GDPR for sailing club committees, in plain English

Sailing club committees are volunteers, and most have never had any training in data protection. Yet a club holds a surprising amount of personal information: addresses, phone numbers, dates of birth, children's names, emergency contacts, medical notes on entry forms, payment records. This post is GDPR for sailing club committees in plain English: the handful of principles that matter day to day, and the ways Yacht Clubs Manager helps you meet them.

This is general guidance for club volunteers, not legal advice. Your club is responsible for its own compliance. For anything specific, check the guidance published by the Information Commissioner's Office (ICO), which has material written for small organisations and clubs, or take proper advice.

The principles, in club terms

Have a reason for everything you hold

GDPR calls this a lawful basis. For most of what a club holds, the reason is straightforward: you need a member's name, contact details and payment record to provide their membership. Emergency contacts are needed for safety on the water. Photos for the website or marketing emails to non-members are different, and you should think about whether you need consent. Write your reasons down in a short privacy notice so members can see them.

Collect only what you need

This is the principle clubs most often break, usually by accident. The old joining form asked for occupation, date of birth and a second phone number, so everyone was asked for them for twenty years. When you set up a new application form, go through each field and ask who uses it and for what. If the answer is "nobody", leave it out.

Don't keep it forever

Personal data should be kept only as long as you need it. A member who left six years ago does not need their home address in your system. Agree retention periods as a committee and stick to them.

Respond to requests

Members have the right to see the data you hold about them and, in many cases, to have it deleted. You normally have one month to respond. Most clubs get very few of these requests, which is why they are easy to fumble when one does arrive.

Limit who can see what

Not every committee member needs every member's details. The treasurer needs payment records; the social secretary probably does not. And when someone steps down from the committee, their access should end with their role.

How the platform helps: members control their own data

In the members area, each member can see and edit their own profile: contact details, family members, emergency contacts, qualifications and boats. Keeping details current is part of GDPR too, and members fixing their own records beats a secretary transcribing emails.

From their account page, members can also:

• Download my data. A file containing the personal data the club holds about them, including their profile, family and emergency contacts, boats, qualifications, invoices, event entries and crew finder activity. This handles most access requests without a committee member doing anything.
• Delete my account. Their member record is anonymised. Deletion is blocked while anything is still outstanding, such as an unpaid invoice, an upcoming duty, or an open booking, event entry or shop order, so those loose ends have to be sorted out with the club first. Invoices themselves are kept for 7 years for the club's accounts, linked to the anonymised record.
• Choose their email preferences, including opting out of club communications and newsletters. Newsletters automatically skip members who have opted out, so nobody has to maintain a separate unsubscribe list.
• Change their cookie choices.

There is more on the member side of this in keeping your club profile up to date.

Deleting a member properly

When an admin deletes a member, the platform first runs a deletion review. Every open item linked to that member is listed: invoices, bookings, shop orders and so on. The admin decides what happens to each one, for example whether a paid booking is cancelled and refunded. Only then is the member's personal data anonymised.

Anonymised rather than simply erased, because a club still needs its financial records to add up. The invoice for last year's subscription still exists for the accounts, linked to the anonymised record instead of a named member.

Automatic clean-up

The hardest principle for a volunteer committee is retention, because nobody remembers to go back and delete things. The platform runs a daily clean-up so some of this happens without anyone remembering:

• IP addresses recorded with event entries, payments and email tracking are removed after 120 days.
• The content of emails sent by the system is deleted after 24 months.
• Membership applications that have been decided are erased 12 months after the decision.
• Guests' contact details on resource bookings are cleared 2 years after the booking date.
• Members whose membership lapsed more than 2 years ago are anonymised.

Make sure these periods fit your club's own policy and mention them in your privacy notice. The last one in particular is worth telling members about: someone who lets their membership lapse and comes back after three years will be starting again.

Who can see what

Instead of one shared admin login, each committee member can be given only the admin permissions their role needs, for example news, events, the duty roster, viewing the member list, invoices, the shop or settings, or full access where that is genuinely needed. The permissions are enforced on the server, not just hidden in the menus.

Admin actions are recorded in an admin actions log, which you can filter and export, and payments have a separate log. If a member asks who recently changed their record, you can look it up rather than asking around the committee. At each AGM handover, remove the outgoing officers' permissions and give the new ones theirs. The guide to committee roles and permissions covers this step by step.

What the platform can't do for you

Software can make good practice easier, but some things remain the committee's job:

1. Writing and publishing a privacy notice that describes what you hold and why.
2. Deciding which fields your application form really needs.
3. Agreeing who on the committee gets which permission, and reviewing it each year.
4. Dealing with data held outside the platform: old spreadsheets on personal laptops, paper forms in the clubhouse, WhatsApp groups.
5. Knowing what to do if something goes wrong, such as an email sent to the wrong list.

The old spreadsheets deserve a special mention. Moving to a new system is the ideal moment to delete the copies scattered across past secretaries' computers. See moving members off spreadsheets for what to keep and what not to import.

To see how member records are held and managed, read about member management and communications, or ask us a specific question about how the platform handles data.