GDPR for Sports Clubs and Community Groups
18 March 2026 · Mary Molloy Solicitors
Clubs run on volunteers, spreadsheets and WhatsApp — and hold more personal data than most small companies: members and children, medical notes for trips, vetting outcomes, photos across a decade of socials. The law applies, but proportionately, and club compliance is genuinely achievable by a committee that knows the half-dozen rules that matter.
The register and the handover
Keep membership data in one controlled place — a club account, not five personal laptops — collect only what running the club requires, and retire data when members leave. The classic community-sector failure is the handover: the outgoing secretary keeps everything, the incoming one starts a new spreadsheet, and the club's data diaspora grows annually. An officer transition checklist (transfer, then delete) fixes it permanently.
Children: photos, medical notes and the group chat
Photo consent at registration, with genuine separate choices for team photos, website and social media — and a working system for who opted out, applied before posting, not after complaint. Medical information for activities is special category data: collect for the event, restrict to the leaders who need it, delete when the season ends. And keep children's welfare and medical matters out of WhatsApp groups entirely; announcement-style channels handle general communication without exposing every parent's number to every other parent.
Vetting, fundraising and when it goes wrong
Vetting records are sensitive: minimal access, defined retention under the applicable vetting guidance, never discussed in committee minutes by name. Fundraising messages follow marketing rules — consent or the narrow existing-supporter footing, an opt-out on everything. And when the wrong attachment goes to the full list, it is a breach like any organisation's: contain, assess risk, document, notify the DPC within 72 hours unless risk is unlikely. Our breach checklist was written to be usable by a volunteer secretary at ten in the evening — because that is who handles these.
Read more in our main guide: GDPR for Clubs, Charities and Schools · or back to the blog.
This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.