GDPR also applies to sports clubs and associations. Here is a practical guide to what you need to consider when processing personal data.
GDPR doesn't only apply to large companies. Your sports club and your association also process personal data — names, addresses, phone numbers, email addresses, payment information and health information. That means you are subject to the same data protection rules as everyone else.
Fortunately, you don't need a lawyer to follow the rules. In this article we give you a practical overview of what GDPR means for sports clubs and associations, and what you specifically need to do.
Rubic is GDPR-compliant and operated in Norway — read more about security →
What is GDPR — in brief?
GDPR (General Data Protection Regulation) is the EU's data protection regulation, which also applies in Norway through personopplysningsloven (the Personal Data Act). The rules give individuals rights over their own data and impose obligations on organisations when they collect and use personal data.
For a sports club or an association, this means in practice:
- You must know what personal data you collect
- You must have a lawful basis for processing it
- You must store it securely
- You must be able to delete it when it is no longer needed
What personal data does a sports club process?
More than you might think:
Member data: Name, date of birth, address, phone, email, membership number.
Payment information: Membership fee payments, invoice data, Vipps transactions, account numbers.
Activity data: Training attendance, match results, group membership.
Health information: Allergies, injuries, medical information — especially for children. These are “special categories” of personal data with extra strict requirements.
Photos and video: Match photos, team photos, social media content.
Volunteer data: Contact details, availability, shift history.
The most important GDPR obligations for your club
1. Have a privacy policy
You must inform members about how their personal data is used. Create a simple privacy policy that explains:
- What data you collect
- Why you collect it (the purpose)
- Who has access
- How long you keep it
- How people can request access, correction or deletion
It should be available on the club's website and referred to when people join.
2. Have a lawful basis for processing
For each purpose for which you process data, you need a lawful basis. The most common ones for sports clubs:
- Contract: Membership is an agreement — you need personal data to administer it.
- Legitimate interest: Sending training notices to active members is a natural part of the purpose.
- Consent: For marketing, publishing photos and health information, you need active consent.
3. Don't collect more than necessary
Only collect the data you actually need. Do you need national identity numbers? Probably not. Do you need dates of birth? Yes, for age groups. Think through every field in the registration form.
4. Store data securely
Personal data must be protected against unauthorised access. In concrete terms, this means:
- Don't store member lists in open Google Docs or shared Excel files
- Limit who has access to the administration system
- Use strong passwords and preferably two-factor authentication
- Choose a system that is GDPR-compliant and operated in line with Norwegian requirements
More than 500 organisations use Rubic, which is GDPR-compliant and operated in Norway.
5. Delete data that is no longer needed
When a member leaves, you no longer have grounds for keeping all their information. Bokføringsloven (the Bookkeeping Act) requires vouchers to be kept for five years after the end of the financial year, but contact details for inactive members should be deleted — or at least anonymised — after a reasonable period.
6. Have a data processing agreement with suppliers
Do you use an administration system, email service or other software that handles member data? Then there must be a data processing agreement (DPA) between the club and the supplier. It governs how the supplier processes data on your behalf.
Check that your supplier has this in place. A reputable supplier offers it as standard.
Photos of children — what do the rules say?
A common question: Can we post team photos and match photos of children? The answer is: Yes, but with reservations.
- Obtain consent from parents and guardians, preferably when the child joins
- Make it possible to withdraw consent
- Don't publish photos that may be perceived as offensive or that identify children in vulnerable situations
- Be particularly careful with photos from swimming pools, and never publish photos from changing rooms
A good administration system lets you store consent status per member, so you always know who has said yes — and who hasn't.
GDPR checklist for the sports club
Use this list as a starting point:
- Do you have a privacy policy on your website?
- Do you know what personal data you collect — and why?
- Is member data stored in a secure system (not open spreadsheets)?
- Do you have data processing agreements with all suppliers that handle data?
- Do you have routines for deleting data on former members?
- Do you obtain consent for publishing photos?
- Have you restricted access — do only those who need it have access?
Choose a system that takes data protection seriously
The simplest thing you can do to improve data protection in the club is to move away from loose spreadsheets, email threads and shared folders — and over to a system built with data protection at its core.
Rubic is GDPR-compliant, operated in Norway, and provides a data processing agreement as standard. Access control, deletion and consent management are built in.
Book a free demo → rubic.no/demo