If you run a martial arts school, you're holding a surprising amount of personal data: names, addresses, dates of birth, emergency contacts, medical notes, and — for many of your members — information about children. UK data protection law (UK GDPR and the Data Protection Act) applies to all of it. The good news is that the basics are common sense, and you don't need a legal background to get them right.
This is a plain-English overview, not legal advice — if in doubt, check the ICO's guidance for small organisations.
What data you actually hold
Most schools hold more than they realise:
- Contact details for students and parents.
- Dates of birth and whether a member is a minor.
- Emergency and next-of-kin contacts.
- Medical notes and allergies — this is special category data and deserves extra care.
- Attendance, gradings and payment records.
Knowing what you hold is the first step; you can't protect what you haven't accounted for.
The principle underneath the law is simple: only collect what you need, keep it safe, and use it only for what people expect.
A few sensible habits
You don't need a compliance department. You need a handful of good habits:
- Collect only what you use. If you'd never look at a field, don't ask for it.
- Limit who can see what. Front-desk staff don't need medical notes; role-based access keeps sensitive data on a need-to-know basis.
- Keep it secure. A shared spreadsheet emailed around is a risk. Data behind a proper login, hosted responsibly, is far safer.
- Don't keep it forever. When someone leaves and there's no reason to retain their record, remove it.
- Be ready to answer requests. People can ask what data you hold on them; know where it lives so you can respond.
Children's data needs extra care
A large share of your members are under 18, and children's data carries higher expectations. Make sure a parent or guardian is the point of consent and contact, keep safeguarding in mind, and be especially careful about who can view a child's details.
Why "where it's hosted" matters
Where your data physically lives is part of the picture. Data held in the UK, behind proper access controls, is easier to reason about than a spreadsheet on a personal laptop or a platform hosted overseas. When you choose tools, it's a fair question to ask: where is my members' data stored, and who can see it?
Getting data protection right isn't about fear — it's about respect for the families who trust you with their details. A few good habits, and the right tools doing the heavy lifting, keep you on the right side of it without it ever becoming a burden.