GDPR for Sailing Clubs and Schools

A sailing club or school holds more personal data than it usually realises: names, addresses, dates of birth, medical conditions, emergency contacts, photographs, payment details, criminal records check outcomes, safeguarding notes and the personal details of hundreds of children. Data protection law in the UK, under the UK GDPR and the Data Protection Act 2018, and in Ireland under the EU GDPR and the Data Protection Act 2018, applies to all of it. The good news is that compliance for a typical centre is mostly common sense done deliberately. This is a plain-English guide to what matters.

The principles in practice

The law rests on a handful of principles: process data lawfully, fairly and transparently; collect it for specified purposes and do not use it for others; collect only what you need; keep it accurate; keep it only as long as necessary; keep it secure; and be able to show you do all of this. For a centre that means: tell people what you collect and why, collect only what the course or membership needs, keep it up to date, delete it when it is no longer needed, protect it, and keep a short record of your decisions.

Know what you hold

Start with a data map: a one-page list of each type of personal data, where it lives, who can see it, why you have it and how long you keep it. Booking system, membership database, paper sign-in sheets, medical forms in the office, the Welfare Officer's file, instructor records, the photo archive, the email marketing list, the WhatsApp group. Most centres find data in more places than they expected, including personal phones and old spreadsheets. The map is the foundation for everything else and is the first thing a regulator would ask for.

Lawful basis

Every use of personal data needs a lawful basis. For most centre activity it is contract (you need the data to deliver the course someone booked), legal obligation (safeguarding records, health and safety, tax) or legitimate interests (keeping members informed about club activities, maintaining safety records). Consent is needed for some things, notably marketing emails to people who are not customers, and for photographs used in promotion. Special category data such as health information needs an additional condition; for medical information collected to keep a learner safe, explicit consent is usually the route, and the form should say so.

Write your lawful basis for each type of processing into the data map. It takes an hour and settles most later questions.

Privacy notices

People have a right to know what you do with their data. A clear privacy notice on your website and linked from your booking and membership forms, written in plain language, covers it: what you collect, why, the lawful basis, who you share it with, how long you keep it, their rights and how to contact you. Keep a shorter version for children and parents. Avoid copying a corporate template full of jargon; a notice nobody can understand is not transparent.

Children's data

Children's data deserves particular care. Collect only what is needed, explain to parents what you hold, keep medical and safeguarding information separately and securely, be careful with photographs and names online, and do not market directly to children. If a child's data is used for anything beyond the course, consider whether parental consent is needed. Treat the data of your under-18 staff and assistant instructors with the same care.

Security

Most data breaches at small organisations are mundane: a laptop left on a train, a spreadsheet emailed to the wrong person, a sign-in sheet left on the bench, a shared password on a sticky note. Practical controls: password-protect devices, use a system with individual logins rather than shared ones, turn on two-factor authentication where offered, lock paper records away, shred old forms, limit who can see sensitive information, and be cautious about personal data in messaging apps. Choose suppliers, such as booking and rostering software, that store data in the UK or EU, offer a data processing agreement and can delete data when asked.

Retention

Deciding how long to keep things, and then actually deleting them, is where most centres fall short. Set a retention period for each data type based on why you need it: booking records for the period a claim could be brought, accident records longer, safeguarding records according to the relevant guidance, membership data while someone is a member and a short period after, marketing lists until consent is withdrawn. Write the periods into the data map and build a yearly deletion routine. Keeping everything forever is not a policy; it is a liability.

Individual rights

People can ask to see the data you hold about them, to have it corrected, and in many cases to have it deleted or to object to its use. You must respond within a month. Have a simple procedure: who receives requests, how identity is confirmed, how the data is gathered from each place it lives, and how the response is sent. A good data map makes a subject access request a morning's work rather than a crisis.

Breaches

If personal data is lost, stolen or exposed, you must assess the risk to the people affected quickly. Breaches likely to result in a risk to individuals must be reported to the Information Commissioner's Office in the UK or the Data Protection Commission in Ireland within 72 hours, and in serious cases the individuals themselves must be told. Keep a log of all breaches, including those you decide not to report, with your reasoning. Brief your team that reporting a suspected breach promptly is always the right thing to do.

Sharing data

Be clear about who you share data with and why: the RYA for certificates, insurers, your software suppliers, schools and group organisers, emergency services. Share the minimum needed. Have written agreements with suppliers who process data on your behalf. Do not share member lists with third parties for marketing.

Volunteers and committees

Committee members and volunteers who handle data are covered by your policies and need the same brief as staff. Make sure data does not walk out of the club on a departing treasurer's laptop or in a former secretary's email account. Use club accounts and systems, not personal ones.

Registration and accountability

Most organisations processing personal data in the UK must pay the ICO data protection fee; check whether your club or school is exempt. Keep a short record of your data map, policies, decisions and training; this is your evidence of accountability. Appoint someone to own data protection, even if the role is part of another job.

A practical starting list

1. Write the data map.
2. Agree the lawful basis for each type of processing.
3. Publish a plain-language privacy notice and link it from your forms.
4. Fix the obvious security gaps: shared logins, unlocked cabinets, personal devices.
5. Set retention periods and delete what is past them.
6. Write the subject access and breach procedures on one page each.
7. Brief staff, volunteers and committee members.
8. Review annually.

Data protection done this way is not a burden; it is part of the trust that lets parents hand you their children and members hand you their details. It also tends to tidy up a great deal of operational mess along the way.

This article is general guidance for RYA centres and clubs. Schemes, awards and requirements change — always check the latest official RYA guidance and your recognition paperwork before acting. ActivityRoster helps you run the rostering, qualifications and safety-cover side of all of this in one place.