Sport — GDPR: minors, health data and images

What does GDPR cover?

GDPR affords enhanced protection to minors, who are heavily represented in sport. Medical certificates fall under health data (Article 9). Images are subject to GDPR and portrait rights, with particular vigilance required for young athletes.

Sharing between club, league, and federation must be clarified (roles and legal bases).

Is the 'Sport' sector covered?

Clubs, leagues, federations and organisers are data controllers, with no threshold. The presence of minors systematically raises the level of requirement.

Service providers (management software, licensing platforms) are data processors.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover, with strong focus on minors and health data. Distributing images of minors without authorisation is a recurring risk.

Common mistakes in the sector

• 1Consent omitted. Processing minors' data without managing the required consent.
• 2Poorly protected certificates. Retaining medical certificates without security measures or retention periods.
• 3Images without authorisation. Publishing images of minors without consent.
• 4Unclear roles. Fail to clarify sharing between entities.

Practical case

A club was publishing photos of young players without authorisation and retaining medical certificates indefinitely. Remediation introduces image rights authorisations, a retention period for medical certificates, and information notices for families.

Compliance roadmap

1. 1

   Map. Catalogue licences, certificates, performance data, and images.

2. 2

   Consent. Organise parental consent.

3. 3

   Health. Governing medical certificates.

4. 4

   Image. Manage authorisations.

5. 5

   Roles. Clarify club/league/federation.

Frequently asked questions