Sports sector compliance: GDPR & AI Act

Why the 'Sports' sector is concerned

Sport processes a wide variety of personal data: identity and contact details of registered members, many of whom are minors, medical certificates (health data), performance data (sometimes via connected devices) and images. The presence of minors raises the GDPR standard.

Medical certificates and health data require an exception to processing, enhanced security, and adapted retention periods. Images of athletes, particularly minors, raise right-of-image issues compounded by GDPR.

On the AI side, video performance analysis generally falls under limited risk. By contrast, facial recognition for access to venues involves biometric data, the use of which is strictly regulated or even prohibited depending on the context.

GDPR — licensees, health, images

Clubs and federations act as data controllers for their members (often minors), medical certificates (health data), performance data and images. They must manage parental consent, govern health data, ensure security and respect the right to one's image.

Data sharing between club, league, and federation must be clarified.

Key obligations

• Parental consent for minors.
• Exception and security for medical certificates.
• Governing image rights (minors).
• Clarification of roles: club / league / federation.

AI Act — video analysis and biometrics

Video-based performance analysis generally falls under limited risk. Facial recognition for access to premises involves biometric data: real-time remote biometric identification in publicly accessible spaces is heavily restricted, and biometric categorisation is subject to strict regulation.

Vigilance is required regarding any biometric device.

Key obligations

• Classify use cases (video analytics = often limited risk).
• Prohibit unauthorised biometric access to venues.
• Transparency on AI usage.
• Alignment with GDPR (biometrics = sensitive data).

Comparative overview of regulations

How these regulations interact

Sport combines sensitive data (health data via medical certificates), minors, and images. The GDPR is central, with particular vigilance on parental consent and the right to likeness of young athletes.

Biometrics illustrates the GDPR / AI Act overlap: facial recognition for access control involves biometric data (GDPR, sensitive category) and a use case strictly regulated by the AI Act. In general, it is preferable to avoid it in favour of less intrusive solutions.

Application timeline

• 1GDPR. In force; vigilance regarding minors and health.
• 2AI Act. Prohibitions: Certain biometric practices restricted since February 2025.

Applicable penalties

GDPR up to €20 M or 4%, AI Act up to €35 M or 7% for prohibited practices. Processing of minors' and health data, and the use of biometrics, are subject to particularly close scrutiny.

Compliance roadmap

• 1Map. Record licensees, medical certificates, performance data, images.
• 2Managing parental consent. Organise consent collection for minors.
• 3Securing health data. Govern medical certificates (exception, security, retention periods).
• 4Respecting the right to one's image. Governing the capture and distribution of content, especially involving minors.
• 5Governing AI. Qualifying video analytics and prohibiting unauthorised biometrics.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports clubs, leagues, and federations on minors, health data, and the use of video AI.

DCO offers tailored templates (parental consent, management of medical certificates, image rights authorisations).

Frequently asked questions