Do Children's Activity Providers Need A Privacy Policy?

Yes, if you run children's activities in the UK and collect personal information about children, parents or carers, you should have a clear privacy policy.

The slightly more nuanced answer is that your privacy policy is only one part of your data protection setup. You also need to think carefully about what information you collect, why you collect it, who can see it, how long you keep it and when you need consent.

This matters because children's activity providers often handle particularly sensitive information: emergency contacts, medical notes, allergy details, safeguarding concerns, attendance records, photos and parent communications. The good news is that this doesn't have to be complicated, but it does need to be deliberate.

Do You Need A Privacy Policy For Children's Activities?

Yes, if you collect personal data for bookings, attendance, safeguarding, communications or payments, you need to tell people how you use that data.

Under the UK GDPR and the Data Protection Act 2018, you need to be transparent with people whose personal data you collect. For a children's activity provider, that usually means giving a privacy notice to parents or carers, and sometimes explaining key points to children in an age-appropriate way too.

You might need a privacy policy if you run:

• an after school club
• a holiday camp
• a sports coaching business
• a dance, drama, music or art class
• a tutoring or education programme
• a nursery add-on activity or wraparound care service
• a birthday party or children's event business

Your privacy policy should explain, in plain English:

• what information you collect
• why you need it
• your legal basis for using it
• who you share it with
• how long you keep it
• what rights parents, carers and children have
• how they can contact you about privacy questions

People often call this document a privacy policy, but under UK data protection law you may also hear it called a privacy notice. For most small activity providers, the practical aim is the same: give families a clear explanation of how their information is handled.

What Child And Parent Data Are You Collecting?

You should only collect data you genuinely need to run your activities safely and properly.

This is called data minimisation under the UK GDPR. It means you shouldn't collect extra information just because it might be useful one day. The more information you collect, especially about children, the more responsibility you take on.

For example, you may need to collect:

• the child's name, age and date of birth
• parent or carer names and contact details
• emergency contact details
• booking and attendance records
• medical conditions, allergies and medication instructions
• dietary requirements
• permissions for pickup arrangements
• payment and invoice details
• safeguarding notes, where relevant
• photo and video permissions
• communications with parents about bookings or incidents

Some of this is ordinary personal data. Some of it's more sensitive. Health information, disability information and some safeguarding information can be special category data under the UK GDPR, which means you need extra care and a clear legal reason for using it.

Say Priya runs a weekend football coaching programme for 6 to 12 year olds. She needs children's names, ages, parent contact details, emergency contacts, allergy notes and attendance records. She probably doesn't need to know each child's full school history, family circumstances or passport details for a standard weekly session.

A good test is to ask: if a parent challenged this, could you clearly explain why your business needs that specific piece of information?

Can You Rely On Parent Consent For Data Protection?

Sometimes, but not always. Consent is only one legal basis under the UK GDPR, and it isn't always the best fit for running your children's activity business.

This is where many providers get tripped up. Parents often sign booking forms and give permissions, so it can feel like everything is based on consent. In data protection terms, though, you may be relying on several different legal bases.

When Consent May Be Appropriate

Consent can work well where the parent has a genuine choice and can say no without affecting the core service.

For example, you may ask for consent to:

• use a child's photo in your social media posts
• include a child in a promotional video
• send optional newsletters or marketing updates
• share details with a third-party event partner where it's not essential

If you rely on consent, it needs to be specific, informed and easy to withdraw. Pre-ticked boxes aren't a good idea. A vague line saying parents agree to all data use is unlikely to be enough.

When Consent May Not Be The Right Basis

For core operational data, you may be better relying on another legal basis.

For example:

• Contract: contract may cover parent or carer booking and payment details where they're the contracting customer. For the child's data, you may need to consider legitimate interests, legal obligation, vital interests or consent, depending on the purpose and circumstances.
• Legal obligation: you may need to keep certain records because childcare, health and safety or safeguarding rules apply to your activity.
• Legitimate interests: you may need to manage your business, prevent fraud, respond to parent queries or keep limited internal records.
• Vital interests: in a serious emergency, you may need to share relevant information with paramedics or medical staff where this is necessary to protect a child's life and you can't get consent in time.

For children's online services, there's also a specific UK GDPR rule around consent for information society services. In the UK, a child can consent to this type of online service from age 13. Below that age, consent may need to come from someone with parental responsibility. This usually matters more for apps, online platforms and digital communities than for a simple offline booking form, but it can be relevant if you run an online activity platform for children.

Your children's privacy policy should match what you actually do. If it says everything is based on consent, but parents can't realistically refuse certain data uses and still attend, that can create problems.

How Should You Handle Medical Details And Emergency Contacts?

You should collect medical and emergency information only where you need it for safety, and you should protect it more carefully than ordinary admin details.

Medical information is often special category data under the UK GDPR. This might include allergy details, asthma plans, epilepsy information, medication instructions, disability-related adjustments or mental health notes.

For this type of information, you need both:

• a lawful basis under Article 6 of the UK GDPR, such as contract, legal obligation, legitimate interests or vital interests
• a special category condition under Article 9, such as explicit consent, vital interests in narrow emergency circumstances, health or social care, or substantial public interest, depending on the situation

For many small children's activity providers, explicit consent from a parent or carer is commonly used for health details collected at booking stage. Vital interests is a narrow basis, focused on protecting life, and for special category data it generally only applies where the child is physically or legally incapable of giving consent.

Emergency contact details also need care. Remember, you're collecting personal data about the emergency contact, not just the child. Your privacy notice should explain that you collect emergency contact details and may use them if there's an incident, illness, safeguarding concern or pickup issue.

Practical Steps For Medical And Emergency Data

• Ask for information that's relevant to the activity, not open-ended family history.
• Keep medical notes separate from general marketing or admin lists.
• Limit access to staff who need the information to supervise children safely.
• Have a process for updating medical details each term or each booking cycle.
• Follow a clear data retention policy to securely delete or archive information when you no longer need it, unless you need to keep it for legal, insurance or safeguarding reasons.
• Train staff on what can and can't be shared casually in group chats or at pickup time.

For example, if a child has a severe nut allergy, coaches may need to know what to avoid and what to do in an emergency. Your marketing assistant probably doesn't need access to that information to send a term newsletter.

Can You Use Photos And Videos Of Children?

Yes, but you should get clear permission for promotional use and be very specific about where the images will appear.

Photos and videos of children are personal data if a child can be identified. If you use CCTV at your venue, explain that separately too. They can also carry safeguarding and reputational risks if they're used carelessly. This is one area where a simple tick box labelled photo consent often isn't enough.

You should separate different uses, such as:

• internal records, such as documenting an incident or achievement
• sharing photos privately with parents in a secure app or email
• using photos on your website
• posting photos on social media
• using photos in paid advertising
• allowing a venue, school or partner organisation to use photos

Parents may be happy for a photo to be shared in a private parent gallery, but not on Instagram. They may agree to a group photo but not a close-up of their child in a paid advert. Your forms and privacy policy should make these choices clear.

If a parent withdraws consent, you should stop using the image going forward where practical. You may not be able to delete every printed flyer already distributed, but you can remove website images, avoid reposting and update your records so staff know the child's preference.

Also think about your staff. If staff use their own phones to take photos during activities, you need clear rules about storage, deletion and sharing. Otherwise, images can end up scattered across personal devices and messaging apps, which is risky and difficult to manage.

What Should Your Kids Club Privacy Notice Say?

Your kids club privacy notice should be clear enough for parents to understand quickly, while still covering the key UK GDPR requirements.

Templates can be a useful starting point, but they often miss the details that matter for children's activity businesses. A privacy notice for an online shop won't properly cover safeguarding notes, pickup permissions, accident records or photo choices.

Your privacy notice should usually cover:

• Who you are: your business name and contact details.
• What data you collect: parent details, child details, bookings, attendance, medical notes, photos and communications.
• Why you collect it: bookings, safety, safeguarding, parent updates, payments, legal obligations and marketing.
• Your legal bases: the UK GDPR grounds you rely on for each main purpose.
• Special category data: how you handle health, disability or safeguarding information.
• Who you share data with: staff, instructors, payment providers, booking platforms, insurers, schools, venues, emergency services or regulators where relevant.
• International transfers: whether your software providers store or access data outside the UK and what protections apply.
• Retention: how long you keep booking records, incident records, medical details, marketing lists and photos.
• Rights: access, correction, deletion, restriction, objection and complaint rights.
• How to contact you: who parents can contact with data questions or concerns.

You should also think about how you present the notice. Parents don't want to read a ten-page legal document while trying to book a holiday club place. You can use short sections, clear headings and practical examples.

If children interact directly with your online platform, app or digital content, you should also consider the ICO's Children's Code, also known as the Age Appropriate Design Code. It applies to online services likely to be accessed by children and focuses on making children's privacy a core part of the design.

How Do You Keep Children's Data Safe Day To Day?

You keep children's data safe by combining sensible systems, staff training, an information security policy and clear internal rules.

Your privacy policy tells families what you do. Your internal processes make sure it actually happens. This is often where small providers can make the biggest improvements without spending a fortune.

Use Sensible Access Controls

Not every staff member needs access to every record. A session leader may need medical notes and emergency contacts for children attending that day. A casual assistant may only need attendance lists and key safety alerts.

Use password-protected systems, avoid shared logins where you can and remove access when staff leave. If you use paper registers, keep them secure and don't leave them visible to other parents at pickup.

Be Careful With Apps And Suppliers

If you use booking software, payment tools, email platforms, cloud storage or parent communication apps, those suppliers may act as processors under the UK GDPR. You should have suitable data processing terms in place.

Check what each platform does with your data, where it stores data and whether it gives you tools to delete or export records. Free tools can be convenient, but they may not always be set up for sensitive children's data.

Have A Breach Plan

A personal data breach could be as simple as emailing a medical list to the wrong parent, losing a paper register or having a staff member's phone stolen with children's photos on it.

If a breach is likely to risk people's rights and freedoms, you may need to report it to the Information Commissioner's Office within 72 hours of becoming aware of it. You may also need to tell affected parents or carers if the risk is high.

You don't need a scary 50-page incident manual, but you do need staff to know who to tell, what to record and what to do quickly if something goes wrong.

Handle Marketing To Parents Properly

You can market to parents, but you need to follow the UK GDPR and the Privacy and Electronic Communications Regulations, often called PECR.

For email or text marketing, you usually need consent unless the soft opt-in applies. The soft opt-in may apply where you got a parent's contact details during a sale or negotiation for your services, you're marketing similar services, and you gave them a clear chance to opt out when you collected their details and in every later message.

Keep marketing lists separate from essential service messages. For example, a parent can opt out of your termly offers but still receive urgent pickup updates, timetable changes or safety notices about a session they've booked.

Key Takeaways

• If you collect parent or child data for bookings, safety, safeguarding or communications, you should have a clear privacy policy.
• Children's data needs extra care, especially medical details, emergency contacts, safeguarding notes and photos.
• Parent consent is useful for some things, but it isn't always the right legal basis for core booking and safety information.
• Photo permissions should be specific, especially for websites, social media and paid advertising.
• Your privacy notice should reflect how your activity business actually operates, including your software, staff access and retention practices.
• Good data protection processes help parents trust you and make day-to-day operations smoother.

If you'd like help with your privacy policy, photo consent forms, parent booking terms or data protection processes for children's activities, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.