Glossary
GDPR for sports clubs
Regulation (EU) 2016/679, the General Data Protection Regulation
By Clybo’ team ·Published on ·Editorial update: ·Next scheduled review:
This article explains Spanish regulations: it only applies to clubs whose tax residence is in Spain.
The GDPR applies to every sports club in Spain that processes personal data of athletes, guardians or staff. The club is always the Data Controller; service providers (such as Clybo’) are Processors with a signed contract. Data on minors is subject to special rules.
Legal framework
Two main laws apply in Spain:
- Regulation (EU) 2016/679, known as the GDPR, directly applicable in all Member States.
- Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD, the Spanish Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), which adapts the GDPR to Spanish law.
Roles: club vs provider
| Role | Who | Responsibility |
|---|---|---|
| Data Controller | The club | Decides what data is processed and why. It is ultimately accountable to the AEPD (the Spanish Data Protection Agency). |
| Data Processor | Providers such as Clybo’, Stripe, the bank | Processes the data on the club's behalf following its instructions, with a signed DPA (art. 28 GDPR). |
| Data subject | The athlete, the guardian, the staff | Exercises their data protection rights (known in Spain as ARCO+) with the Controller club. |
Most common legal bases in a club
- Performance of a contract (art. 6(1)(b)): processing data to register the athlete, collect the fee and organise training. It does not require consent.
- Legal obligation (art. 6(1)(c)): issuing invoices (VeriFactu) and meeting Social Security obligations for staff.
- Legitimate interest (art. 6(1)(f)): sending organisational communications, fraud prevention.
- Consent (art. 6(1)(a)): photos for publication, marketing communications, non-essential cookies.
Data on minors
Article 8 GDPR and Article 7 LOPDGDD set out enhanced protection for minors. Key points for a club:
- Under the age of 14, consent is given by the holder of parental authority.
- Information for the minor must be easy to understand (plain language, pictograms where appropriate).
- Health data (allergies, injuries) is a special category of data (art. 9 GDPR) and requires a specific legal basis.
- Identifiable images require express consent that can be withdrawn.
Data subject rights
- Access: knowing what data about them is processed.
- Rectification: correcting inaccurate data.
- Erasure: deleting data that is no longer necessary.
- Objection: objecting to processing based on legitimate interest.
- Restriction: freezing processing while a dispute is resolved.
- Portability: receiving the data in a structured, reusable format.
The club must respond to these requests within one month (extendable to three months if justified by complexity). The data subject can always lodge a complaint with the Agencia Española de Protección de Datos (Spanish Data Protection Agency).
Security breaches
If a security breach affecting personal data occurs, the club has72 hours from becoming aware of it to notify the AEPD (art. 33 GDPR). If it poses a high risk to people's rights, the affected data subjects must also be informed without undue delay.
How Clybo’ handles it
Clybo’ signs a DPA (Data Processing Agreement) with each club that complies with Article 28 GDPR: it sets out obligations, sub-processors, security measures and the procedure in the event of a breach. We apply AES-256 encryption at rest, TLS 1.3 in transit, Row-Level Security in the database by club_id and activity logging for sensitive operations. If you need a copy of the DPA before signing up, write to us at privacidad@clybo.app.
Frequently asked questions about GDPR for sports clubs
Do I need the guardian's consent to collect the child's fee?
No. The usual legal basis is performance of a contract (art. 6(1)(b) GDPR), not consent. Registering the child with the club involves a contract whose performance requires collecting the fee. Consent is reserved for marketing communications or photos for publication.
From what age can a minor give consent themselves?
In Spain, 14 (art. 7 LOPDGDD, the Spanish data protection act). Below that age, consent is given by the person holding parental authority or guardianship.
Do I need a Data Protection Officer (DPO)?
No, unless special categories of data are processed on a large scale. Most clubs are not required to have one, but it is good practice to appoint someone internally to be responsible for privacy.
Can I post photos of training sessions on social media?
You need the express consent of the guardian for identifiable images of minors. Collect consent in writing on the registration form and allow it to be withdrawn at any time.
How Clybo’ helps
Clybo’ brings together athlete management, payments and club documentation. See the help guides and the terms of each plan. Tax services are contracted separately and their availability depends on the club's tax territory and on the relevant technical and legal activation.
Try Clybo’ free for 30 days