medical information; parents' contact details and payment information; attendance records; photographs and videos; staff employment records and DBS information; and marketing consent records. Each type of data has different sensitivity levels and handling requirements. Children's medical data and DBS information are classified as "special category data" requiring enhanced protection.

Practical data protection measures include: encrypting digital data and securing physical records, limiting access to personal data to those who need it, having clear data retention policies (how long you keep information after a family leaves), training staff on data handling, using secure communication channels, having a process for handling data subject access requests, and maintaining a data breach response plan. If your business has a turnover above a certain threshold, you must register with the ICO and pay an annual data protection fee.