GDPR Is Not as Complicated as You Think

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 govern how you collect, store, and use personal data. For a children's activity provider, this is not an abstract legal concern. You handle sensitive data every day: children's names, medical information, emergency contacts, photographs, and payment details.

The good news is that compliance does not require a law degree. It requires understanding a few core principles and applying them consistently.

What Data Do You Actually Collect?

Before you can comply with GDPR, you need to know what data you hold. Conduct a simple audit:

Digital privacy and data protection concept with secure lock icon — Protecting personal data is a legal requirement and builds trust with families

Child's data: Name, date of birth, medical conditions, allergies, dietary requirements, ability level, photographs
Parent/guardian data: Name, email address, phone number, home address, payment details
Emergency contact data: Name, relationship, phone number
Staff data: Employment records, DBS details, qualifications, payroll information
Marketing data: Email lists, social media interactions, website analytics

Write this down. This is the beginning of your Record of Processing Activities (ROPA), which every data controller should maintain.

Lawful Basis for Processing

GDPR requires you to have a lawful basis for processing each type of data. For activity providers, the relevant bases are:

Contract

When a parent books a class, you enter into a contract. Processing their name, contact details, and payment information is necessary to fulfil that contract. This is your lawful basis for most of the data you collect at enrolment.

Legitimate Interest

You can process data where you have a legitimate business interest, provided it does not override the individual's rights. Sending an existing customer an email about next term's classes is legitimate interest. Adding them to a general marketing list without consent is not.

Consent

For marketing to people who are not current customers, and for processing photographs, you need explicit consent. Consent must be freely given, specific, informed, and unambiguous. A pre-ticked box on a form is not valid consent.

Legal Obligation

Some data processing is required by law. Maintaining safeguarding records, for example, is a legal obligation.

Vital Interests

In an emergency, you can process data (such as sharing a child's medical information with paramedics) to protect someone's life.

Children's Data: Extra Care Required

The ICO (Information Commissioner's Office) considers children's data to require additional protection. Key considerations:

Privacy notices must be written in language a child can understand (where the child is old enough to be the service user)
Parental consent is required for children under 13 for online services (this includes apps and online booking portals)
Data minimisation is especially important: do not collect data about children that you do not genuinely need
The Children's Code (Age Appropriate Design Code) applies if you offer any online services that children are likely to access

Your Privacy Notice

You must provide a privacy notice that tells people:

Who you are (your business name and contact details)
What data you collect and why
Your lawful basis for processing each type of data
Who you share data with (e.g., your booking system provider, payment processor, governing body)
How long you keep data
Their rights (access, correction, deletion, objection)
How to complain to the ICO

This should be on your website, included in your enrolment pack, and available on request. It does not need to be lengthy, but it must be clear and honest.

Registration forms and digital devices used for collecting member information — Every piece of data you collect must have a lawful basis and clear retention policy

Data Retention: How Long Is Too Long?

Do not keep data longer than you need it. Set clear retention periods:

Active customer data: Keep while the family is enrolled and for a reasonable period after (12-24 months to allow for re-enrolment)
Financial records: HMRC requires you to keep these for six years
Safeguarding records: Keep until the child's 25th birthday (or longer if there are ongoing concerns). Seek legal advice for serious cases.
Staff DBS records: Record the DBS certificate number and date, but do not keep copies of the certificate itself (this is a common mistake)
Marketing data: Review annually. Remove anyone who has not engaged for 12+ months.

Using a platform like AMES helps with data retention because it stores data centrally with clear records of what you hold and when it was collected, making it straightforward to conduct periodic data reviews.

Subject Access Requests (SARs)

Any individual (or a parent on behalf of their child) has the right to request a copy of all data you hold about them. This is called a Subject Access Request.

You must respond within one calendar month
You cannot charge a fee (unless the request is manifestly unfounded or excessive)
You must verify the identity of the requester
You must provide the data in a commonly used electronic format

In practice, SARs from parents at small activity businesses are rare. But you need to know the process and be able to respond if one arrives.

Data Breaches: What to Do

A data breach is any event where personal data is accidentally or unlawfully accessed, lost, altered, or disclosed. This could be anything from a lost USB stick to a hacked email account to accidentally sending a group email with all addresses visible in the To field (a surprisingly common breach).

Your Response

Contain the breach: Stop the data being further compromised
Assess the risk: What data was affected? How many people? What is the potential harm?
Notify the ICO: If the breach poses a risk to people's rights and freedoms, you must notify the ICO within 72 hours
Notify affected individuals: If the breach poses a high risk to them personally
Document everything: Record what happened, what you did, and what you have changed to prevent recurrence

Actionable Takeaways

Conduct a data audit this week. List every type of personal data you collect, where it is stored, and why you need it. Delete anything you do not need.
Publish a privacy notice on your website if you do not already have one. The ICO provides templates you can adapt.
Set data retention periods and schedule a quarterly review to delete data you no longer need.
Brief your team. Every staff member who handles personal data should understand the basics of GDPR. A 30-minute team briefing covers the essentials.