A junior football club holds a remarkable amount of information about children: names, dates of birth, addresses, photographs, medical notes, emergency contacts, attendance, sometimes injury history. It is gathered by volunteers, usually at speed, and it ends up wherever was convenient at the time.
That is normally a phone, a personal email account, a shared spreadsheet and a group chat. Nobody intends it; it accumulates.
The obligations here are real, and they apply to the club whether or not anyone has read them. The good news is that the practical fixes are neither expensive nor technical.
Where the risk actually sits
Not in the club’s intentions. In four specific places:
1. Data on personal devices. A coach’s phone has the squad list, the medical notes and photographs of other people’s children. When they leave the club, it goes with them, and nobody has a way to remove it.
2. Consent that cannot be produced. A parent agreed to photographs at registration, verbally, two seasons ago. Nobody can now say what they agreed to, when, or whether they later changed their mind.
3. No retention limit. Records of players who left four years ago sit in the same spreadsheet as the current squad, because nobody has ever deleted anything.
4. Everyone can see everything. A volunteer helping with fixtures has access to medical information they have no need for, because the spreadsheet is one file.
None of those requires bad intent. All of them are the default outcome of running a club on general-purpose tools.
Consent has to be a record, not a memory
The workable rule is that consent should be specific, recorded, and revocable without an argument.
In practice that means capturing each permission separately rather than as one blanket agreement at sign-up: photography for the club’s own use, photography on social media, medical information sharing with coaches, contact by email. They are genuinely different decisions and parents often answer them differently.
It also means the parent can see what they agreed to and change it themselves. A consent that requires emailing the secretary to withdraw is a consent that will not be withdrawn, which is not the same as one that stands.
Retention is a decision, not an oversight
Most clubs have never made a retention decision, which means the answer is “forever”. Deciding it properly takes one committee meeting:
- How long after a player leaves do we keep their record?
- What about injury or medical notes, which may need to be kept longer?
- What happens to photographs of them?
- Who is responsible for the deletion actually happening?
Writing it down is most of the work. Software should then do the deleting, because a policy that relies on somebody remembering in three years is a policy that will not run.
Give people only what their job needs
The safest arrangement is that access follows the role. A coach needs medical notes for their own squad. A treasurer needs payment status and does not need medical notes at all. A parent needs their own child and nobody else’s.
This is straightforward when the system is designed for it and effectively impossible when the data lives in a shared file, which is the real argument against running a club on a spreadsheet.
What we built, and why
The Performance Centre handles registration, consent forms, attendance, availability and progress tracking for clubs from grassroots to first team, with consent capture, retention rules, role-based visibility and audit trails built in from the start rather than added once someone asked about them.
That last part matters more than it sounds. Retrofitting consent and retention onto a system that assumed neither is difficult and usually incomplete. Building for it at the beginning costs almost nothing.
A short checklist for your club
- Is any squad or medical data on a personal device or personal email account?
- Can you show what each parent consented to, and when?
- Can a parent change their mind without emailing anybody?
- Do you know when you delete a former player’s record, and does it happen?
- Can a volunteer see information they have no need for?
If more than one answer is uncomfortable, that is normal. It is also fixable, and it is a great deal easier to fix before someone asks.
This is general guidance rather than legal advice; a club with specific concerns should take its own. If you are building or reviewing a platform that holds data about children, get in touch, or read more about our work in sport and health and life sciences.