Guides

GDPR for cricket clubs: a plain-English guide

Last updated 2 November 2026

Not legal advice. This guide is general information about UK GDPR and the Data Protection Act 2018 as they apply to amateur cricket clubs. For your club's specific situation, check the ICO's guidance or speak to a qualified adviser.

Every cricket club runs on personal data. There's the membership list, the junior registration forms, the team WhatsApp group and the scorebook with the name of every player in it. None of that is a problem. UK GDPR doesn't stop clubs running. It asks you to know what you hold, why you hold it, who can see it and when you'll delete it.

This guide covers the basics for a volunteer-run club, with no jargon and no scare stories.

Does UK GDPR apply to a small volunteer club?

Yes. UK GDPR applies to organisations that handle personal data, including clubs run entirely by volunteers. The club is usually the controller, which means it decides why and how the data is used. Committee members and volunteers handle the data on the club's behalf.

Most organisations that use personal information also need to pay the ICO data protection fee, unless they are exempt. Use the ICO's fee self-assessment to check, rather than guessing.

What personal data does a cricket club hold?

More than most committees realise. A typical list:

Membership records: names, addresses, email addresses, phone numbers, date of birth, membership category and subscription payments.
Junior records: child's name and date of birth, school year, and parent or guardian contact details.
Emergency contacts and medical information: allergies, asthma, epilepsy, medication. Health data is "special category data" and needs extra care (see below).
Selection and availability: who's available on Saturday, who was picked and team sheets.
Match records: scorecards, averages and results published on Play-Cricket or the club website.
Photos and video: match photos, presentation nights and social media posts.
Safeguarding and DBS records: checks on coaches and volunteers. Handle these strictly in line with ECB safeguarding guidance.
Bar, kit and payment records: card payments, bank details for direct debits and kit orders.

Practical step: write all of this down in a simple spreadsheet showing what you hold, where it is, who can access it and why you have it. It's the backbone of everything else.

Lawful basis: why you're allowed to use the data

Under UK GDPR you need a lawful basis for each use of personal data. The ICO's guide to lawful basis now lists seven, including "recognised legitimate interest", which was added by the Data (Use and Access) Act 2025. Clubs mostly rely on three:

Contract. When someone joins, there's an agreement: they pay subs and you provide cricket. You can use the data needed to run their membership, such as contact details, fixtures, selection and subscriptions.
Legitimate interests. Running the club sensibly: sending club news to members, publishing scorecards and keeping basic match records. Weigh the club's interest against the person's, and write down that you did.
Legal obligation. For example, keeping financial and tax records for HMRC.

Consent is often overused. Under UK GDPR it must be freely given, specific, informed and unambiguous, and people must be able to withdraw it easily (ICO: what is valid consent?). Use it where people really have a choice, such as using a child's photo on social media. Don't rely on it for things the club needs to do anyway, like contacting a player about selection.

Special category data (medical information)

Health information needs a lawful basis and a separate condition under Article 9. For clubs this is usually explicit consent from the member, or from the parent for a child (ICO: conditions for processing special category data). Collect only what coaches need to keep people safe. Store it securely and limit it to the people who need it, such as the junior coach and the welfare officer, not the whole committee.

Juniors and parental consent

Juniors are where clubs need to be most careful.

Children have rights over their own data, even though parents usually act for them.
Parental consent where consent is the basis. For online services offered directly to children, UK GDPR sets the age of consent at 13. Below 13, consent must come from an adult with parental responsibility (ICO: children and consent for online services). Many clubs simply collect parental consent for all juniors, which is a sensible, cautious approach.
Photos. Follow the ECB's safeguarding guidance on photography, get permission before publishing images of juniors, and respect parents who opt out.
Contacting juniors. Communicate through parents for younger players. Don't message children one-to-one in private channels, including WhatsApp.
Minimise. Junior registration forms tend to grow over time. Ask only for what you'll use.

On CricketRight, parents reply to availability for their child, so contact about junior cricket goes through parents. Phone numbers and email addresses stay with club staff: parents and players don't see each other's contact details.

WhatsApp groups

WhatsApp is how most club cricket is organised. Using it isn't against data protection law in itself, but it creates real risks:

Phone numbers are visible to everyone in the group. Adding someone to a big group shares their number with people they may not know. Use announcement-only groups, or ask before adding people.
Junior groups. Keep junior groups for parents, with more than one club official as admin.
Medical and sensitive information. Don't share health details, safeguarding concerns or disciplinary matters in a group chat.
People who leave. When someone leaves the club or a team, remove them from the group. The same applies to admins who step down.
Personal phones. Club data on volunteers' phones is still club data. Agree some simple rules, such as deleting old groups at the end of the season and not forwarding screenshots.

A dedicated availability and selection tool takes names, numbers and Yes/No replies out of the group chat, so WhatsApp is left for the banter.

How long should you keep data?

UK GDPR says you should keep personal data only for as long as you need it. There's no fixed number for most club data, so the club decides and writes it down in a retention policy. These are suggestions, not legal requirements:

Data	Suggested retention
Current member records	While they're a member
Lapsed members	Up to 1–2 seasons, then delete or anonymise
Availability and team selection	Current season plus one
Junior medical and consent forms	Renew each season; delete when the child leaves
Financial and tax records	Usually 6 years (HMRC guidance)
Safeguarding records	Follow current ECB safeguarding guidance
Scorecards and statistics	Can be kept long-term as club history

Once a year, ideally at the end of the season, go through the spreadsheets, shared drives, old email lists and WhatsApp groups and delete what you no longer need.

People's rights

Members can ask to see the data you hold on them (a subject access request). You must respond without undue delay and within one month, which can be extended by up to two further months for complex requests (ICO: guide to subject access). People can also ask you to correct their data, delete it in many cases, or stop using it for direct marketing. Nominate one committee member to handle these requests.

Data breaches

A breach could be a lost laptop, a membership list emailed to the wrong people, or someone added to the wrong WhatsApp group. If a breach is likely to put people's rights at risk, you must tell the ICO as soon as possible and, where feasible, within 72 hours of becoming aware of it (ICO: personal data breaches). Keep a short log of every breach, even minor ones you don't need to report.

Using software suppliers (and why you need a DPA)

When you use an app to run the club, the supplier is usually a processor acting for the club. UK GDPR requires a written contract with a processor, often called a data processing agreement (DPA). Check that your suppliers have one, that data is stored securely, and where it's held.

CricketRight's data processing agreement explains what we process for your club and how we protect it.

A GDPR checklist for cricket clubs

Check whether the club needs to pay the ICO data protection fee
Nominate a committee member responsible for data protection
List what personal data you hold, where it is and who has access
Record your lawful basis for each use
Publish a short, plain-English privacy notice on your website and membership forms
Get parental consent for junior photos and medical information, and renew it each season
Get explicit consent for medical information and limit who sees it
Set WhatsApp rules: parents only in junior groups, more than one admin, no medical details, remove leavers
Agree a retention policy and do an end-of-season clear-out
Use strong passwords and two-factor authentication on club email and shared drives
Check every software supplier has a data processing agreement
Know how to handle a subject access request (one month) and a breach (72 hours where feasible)
Brief new committee members and team captains each season

FAQ

Does GDPR apply to a small volunteer cricket club?

Yes. UK GDPR applies to clubs run by volunteers. The club is usually the controller for its members' data.

Do we need parental consent for junior players?

Where you rely on consent for an online service offered directly to a child, a parent must consent for children under 13. Many clubs collect parental consent for all juniors as a cautious approach.

How quickly must a club answer a subject access request?

Without undue delay and within one month, extendable by up to two more months for complex requests.

When does a club have to report a data breach?

If a breach is likely to put people's rights at risk, tell the ICO as soon as possible and, where feasible, within 72 hours.