A UK membership form has two jobs under UK GDPR. First, tell people clearly who you are, what you will do with their details and what their rights are. Second, only ask for a tick (consent) where you genuinely need one, which for the basic running of a club is usually not the case. Below is wording you can copy for an adult form and a junior form, plus how to decide which parts need a tick box.
This is general information, not legal advice. Take advice if you handle health information, work with children in a regulated setting, or run paid services.
Step 1: pick the right legal basis for each use
UK GDPR requires a lawful basis for each thing you do with personal data. Most clubs get tangled because they treat everything as "consent". You do not have to.
- Running membership (records, subscription, meeting notices, fixtures, team selection). Normally covered by a basis other than consent: contract (you provide membership in return for the person joining) or legitimate interests. The ICO describes legitimate interests as a three-part test: identify the interest, show the processing is necessary for it, and balance it against the person's rights. You should keep a note of that assessment, and you must include your legitimate interests in your privacy information.
- Optional extras (a members' contact list shared among members, third-party sponsor marketing, newsletters beyond club business, publishing photos). These are where you ask for a separate tick. Consent has to be freely given, specific and unambiguous, and UK GDPR Article 7 says the request must be clearly distinguishable from other matters and easy to withdraw.
- Health information (allergies, medical conditions). Special category data under Article 9. You need an extra condition on top of a lawful basis. For most sports and hobby clubs, that means explicit consent. Article 9(2)(d), the not-for-profit condition, is limited to bodies with a political, philosophical, religious or trade union aim and processing that relates solely to members, so it does not generally cover a sports club. Only collect health data you will actually use (for example, to keep someone safe during activities) and consider whether a short "tell the coach about anything we should know" prompt does the job without a medical questionnaire.
A useful rule of thumb: if the person joining the club would be surprised to learn you were doing it, it needs a tick box. If they would expect it as part of being a member, it does not.
Step 2: tell them what you do (Article 13)
At the time you collect the data, Article 13 of UK GDPR says you must give people the following information (the full list is in the legislation; this is the part that matters to a small club):
- who you are and how to contact you;
- why you use their data and the legal basis for each purpose;
- if you rely on legitimate interests, what those interests are;
- who receives the data, if anyone (for example, your national governing body or a website or payment provider);
- how long you keep it, or how you decide;
- their rights: to see, correct or delete their data, to restrict or object to its use, and to data portability;
- the right to withdraw consent at any time, where you rely on consent;
- the right to complain: Article 13 now includes the right to make a complaint to you as the controller as well as to the regulator (the ICO, now formally the Information Commission); and
- whether providing the data is a requirement for joining and what happens if they do not provide it.
You can put this in a short notice on the form, with the long version on your Privacy page.
Template: adult membership form wording
Copy, replace the bracketed parts and delete anything that is not true for your club.
How we use your details
[Club name] ("we") is the controller of the information you give us on this form. Contact: [role, e.g. Membership Secretary], [email].
We use your name, address, email, phone number and [any other field you actually use] to run your membership: to keep our membership register, collect subscriptions, send you notices of meetings, fixtures and events, and keep you safe at club activities. We do this because it is necessary to provide your membership and in our legitimate interests in running the club. You do not need to tick a box for this.
We share your details only with [e.g. our national governing body for affiliation purposes, our payment provider, our website and email provider]. We do not sell your details.
We keep your details while you are a member and for [e.g. 12 months] afterwards, then delete them. [Accounts records are kept for [period] because we must.]
You can ask us to show you the data we hold, correct it, delete it, or stop using it for a particular purpose, and you can object to marketing at any time, by contacting [email]. If you are unhappy with how we use your data, please tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk. Our full privacy notice is at [link].
Optional (tick if you are happy for us to):
[ ] Include my name and email in a members' contact list shared with other club members.
[ ] Send me news from [named sponsor or partner] by email.
[ ] Use photographs of me taken at club events on our website and social media.
You can change your mind at any time by emailing [email]. Not ticking these boxes does not affect your membership.
Health and access needs (optional)
If there is anything we should know to keep you safe at club activities (for example, an allergy or medical condition), you can tell us here: [free text]. We will only use this to look after you at activities and will share it only with [named roles, e.g. the session leader and first aider]. By completing this box you are giving us your explicit consent to use that information for that purpose. You can withdraw that consent at any time.
Notes on that wording:
- Optional boxes start unticked. The ICO's electronic mail marketing guidance says you must not use pre-ticked boxes, silence or inactivity as evidence of consent, and that a person should be able to refuse without detriment.
- Separate the asks. Do not bundle a members' list, sponsor emails and photos into one tick. Specific means each purpose gets its own choice.
- Do not make marketing a condition of joining. The ICO says consent is unlikely to be valid if agreeing to marketing is a necessary condition of buying or donating.
- Name any sponsor or third party in the box. Consent covers the named sender, not "partners" in general.
- Right to object to marketing. Article 21 gives people an absolute right to object to direct marketing, and it says that right must be brought to their attention clearly and separately from other information by the time of your first communication. The line in the template about objecting to marketing at any time does that job on the form, and your first newsletter should repeat it with an unsubscribe link. See PECR and your club newsletter.
Template: junior membership form (parent or guardian)
Use the adult wording and change these parts.
Junior member details: Name [ ], date of birth [ ] (we ask for date of birth only to place your child in the right age group). Parent or guardian: name [ ], relationship [ ], phone [ ], email [ ].
Emergency contact: name [ ], phone [ ]. Please make sure this person knows you have given us their details.
How we use your child's details. We use your child's details, and yours as parent or guardian, to run their membership and look after them at club sessions. We contact you, not your child, about fixtures, training and club business. [If you also email or message under-18s directly, say so here and why.]
Optional (parent or guardian to tick):
[ ] I consent to photographs or video of my child being used on the club website and social media. We will not publish a child's full name alongside their photo.
[ ] I consent to my child's name appearing in match reports (first name and age group only).
Health and access needs: [same explicit-consent wording as above, completed by the parent or guardian].
I confirm I am the parent or guardian of the child named above. Signed [ ] Date [ ]
Article 6(1)(f) specifically flags that legitimate interests can be overridden where the person concerned is a child, so be especially careful to collect only what you need on a junior form. Why those choices: the NSPCC's photography guidance says to get written consent from the child and their parent or carer, advises not supplying children's names along with images, and says to avoid publishing personal information about individual children. Also keep in mind UK GDPR Article 8, which sets 13 as the age at which a child can consent for themselves in relation to online services offered directly to a child, and requires parental authorisation below that. It applies to information society services rather than a club membership form as such, but it is a good reminder that you should be careful about treating children as able to consent on their own. Your national governing body may also require particular child-protection wording, so check theirs.
Step 3: put the form online without creating a data mess
If you move the form online, the same wording applies. A few practical points:
- Show the privacy notice on or beside the form, not on a page nobody clicks.
- Keep optional boxes unticked and separate.
- Do not collect more than the paper form did. An online form makes it easy to add a "date of birth" field you do not need.
- Decide who can see submissions, and remove access when committee members leave.
On a Natterio site you can add a contact form and a Privacy page in the footer, and every site has cookie consent. For a full membership application with payments, check whether you need a separate tool. Natterio does not make your form compliant: the wording and the decisions above are yours to make.
Related reading
- GDPR for small clubs and charities: the plain-English guide
- A free privacy policy template for UK clubs
- Do we have to pay the ICO data protection fee?
- A safeguarding page for your club website
Build your club's site free: permanent free plan (three pages, no card), paid plans from £7 a month.
Sources and last checked 30 Oct 2026
- UK GDPR, Article 6 (lawfulness of processing, including contract and legitimate interests): legislation.gov.uk/eur/2016/679/article/6
- UK GDPR, Article 13 (information to be provided): legislation.gov.uk/eur/2016/679/article/13
- UK GDPR, Article 7 (conditions for consent): legislation.gov.uk/eur/2016/679/article/7
- UK GDPR, Article 8 (child's consent, information society services): legislation.gov.uk/eur/2016/679/article/8
- UK GDPR, Article 9 (special category data): legislation.gov.uk/eur/2016/679/article/9
- UK GDPR, Article 21 (right to object): legislation.gov.uk/eur/2016/679/article/21
- ICO, Legitimate interests (updated 23 March 2026): ico.org.uk legitimate interests
- ICO, How do we comply with the PECR electronic mail marketing rules? (consent standard): ico.org.uk
- NSPCC Learning, Photography and sharing images: learning.nspcc.org.uk