James Ashworth
Athlete health records are among the most sensitive data a sports organisation will ever hold. A hamstring scan, a concussion assessment, a mental health referral — these details sit at the intersection of medical confidentiality, employment law and competitive integrity. Under the UK GDPR and the Data Protection Act 2018, health data is special category data. That means you need a lawful basis under Article 6 and a separate condition under Article 9. Getting this wrong can lead to ICO fines, civil claims and — just as damaging — a breakdown of trust with the athletes who depend on you.
Lawful bases: consent is not your only option
Many clubs default to asking for explicit consent. But consent must be freely given, specific, informed and unambiguous. In an employment or squad-selection context, athletes may feel they cannot refuse. The ICO has repeatedly warned that consent is rarely appropriate where there is an imbalance of power. Better alternatives exist. For club doctors treating athletes, the condition is “medical diagnosis, provision of health care or treatment” under Article 9(2)(h), with a professional secrecy safeguard. For governing bodies assessing anti-doping or safeguarding, the “substantial public interest” condition may apply, provided there is a legal basis in UK law. For employment-related obligations — like sick pay or fit-to-work assessments — the “employment, social security and social protection” condition under Article 9(2)(b) is often the right fit. And do not forget Article 6: you still need a basis such as contract, legal obligation or legitimate interests.
Retention periods: keep what you need, no more
There is no single retention period for athlete health records. The UK GDPR requires that you keep data no longer than necessary. In practice, that means a documented retention schedule. For adult medical records, NHS guidance often suggests eight years after last treatment, but sports organisations are not the NHS. A professional club might retain physiotherapy notes for six years after the player leaves, to align with the Limitation Act 1980 for contract claims (six years) and personal injury claims (three years, but with knowledge dates). Governing bodies dealing with anti-doping might need to keep samples and related medical data for ten years under international anti-doping rules — but that is a specific legal obligation, not a free pass. For youth athletes, records may need to be kept until the athlete reaches 25 or 26, given the long tail of abuse claims. Always ask: what is the legal, regulatory or insurance justification? If you cannot point to one, delete.
Athlete rights: more than just access
Athletes have the same rights as anyone else, but the context makes them sharper. Subject access requests are common when a player moves clubs or disputes a diagnosis. You must respond within one month, though complex requests can be extended by two further months. Athletes can also ask for rectification of inaccurate medical notes — be careful here, as clinical opinion is not the same as factual error. They can request erasure when data is no longer necessary, but that will often be outweighed by legal claims or public health obligations. They can restrict processing whilst a complaint is investigated. They can object to processing based on legitimate interests. And they have rights around automated decision-making, which matters if you use algorithms for injury risk or return-to-play decisions. Practical tip: nominate a single point of contact for athlete data queries and train your medical and performance staff to recognise a request and pass it on immediately.
Dispute resolution: internal, regulatory and judicial routes
When an athlete believes their health data has been mishandled, the first step is usually an internal complaint under your data protection policy. If that fails, they can complain to the Information Commissioner’s Office (ICO). The ICO can issue reprimands, enforcement notices and fines of up to £17.5 million or 4% of annual global turnover, whichever is higher. Athletes can also bring civil claims for distress and material damage under section 168 of the Data Protection Act 2018. For governing body decisions — such as a suspension based on medical evidence — a separate appeal route may exist under the relevant sport’s disciplinary rules. And in employment disputes, an athlete may bring a claim in the employment tribunal if the processing relates to their contract. The key is to have a clear, documented process that separates data protection complaints from on-field disciplinary matters.
Practical steps for clubs and governing bodies
You do not need a legal team on standby for every scan. But you do need a data protection officer or a named lead, a record of processing activities that lists every health data flow, a retention schedule that is reviewed annually, and a data protection impact assessment for any new monitoring or algorithmic tool. Train medical staff on the difference between consent and other lawful bases. Give athletes a plain-English privacy notice that explains what you hold, why, for how long, and who you share it with — including insurers, other clubs and anti-doping authorities. And when a breach happens, be ready to notify the ICO within 72 hours if it poses a risk to rights and freedoms. Athletes trust you with their bodies and their careers. Treat their data with the same care.
