GDPR Is Not as Complicated as You Think
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 govern how you collect, store, and use personal data. For a children's activity provider, this is not an abstract legal concern. You handle sensitive data every day: children's names, medical information, emergency contacts, photographs, and payment details.
The good news is that compliance does not require a law degree. It requires understanding a few core principles and applying them consistently.
What Data Do You Actually Collect?
Before you can comply with GDPR, you need to know what data you hold. Conduct a simple audit:
- Child's data: Name, date of birth, medical conditions, allergies, dietary requirements, ability level, photographs
- Parent/guardian data: Name, email address, phone number, home address, payment details
- Emergency contact data: Name, relationship, phone number
- Staff data: Employment records, DBS details, qualifications, payroll information
- Marketing data: Email lists, social media interactions, website analytics
Write this down. This is the beginning of your Record of Processing Activities (ROPA), which every data controller should maintain.
Lawful Basis for Processing
GDPR requires you to have a lawful basis for processing each type of data. For activity providers, the relevant bases are:
Contract
When a parent books a class, you enter into a contract. Processing their name, contact details, and payment information is necessary to fulfil that contract. This is your lawful basis for most of the data you collect at enrolment.
Legitimate Interest
You can process data where you have a legitimate business interest, provided it does not override the individual's rights. Sending an existing customer an email about next term's classes is legitimate interest. Adding them to a general marketing list without consent is not.
Consent
For marketing to people who are not current customers, and for processing photographs, you need explicit consent. Consent must be freely given, specific, informed, and unambiguous. A pre-ticked box on a form is not valid consent.
Legal Obligation
Some data processing is required by law. Maintaining safeguarding records, for example, is a legal obligation.
Vital Interests
In an emergency, you can process data (such as sharing a child's medical information with paramedics) to protect someone's life.
Children's Data: Extra Care Required
The ICO (Information Commissioner's Office) considers children's data to require additional protection. Key considerations:
- Privacy notices must be written in language a child can understand (where the child is old enough to be the service user)
- Parental consent is required for children under 13 for online services (this includes apps and online booking portals)
- Data minimisation is especially important: do not collect data about children that you do not genuinely need
- The Children's Code (Age Appropriate Design Code) applies if you offer any online services that children are likely to access
Your Privacy Notice
You must provide a privacy notice that tells people:
- Who you are (your business name and contact details)
- What data you collect and why
- Your lawful basis for processing each type of data
- Who you share data with (e.g., your booking system provider, payment processor, governing body)
- How long you keep data
- Their rights (access, correction, deletion, objection)
- How to complain to the ICO
This should be on your website, included in your enrolment pack, and available on request. It does not need to be lengthy, but it must be clear and honest.
Data Retention: How Long Is Too Long?
Do not keep data longer than you need it. Set clear retention periods:
- Active customer data: Keep while the family is enrolled and for a reasonable period after (12-24 months to allow for re-enrolment)
- Financial records: HMRC requires you to keep these for six years
- Safeguarding records: Keep until the child's 25th birthday (or longer if there are ongoing concerns). Seek legal advice for serious cases.
- Staff DBS records: Record the DBS certificate number and date, but do not keep copies of the certificate itself (this is a common mistake)
- Marketing data: Review annually. Remove anyone who has not engaged for 12+ months.
Using a platform like AMES helps with data retention because it stores data centrally with clear records of what you hold and when it was collected, making it straightforward to conduct periodic data reviews.
Subject Access Requests (SARs)
Any individual (or a parent on behalf of their child) has the right to request a copy of all data you hold about them. This is called a Subject Access Request.
- You must respond within one calendar month
- You cannot charge a fee (unless the request is manifestly unfounded or excessive)
- You must verify the identity of the requester
- You must provide the data in a commonly used electronic format
In practice, SARs from parents at small activity businesses are rare. But you need to know the process and be able to respond if one arrives.
Data Breaches: What to Do
A data breach is any event where personal data is accidentally or unlawfully accessed, lost, altered, or disclosed. This could be anything from a lost USB stick to a hacked email account to accidentally sending a group email with all addresses visible in the To field (a surprisingly common breach).
Your Response
- Contain the breach: Stop the data being further compromised
- Assess the risk: What data was affected? How many people? What is the potential harm?
- Notify the ICO: If the breach poses a risk to people's rights and freedoms, you must notify the ICO within 72 hours
- Notify affected individuals: If the breach poses a high risk to them personally
- Document everything: Record what happened, what you did, and what you have changed to prevent recurrence
Actionable Takeaways
- Conduct a data audit this week. List every type of personal data you collect, where it is stored, and why you need it. Delete anything you do not need.
- Publish a privacy notice on your website if you do not already have one. The ICO provides templates you can adapt.
- Set data retention periods and schedule a quarterly review to delete data you no longer need.
- Brief your team. Every staff member who handles personal data should understand the basics of GDPR. A 30-minute team briefing covers the essentials.
