ChecklistSports
Athlete data privacy: a governance checklist for performance and medical staff
Athlete data privacy comes down to a short list of decisions a club must make before a vest, watch or camera collects anything: what is being collected, which of it is health or biometric data, the lawful basis for each use, who else receives it, how it may influence selection or contracts, and what happens to it when the player leaves. This checklist turns those decisions into items performance, medical and data protection staff can sign off together.
On this page
- Why consent is a weak foundation for player data
- Before collection: inventory, classification and lawful basis
- Vendors, leagues and outside recipients of player data
- The same data point under three different uses
- When data drives decisions, and when a player leaves
- Checklist items clubs skip, and what follows
- Questions and answers
- Sources
Why consent is a weak foundation for player data
Clubs often ask players to sign a consent form for tracking and wellness monitoring. Under the General Data Protection Regulation (EU) 2016/679, consent must be freely given, and the European Data Protection Board's guidance explains that this is hard to show where there is an imbalance of power such as employment2. A player who fears losing a place in the squad for refusing a GPS vest has not freely consented.
The sturdier approach is to identify the lawful basis for each use (often contract or legitimate interests for performance work) and, because heart rate, injury records and much wearable output is data concerning health, a separate condition under Article 91. In the UK, Schedule 1 of the Data Protection Act 2018 sets out conditions for employment and occupational health purposes, several of which require an appropriate policy document3. Keep consent for genuinely optional uses, such as a player appearing in a data-driven fan feature.
The FIFPRO Charter of Player Data Rights, developed with FIFA and launched in 2022, gives football a shared reference: players should be able to be informed, access, revoke, restrict, port, rectify, erase and complain4. It does not create new law, but player unions use it, so it is a sensible benchmark in any sport.
Before collection: inventory, classification and lawful basis
Vendors, leagues and outside recipients of player data
The same data point under three different uses
Governance follows the purpose, not the sensor. Read across each row before approving a new use.
| Data | Load and injury management | Selection, contract or transfer decisions | Commercial or third-party use |
|---|---|---|---|
| GPS and optical tracking | Core purpose; covered by the notice | Permitted with human review and explainable metrics | Needs a separate basis; often consent and player share |
| Heart rate, sleep and readiness | Health data; medical access controls | High risk of unfairness; avoid as a deciding factor | Rarely justifiable |
| Injury and medical records | Medical staff only, under clinical confidentiality | Share only fitness conclusions, not records | Not appropriate |
| Match video and pose data | Useful for technique and return-to-play work | Common in recruitment; disclose its use | Broadcast rights apply; biometric uses need care |
| Psychometric assessments | Only with qualified practitioners | Contentious; document validity and review | Not appropriate |
These are starting positions for discussion with your data protection officer, not legal conclusions.
When data drives decisions, and when a player leaves
Checklist items clubs skip, and what follows
Vendor dashboards nobody reviewed
Early signalCoaches export wellness scores into spreadsheets shared on personal devices.
MitigationApprove each export route, and remove personal-device access to health dashboards.
Purpose creep into contract talks
Early signalReadiness or sleep data appears in a contract renewal discussion.
MitigationState in the notice which data may inform contracts and enforce it with access controls.
Data stranded after a transfer
Early signalA new club asks for history and the old club has no export or retention rule.
MitigationAgree a standard player export and deletion schedule at signing, and log what was shared.
Questions and answers
Can a club sell or license its players' tracking data?
Not simply because it collected the data. Tracking data about identifiable players is personal data, and selling it to betting, media or analytics firms is a new purpose that needs its own lawful basis, transparency and usually player agreement. Clubs may also face contractual limits from leagues, unions and vendors. Aggregated, genuinely anonymized data is a different question, but anonymization of elite athletes is hard because so few people match their profile.
Do academy players need parental involvement in data decisions?
Children's data merits specific protection, so clubs should explain monitoring to parents or guardians as well as the player, minimize medical and wellness data, and avoid relying on a minor's consent for optional uses. Age thresholds for consent vary by country and purpose, so set the academy policy with your data protection officer and safeguarding lead together.
Can a player take their performance data to a new club?
Partly. The right to data portability covers personal data the player provided, processed by automated means on the basis of consent or contract, and it lets the player receive it in a machine-readable format. Derived analysis and medical opinions may fall outside it, but agreeing a standard export at signing avoids arguments at the transfer window.
Is GPS tracking data health data?
Positional data on its own usually is not. It can become health data when combined with heart rate, injury status or readiness scores, or when it is used to draw conclusions about a player's physical condition. Classify by what the dataset reveals and how it is used, not by the sensor that produced it.
Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation) — EUR-Lex · checked 10 October 2026
- Guidelines 05/2020 on consent under Regulation 2016/679 — European Data Protection Board · checked 10 October 2026
- Data Protection Act 2018, Schedule 1: special categories of personal data and criminal convictions etc data — legislation.gov.uk · checked 10 October 2026
- Charter of Player Data Rights launched for professional footballers — FIFPRO · checked 10 October 2026
- Laws of the Game, Law 4: The Players' Equipment — The IFAB · checked 10 October 2026