BackPolicies
Policies 2 of 3
Data policy
Data Protection Policy
1. Purpose and application
This internal policy applies to all Hawks Netball Club committee members, coaches, team managers, officials, volunteers, workers and contractors who handle personal information for the Club. Everyone is responsible for protecting data; the Committee remains accountable for governance.
2. Roles
• Club Committee: approves this policy, provides resources and monitors compliance.
• Data Protection Lead: Club Secretary. Maintains the records of processing, supplier and breach registers; coordinates rights requests; gives advice; and reports to the Committee.
• All authorised users: follow this policy, use only approved systems and report incidents immediately.
• System/data owners: review access, accuracy, retention and deletion for their area at least annually.
3. Core rules
1. Use personal data only for a documented, lawful and transparent purpose.
2. Collect the minimum necessary and avoid duplicate unofficial lists.
3. Keep information accurate and correct errors promptly.
4. Keep it only in line with the approved retention schedule.
5. Protect confidentiality, integrity and availability with proportionate controls.
6. Be able to demonstrate compliance through records, decisions and training.
4. Approved working practices
• Use Club-approved accounts and storage. Do not keep Club records permanently in personal email, personal cloud drives or messaging apps.
• Use unique passwords and multi-factor authentication where available. Never share credentials.
• Restrict team lists, health details and safeguarding records to those who genuinely need them.
• Use BCC for group emails unless recipients have a clear reason to see one another.
• Verify identity before sending personal information or changing contact/payment details.
• Lock devices, encrypt portable devices where available and avoid removable media.
• Do not print personal information unless necessary; collect it promptly and shred securely.
• Keep emergency/medical information available only for the session or trip and return or securely destroy working copies.
• Do not post names, images, health information, selection decisions or safeguarding details on social media without authority and a lawful basis.
• Use approved channels when communicating with junior players and follow safeguarding rules on adult-to-child communications.
5. New activities and suppliers
Before introducing a new form, app, camera, mailing list, payment tool or supplier, the owner must tell the Data Protection Lead what information will be collected, why, the lawful basis, who will receive it, where it is stored and how long it will be kept. A data protection impact assessment is required where processing is likely to create high risk, particularly involving children, systematic monitoring, biometrics, extensive health data or new technology.
6. Individual rights requests
Any verbal or written request that may relate to access, correction, deletion, restriction, objection, portability or automated decisions must be forwarded immediately to the Club Secretary (hello@hawksnetballclub.com).
7. Personal data incidents
7. Contain the incident without destroying evidence: recall an email where possible, revoke a link, recover papers/device, reset credentials or isolate access.
8. Report immediately to the Club Secreatry with what happened, when, whose data, categories/volume, recipients and actions taken.
9. The Data Protection Lead records and assesses likelihood and severity of risk to people.
10. Where required, notify the ICO without undue delay and where feasible within 72 hours of awareness; notify affected people where a high risk is likely.
11. Complete lessons learned and corrective actions. No volunteer will be criticised for reporting promptly and honestly.
8. Special category, criminal-offence and safeguarding information
Access must be especially restricted. The Club must document both an Article 6 lawful basis and, for special category data, an Article 9 condition; criminal-offence data also requires specific legal authority or an appropriate policy framework. Safeguarding records must be separated from routine team records and handled under England Netball safeguarding procedures.
9. Training, monitoring and breach of policy
Relevant volunteers and workers will receive induction and periodic refresher guidance. Access and retention will be reviewed annually. Breach of this policy may result in removal of access, retraining, volunteer role termination, disciplinary action under Club or England Netball procedures, and referral to relevant authorities where necessary.
10. Approval
Approved by: Hawks Committee, November 2026
Source basis and review note
This document is adapted for Hawks Netball Club from the following guidance.
• England Netball Data Protection Policy template.
• England Netball Guide to Creating a Privacy Policy, Privacy Statements and Data Protection Policy.
• UK GDPR / Data Protection Act 2018 and ICO guidance, reviewed November 2026.
1. Purpose and application
This internal policy applies to all Hawks Netball Club committee members, coaches, team managers, officials, volunteers, workers and contractors who handle personal information for the Club. Everyone is responsible for protecting data; the Committee remains accountable for governance.
2. Roles
• Club Committee: approves this policy, provides resources and monitors compliance.
• Data Protection Lead: Club Secretary. Maintains the records of processing, supplier and breach registers; coordinates rights requests; gives advice; and reports to the Committee.
• All authorised users: follow this policy, use only approved systems and report incidents immediately.
• System/data owners: review access, accuracy, retention and deletion for their area at least annually.
3. Core rules
1. Use personal data only for a documented, lawful and transparent purpose.
2. Collect the minimum necessary and avoid duplicate unofficial lists.
3. Keep information accurate and correct errors promptly.
4. Keep it only in line with the approved retention schedule.
5. Protect confidentiality, integrity and availability with proportionate controls.
6. Be able to demonstrate compliance through records, decisions and training.
4. Approved working practices
• Use Club-approved accounts and storage. Do not keep Club records permanently in personal email, personal cloud drives or messaging apps.
• Use unique passwords and multi-factor authentication where available. Never share credentials.
• Restrict team lists, health details and safeguarding records to those who genuinely need them.
• Use BCC for group emails unless recipients have a clear reason to see one another.
• Verify identity before sending personal information or changing contact/payment details.
• Lock devices, encrypt portable devices where available and avoid removable media.
• Do not print personal information unless necessary; collect it promptly and shred securely.
• Keep emergency/medical information available only for the session or trip and return or securely destroy working copies.
• Do not post names, images, health information, selection decisions or safeguarding details on social media without authority and a lawful basis.
• Use approved channels when communicating with junior players and follow safeguarding rules on adult-to-child communications.
5. New activities and suppliers
Before introducing a new form, app, camera, mailing list, payment tool or supplier, the owner must tell the Data Protection Lead what information will be collected, why, the lawful basis, who will receive it, where it is stored and how long it will be kept. A data protection impact assessment is required where processing is likely to create high risk, particularly involving children, systematic monitoring, biometrics, extensive health data or new technology.
6. Individual rights requests
Any verbal or written request that may relate to access, correction, deletion, restriction, objection, portability or automated decisions must be forwarded immediately to the Club Secretary (hello@hawksnetballclub.com).
7. Personal data incidents
7. Contain the incident without destroying evidence: recall an email where possible, revoke a link, recover papers/device, reset credentials or isolate access.
8. Report immediately to the Club Secreatry with what happened, when, whose data, categories/volume, recipients and actions taken.
9. The Data Protection Lead records and assesses likelihood and severity of risk to people.
10. Where required, notify the ICO without undue delay and where feasible within 72 hours of awareness; notify affected people where a high risk is likely.
11. Complete lessons learned and corrective actions. No volunteer will be criticised for reporting promptly and honestly.
8. Special category, criminal-offence and safeguarding information
Access must be especially restricted. The Club must document both an Article 6 lawful basis and, for special category data, an Article 9 condition; criminal-offence data also requires specific legal authority or an appropriate policy framework. Safeguarding records must be separated from routine team records and handled under England Netball safeguarding procedures.
9. Training, monitoring and breach of policy
Relevant volunteers and workers will receive induction and periodic refresher guidance. Access and retention will be reviewed annually. Breach of this policy may result in removal of access, retraining, volunteer role termination, disciplinary action under Club or England Netball procedures, and referral to relevant authorities where necessary.
10. Approval
Approved by: Hawks Committee, November 2026
Source basis and review note
This document is adapted for Hawks Netball Club from the following guidance.
• England Netball Data Protection Policy template.
• England Netball Guide to Creating a Privacy Policy, Privacy Statements and Data Protection Policy.
• UK GDPR / Data Protection Act 2018 and ICO guidance, reviewed November 2026.