Protecting Your Members' Data

A sailing centre holds information its members and learners would be upset to see leaked: home addresses, children's dates of birth, medical conditions, emergency contacts, payment histories, criminal records check outcomes, safeguarding notes. The law requires that it be protected, but the stronger reason is trust. A parent who hands over a child's medical form is trusting the centre to keep it safe. A centre that loses that trust through a careless breach rarely gets it back. This article covers the practical steps a centre takes to be a responsible custodian of the data it holds.

Know what you hold and where

You cannot protect what you have not found. Make a short data map: each type of personal data, where it lives, who can see it, why you have it and how long you keep it. Include the places people forget: the sign-in sheets, the medical forms in the office drawer, the photographs on instructors' phones, the spreadsheet on the treasurer's laptop, the old booking system nobody closed, the messaging group with three years of parents' messages. Most centres find their data is more scattered than they thought, and the map is the first step to gathering it in.

Keep it in fewer places

Every copy is a risk. Consolidate: one booking and membership system, one staff and rostering system, one secure drive for documents, rather than duplicates on personal devices and in email. Delete the copies once the move is confirmed. Choose systems that hold data in the UK or EU, offer a data processing agreement and let you delete when you need to.

Control who can see what

Not everyone at the centre needs to see everything. The instructor needs their group's medical notes for today; the office needs bookings; the Welfare Officer needs the safeguarding file; the treasurer needs the payments; the committee needs none of the individual detail. Use systems with individual logins and roles, so that each person sees what their job requires and no more, and so that there is a record of who looked. Remove access the day someone leaves.

Lock the devices and the doors

Most breaches at small organisations are physical or careless: a laptop left on a train, a phone without a passcode, a filing cabinet that does not lock, forms left on a bench. Passcodes and encryption on every device that touches centre data. Two-factor authentication on every account that offers it. Paper records in a locked cabinet in a locked room. A clean-desk habit at the end of the day. Shredding for anything that is finished with.

Be careful with messaging and email

Personal messaging apps and email are where personal data leaks most easily: a medical form forwarded to the wrong address, a group chat that includes someone who has left, a photograph of a child sent to a parent who is not theirs. Keep sensitive information in the proper systems and send a link rather than the data. Check the recipient before sending anything personal. Keep young people's communications within your safeguarding rules, never in private messages.

Protect children's data especially

Children's data deserves extra care: collect only what the course needs, keep medical and consent information separate and restricted, handle photographs under clear consent, never identify a child by full name online, and do not use children's data for anything beyond the activity without a parent's agreement. Treat the data of under-18 staff the same way.

Train the people

Most breaches are caused by someone who did not know better. A short briefing at induction and a reminder each season: what personal data is, where it lives, who may see it, how to handle forms and photographs, what to do if something goes wrong. Make it clear that reporting a mistake quickly is always the right thing and will not be punished.

Keep only what you need, for only as long as you need

Data that no longer exists cannot leak. Set retention periods for each type: bookings and course records for the time a claim could be made, accident records longer, safeguarding records per the relevant guidance, membership data while someone is a member and briefly after, marketing lists until consent is withdrawn. Run a deletion each year and record that it was done. Keeping everything forever is the opposite of protection.

Prepare for the bad day

Decide now what happens if data is lost or exposed: who is told, who assesses the risk, how the people affected are contacted, and when the regulator must be notified, which in the UK and Ireland is within 72 hours for breaches likely to cause risk to individuals. Write it on one page. Keep a log of all incidents, including the ones that turned out to be minor. A centre with a plan handles a breach calmly; one without a plan makes it worse.

Use the suppliers properly

Your booking, rostering, email and payment providers hold your data on your behalf. Have a written agreement with each, know where they store it, check they will delete it when asked, and ask what security they have. A supplier breach is still your breach in the eyes of your members.

Answer requests promptly

Members and learners have the right to see what you hold about them, to correct it and often to have it deleted. Have a simple procedure and respond within a month. A good data map makes this a morning's work.

Tell people what you do

A clear, plain privacy notice on the website and linked from the forms, saying what you collect, why, who sees it, how long you keep it and their rights, is a legal requirement and a trust signal. Keep it honest and short enough to read.

The standard to aim for

A member or parent should be able to ask "where is my information, who can see it, and when will you delete it?" and receive a clear, confident answer. A centre that can give that answer is a responsible custodian, and its members will trust it with the information it needs to keep them and their children safe.

This article is general guidance for RYA centres and clubs. Schemes, awards and requirements change — always check the latest official RYA guidance and your recognition paperwork before acting. ActivityRoster helps you run the rostering, qualifications and safety-cover side of all of this in one place.