Data Protection Guidance

Under the General Data Protection Regulation there are a number of things Societies and Sports Clubs must ensure are standard practice around personal data.

As not-for-profit membership organisations that process data purely in accordance with their membership activities, Sports Clubs and Societies will be exempt from having to pay a data protection fee to the Information Commissioner’s Office – but they are still required to abide by the rules and principles around data protection.

What does this mean for Societies and Sports Clubs?

• You are entirely responsible for complying with GDPR
• You should only collect, hold and use personal data that you have good reason to have in the first place
• You should only collect, hold or use personal data that the people it is personal to know that you have and approve of you using
• You should only use personal data for the explicit reasons that led to you being given it
• You should only use data that you know to be accurate and up-to-date
• You should only hold the data for the period of time that it is needed for the explicit purpose it was intended for
• You must keep the data secure and delete or destroy it securely when its purpose is served
• You must not release data to any third party – this includes allowing individuals to see each other’s data on a sign-up sheet

In the event of a data protection breach you must immediately contact Jacqui Clements giving full details of what has happened.  The SU's Information Security Manager will contact you and help you deal with the incident.

Frequently Asked Questions