Club GDPR

A few quick questions about your club so we only show what's relevant. These aren't scored.

1. Does your club have members or participants under 18?
2. Does the club have a website or social media pages, or share photos and videos of members?
3. Does the club collect any medical or injury information, such as medical consent forms, allergy details, injury reports or fitness and performance tracking?

Children and their parents should be able to take part without worrying about their privacy. A little extra care goes a long way.

Asked only if you answer “Yes” to: Does your club have members or participants under 18?

1. Are parents or guardians given the club's privacy information when they register a child, in words they can easily follow? Registrar or Children's officer
2. Do coaches contact juvenile members through parents or official group channels, in line with your safeguarding policy, rather than private one-to-one messages? Children's officer
3. Is access to juvenile members' details (addresses, phone numbers, dates of birth) limited to the people who need it? Registrar
4. Are Garda vetting outcomes and related paperwork stored securely, seen only by your designated vetting contact or liaison, and not kept longer than needed? Children's officer

From the help text

Parents usually handle registration for younger children, so the information needs to reach them. 'Yes' means the juvenile registration form includes or links to the privacy notice.

Sharing the club's successes is part of club life. Here's how to do it with members' privacy in mind.

Asked only if you answer “Yes” to: Does the club have a website or social media pages, or share photos and videos of members?

1. Does the club have a photo and video policy covering who can take photos, where they're shared and how long they stay up? PRO
2. Can members, and parents of juveniles, easily say they don't want photos published, and does the club respect that? PRO
3. When you publish photos of under-18s, how are they captioned? PRO
4. Does the club website show the privacy notice and ask before setting any non-essential cookies (analytics, social media embeds)? Webmaster or PRO

From the help text

A short policy saves arguments and gives volunteers confidence. 'Yes' means the committee has agreed one and it's been shared with members.

Health details help keep people safe, but they need the most care of anything the club holds.

Asked only if you answer “Yes” to: Does the club collect any medical or injury information, such as medical consent forms, allergy details, injury reports or fitness and performance tracking?

1. Does the club only collect the medical information it genuinely needs, and has it worked out the legal basis for doing so? Secretary
2. Is medical and injury information stored securely and seen only by those who need it (such as the team coach or first aider)? Secretary or Head coach
3. Does the club track fitness or performance data (for example GPS vests, heart-rate monitors or fitness testing)? Head coach

From the help text

Health data needs both a lawful basis and an extra condition under GDPR. 'Yes' means you can explain why each piece is collected, for example emergency contact and allergy details for away trips.

Club data passes through many hands. Clear roles and a good handover make all the difference.

1. Is a committee member responsible for data protection, and do members know how to contact them? Chairperson
2. Are coaches, team managers and other volunteers who handle member details given a short briefing on the club's data protection rules? Secretary
3. When officers or coaches step down, does the club get its records back and remove their access to club email, drives and apps? Secretary
4. How are team group chats (WhatsApp or similar) run? Secretary

From the help text

It doesn't need to be a formal Data Protection Officer, just someone who owns it. 'Yes' means the role is agreed and the contact is in the privacy notice.

You don't need an IT department, just a few good habits applied consistently.

1. Where is club member data kept? Tick all that apply. Secretary
2. Does each volunteer use their own login for club systems, rather than a shared password passed around? Secretary
3. Is two-step login (a code or app prompt as well as a password) turned on for club email, social media and your club management system? Secretary or PRO
4. Where volunteers use their own phones or laptops for club business, are there simple rules (screen lock, no downloads to shared family devices, delete when you step down)? Secretary

From the help text

The DPC's survey of sports clubs found a third use personal devices for club data. We're looking for club-controlled systems wherever possible.

Knowing what to do before something happens takes the panic out of it.

1. Does the club know what to do if member data is lost, stolen or sent to the wrong person, including when to report it to the Data Protection Commission within 72 hours? Knock-out Secretary
2. Does the club keep a record of any breaches or near misses, even minor ones not reported to the DPC? Secretary
3. If a member asks for a copy of the information the club holds about them, would you know how to handle it within one month? Secretary
4. When did the committee last review the club's data protection arrangements? Secretary

From the help text

A breach that poses a risk to people must be reported to the DPC within 72 hours, and people told if the risk is high. 'Yes' means a short written plan and a named person who makes the call.