How is Pitchero helping sports clubs with GDPR?

Read More

DEMO Day: Join Pitchero & Partners at the AJ Bell Stadium

DEMO Day is an opportunity for club officials, coaches, volunteers and academic staff to meet Pitchero staff and partners face to face in October.
Continue Reading
October 14, 2021
Back to Blog home

How is Pitchero helping sports clubs with GDPR?

Pitchero is able to support sports clubs by helping them become clued up on General Data Protection Regulation (GDPR) as well as offering tools to make the process of having a GDPR-compliant website as smooth as possible.

Our blog articles explain how GDPR affects a sports club and 6 Steps your club must take so a club can audit the information it holds while learning about individuals’ rights under GDPR and updating their website and offline data practices.

The Information Commissioner’s Office (ICO) has a useful snapshot on 12 steps to take to prepare for GDPR and here on the Pitchero blog, we’ll look at some of those now and how they relate to your sports club.



If they don’t know already, those actively involved in the running of your sports club should be informed about GDPR and its implications.

Pitchero has emailed all webmasters and team admins about recent and future updates concerning GDPR (also see the GDPR hub) but anyone handling an individual’s personal data (such as coaches and club secretaries) should be briefed.

Information You Hold

On an ongoing basis, consider what personal data your sports club holds, whether it needs to collect and store it and where it starts and stops. Where you got the information from is important as is how it is shared with others. It could be quite a task to consider all the personal data that flows through your club but a brainstorming session will help capture the ideas.

Communicating privacy information

Reviewing and updating your privacy notices is key as GDPR has added requirements that should be included moving forwards. Pitchero’s GDPR Toolkit include advice on writing a privacy policy as organisations must now reference why they are processing personal data and how long they plan to hold it for.

Pitchero’s Helpcentre answers questions across Policies, Reporting, Privacy & Security - including how to add your new privacy policy to your Pitchero website.


 aces girls

Individuals’ rights


Under GDPR, an individual has these rights:

The right to be informed; the right of access; the right to rectification; the right to erasure; the right to restrict processing; the right to data portability; the right to object; and the right not to be subject to automated decision-making including profiling.

From a sports club’s perspective, they should put in place a way to provide a copy of a person’s data or delete it entirely on request. Here are the GDPR rights and how they are relevant to sports clubs.

Subject Access requests

GDPR makes it possible for any individual to request all of the data held on record by a sports club about them. This is called a ‘subject access request’ and must be done in a month or less. Pitchero will soon provide tools to help clubs access data needed for subject requests, but it’s worth bearing in mind, personal data includes everything offline too. 


Lawful basis for processing personal data

A sports club can reasonably claim to have a legitimate need to collect personal data for the running of its activities such as the management of its members. Now there are more stringent measures in place, it should review if it needs to hold all the personal data it does.

 video policy for clubs


With GDPR, permission to collect, store and use personal data (consent) cannot be assumed. According to the ICO, it must be given freely, be specific, informed and unambiguous. Pitchero has video consent forms (adult, parent or adult visitor) and will soon release tools to help clubs access data needed for subject requests (as mentioned above).



Consent forms completed by parents of young people under 18 is common at sports clubs and parental/guardian consent, along with verification of age, is very important. A club typically uses photography and video to promote its members and teams but permission is non-negotiable. It’s a good idea to have a club policy on photography and video - each sport’s governing body will have resources (here’s cricket).

Data Protection Officers


The formal appointment of a Data Protection Officer is usually undertaken by a company or larger organisation than a sports club to manage data protection strategy and implementation. Volunteers juggle enough roles without another job title but it is sensible to have someone in charge of data protection at the club who knows about GDPR and how it affects the club.

With your Pitchero club website, anyone who has Team Admin or Administrator access will be nudged about their responsibilities on data protection next time they log into the Control Panel. Furthermore, Pitchero has also updated its own privacy policy and terms of service to reflect GDPR and highlighted Email Preferences so any user can amend their settings quickly and easily.

GDPR has sometimes been described as a journey, not a destination and hopefully the advice above helps you on that data voyage. So long as sports clubs can show they are actively working on GDPR and trying to implement the steps required, they should have nothing to worry about.

Related Posts

DEMO Day: Join Pitchero & Partners at the AJ Bell Stadium

DEMO Day is an opportunity for club officials, coaches, volunteers and academic staff to meet Pitchero st...
Continue Reading

Trending Pitchero websites - and how they stand out

Here at Pitchero, we like nothing better than to see how clubs use their websites to support members and ...
Continue Reading

Join our Pitchero webinars this autumn

We are running a series of Pitchero webinars throughout August and September.
Continue Reading