What is GDPR?

The General Data Protection Regulation (GDPR), retained in UK law as the UK GDPR alongside the Data Protection Act 2018, sets out strict rules for how you handle personal data. For children's activity businesses, this includes names, contact details, medical information, photographs, attendance records, and payment details for both children and their parents or guardians.

Key GDPR obligations for activity providers include: having a lawful basis for processing data (usually legitimate interests or contract performance for operational data, and explicit consent for marketing); providing a clear, accessible privacy notice explaining what data you collect and why; obtaining parental consent before collecting data about children under 13; implementing appropriate security measures to protect data; maintaining records of your processing activities; and being able to respond to data subject access requests (DSARs) within one calendar month.

Particular areas of attention for activity businesses include photography and video policies (where children are identifiable), sharing registers or achievement information on social media, storing medical or SEN information securely, and marketing communications. If you use booking software, ensure your provider is GDPR-compliant and has appropriate data processing agreements in place. Data breaches involving children's information must be reported to the ICO within 72 hours if they pose a risk to individuals' rights and freedoms.