An online joining or booking form is one of the most useful things a club can add to its website. It is also where most small clubs first handle personal data at scale. The UK GDPR and the Data Protection Act 2018 apply to clubs just as they apply to businesses, but the practical steps are manageable. This guide walks through them in the order you would build the form.
This is general information, not legal advice. The ICO (Information Commissioner's Office) publishes guidance for small organisations, and it is the best place to check specifics.
1. Collect only what you need
The first principle is data minimisation: ask only for information you actually need for the purpose. For a joining form that is usually name, contact email, perhaps a phone number, and a way to confirm eligibility such as date of birth for junior sections. For a booking form, it is name, contact, the session, and any access or dietary needs relevant to it.
Before adding each field ask: what do we do with this? If the answer is "we might want it one day", leave it out. Fewer fields also mean more people finish the form.
Be especially careful with:
- Health and medical information. This is special category data and needs extra care. Collect it only where it is genuinely needed, for example emergency medical information for a trip, and explain why.
- Children's data. If juniors join, you will usually need a parent or guardian's details and consent where appropriate, and extra care about what you publish. See what to put on your safeguarding page.
- Photos and filming. Ask for permission separately and make it optional.
2. Know your lawful basis
You need a lawful basis for each thing you do with the data. For a small club, the common ones are:
- Contract, or steps taken before a contract, for running the membership or booking someone requested.
- Legitimate interests for ordinary club administration that members would expect, provided you have considered the balance with their rights.
- Consent for optional extras, such as marketing emails or photo use. Consent must be a clear, separate, unticked choice that can be withdrawn.
- Legal obligation where the law requires you to keep something, such as certain financial records.
Do not use consent as a blanket basis for everything. If someone can only join by ticking "I consent" to all uses, that consent is not freely given. Separate the essentials from the optional extras. The wording for each is in our guide to membership form wording for GDPR, and the wider picture is in GDPR for small clubs and charities.
3. Tell people what you are doing
Under the UK GDPR you must give people privacy information at the point you collect their data. The simplest way is a short notice next to the submit button, linking to your full privacy notice. It should say:
- Who you are and how to contact you.
- What you collect and why.
- Your lawful basis.
- Who you share it with, such as your governing body, insurer or payment provider.
- How long you will keep it.
- People's rights: to see their data, correct it, have it deleted in some circumstances, and complain to the ICO.
Short wording that fits under a form:
We will use your details to manage your membership of [club name] and to contact you about club activities. We will share them with [governing body / insurer] only where needed to register or insure you. We keep them for [period] after your membership ends. You can ask to see, correct or delete your data by contacting [role email]. See our privacy notice: [link to your privacy notice].
If you do not yet have a privacy notice, start from our club privacy policy template.
4. Keep marketing separate
If you want to send newsletters or promotional emails, add a separate, unticked box: "Tick here if you would like to receive our monthly newsletter." Do not hide it in the terms. Emails that are purely about running the club, such as session changes or AGM notices, are service messages. The rules on the difference are in PECR and your club newsletter, and a practical guide to the newsletter itself is in how to write a club newsletter.
5. Store responses securely
Where do the form answers go? This is often the weak point.
- Use one place. Responses should land in a single system your club controls, not in someone's personal inbox and spreadsheets on three laptops.
- Limit access. Only the people who need the data, such as the membership secretary and treasurer, should be able to see it. Use individual accounts with strong, unique passwords and two-step verification.
- Do not email spreadsheets around. Share a link to a protected document, or print what the session leader needs and destroy it afterwards.
- Back up carefully, and apply the same access rules to backups.
- Plan for handover. When a committee member leaves, remove their access that day. Our guide to handing over a club website when the committee changes covers this.
If you use a third-party tool to collect forms, it becomes a processor of your data. Check where it stores data, that it has proper security and a data processing agreement, and read its current terms. The ICO has guidance on choosing processors.
6. Decide how long to keep it
Do not keep personal data longer than you need. A simple schedule might say:
- Current membership data: for as long as the person is a member.
- Lapsed members: a fixed period, such as a year or two after leaving, then delete or anonymise.
- Booking forms: until the event or session has taken place, plus a short period for any queries.
- Financial records: as long as the law or your accountant says you must.
- Accident or safeguarding records: follow your governing body's guidance, which may be longer.
Write the periods down and diarise a yearly clear-out. Check your own legal and insurance requirements before setting them.
7. Check whether you must register with the ICO
Some organisations must pay the data protection fee to the ICO, and many not-for-profit clubs are exempt. The rules depend on what you do, and it is worth checking with the ICO's self-assessment. See the ICO data protection fee for clubs and charities.
8. Test the form before you launch
Fill it in yourself on a phone. Check that:
- The privacy notice link works and the text is readable.
- Optional boxes are not pre-ticked.
- The confirmation message says what happens next.
- Responses arrive where you expect and nowhere else.
- Someone knows how to answer a request to see or delete a person's data.
Where to put the form
The form belongs on a "Join" or "Book" page of your website, with fees, what is included and a contact address alongside. If you do not have a website, Natterio has a free plan that gives you a live 3-page site on a Natterio subdomain with no card needed, with paid plans from £7 a month. Check what the form feature on any platform you use actually does with responses, how they are stored and who can access them, before you rely on it.
A short pre-launch checklist
- Every field has a reason.
- Optional extras are unticked and separate.
- A privacy notice is visible at the point of collection.
- Responses go to one secure place with limited access.
- A retention period is written down.
- Someone is responsible for requests from members.