When members book tee times online, your club is handling personal data, and under UK law the club committee is responsible for it. That is true whether the booking system is a spreadsheet, a club website or a specialist tool. This guide sets out what that means in practice: who is responsible, what to ask a booking provider, which data to collect, and how to avoid the mistakes that cause real breaches.
It is general information for club officials, not legal advice. If you have a live incident or a complex question, speak to the Information Commissioner’s Office (ICO) or a data protection adviser.
TL;DR
- The club is the data controller. A booking provider is normally a processor acting on your instructions, and you need a written contract with it.
- You do not have to pay the ICO fee simply because you use an online booking system. CCTV can change that.
- Collect only what a booking needs: name, membership number and the slot. Leave out anything you cannot justify.
- The most common avoidable breach is an email that exposes members’ addresses. Use BCC, or better, send from the system.
- Tell members what you hold and why, in a plain privacy notice, and know your 72-hour breach reporting duty.
Table of Contents
- Why booking data counts as personal data
- Controller and processor: who is responsible for what
- Collect less: data minimisation in a booking form
- Tell members what you do with their data
- Do you need to register with the ICO?
- Emails: where clubs actually go wrong
- If something goes wrong
- Our perspective: fairness and privacy are the same discipline
- A fair queue also treats members fairly
- Trying BallChute at your club
- A one-page privacy checklist for your committee
- FAQ
- Sources
Why booking data counts as personal data
The Data Protection Act 2018 sits alongside the UK GDPR and covers information that identifies a living person. A tee-time booking does exactly that: a name, an email address, a handicap or membership number, and a record of when someone plays and with whom.
The law does not exempt volunteer-run clubs. A members’ club run by an unpaid committee has the same core duties as a commercial operator, scaled to what it actually does. Proportionate does not mean optional.
One detail is easy to miss. A booking history is a pattern of behaviour. It shows who plays early on Saturdays, who cancels often and who plays with whom. That is ordinary club business, but it is a good reason to limit who can see it.
Controller and processor: who is responsible for what
The ICO’s guidance for small organisations draws a clear line. The club decides how and why member data is used, so it is the controller. A booking software supplier acts on the club’s behalf, so it is a processor.
This matters for two reasons.
- Responsibility stays with you. Handing data to a supplier does not hand over accountability. One golf club’s published privacy statement says as much about its own role: it names itself as controller for bookings, membership administration and competitions. Your committee should be able to say the same.
- You need a contract. The ICO sets out the terms a controller-processor contract must contain, including processing only on the controller’s documented instructions and rules for any sub-processor. A click-through set of terms can satisfy this if it covers those points, but someone at the club should have read it.
Questions to put to any booking provider
Treat this as due diligence you can file in the minutes.
- Does it provide a data processing agreement, and does it cover the ICO’s required terms?
- Where is member data stored, and which sub-processors does it use?
- Who at the provider can see member data, and how is access controlled?
- What happens to data when you leave? Can you export it, and is it deleted afterwards?
- How, and how fast, will it tell you about a breach?
- Can the system be set up so members only see what they need to see?
A supplier that answers these plainly is a good sign. One that cannot is telling you something too.
Collect less: data minimisation in a booking form
The seven UK GDPR principles include data minimisation, accuracy, storage limitation and security, and the accountability duty to show you comply. Of those, minimisation is the one clubs can act on today, because it costs nothing.
For a tee-time booking the necessary data is short:
| Data item | Needed for a booking? | Comment |
|---|---|---|
| Name | Yes | Needed for the tee sheet |
| Membership number | Yes | Verifies the booker is a member |
| Playing partners | Yes, if group booking | Names only, no extra details |
| Email address | Usually | For confirmations and tee sheets |
| Handicap | Only for competitions | Hold it where the competition needs it |
| Home address, date of birth | No | Belongs in the membership record, not booking |
| Health information | No | Avoid unless there is a clear, lawful need |
Regulators in other countries give the same advice. Switzerland’s data protection commissioner warns clubs against collecting data they have no need for. The Irish Data Protection Commission’s sports guidance tells clubs to list the data they hold and record why they hold it. Both are outside the UK, so treat them as good practice rather than UK law, but the logic carries straight over.
Keep a short record
Write one page: what booking data you hold, why, who can see it, how long you keep it and where it lives. That page is most of what accountability looks like for a small club. It also makes the privacy notice easy to write.
Tell members what you do with their data
Transparency is the first principle, and the cheapest to meet. Your members should be able to find a plain-English privacy notice that says what you collect, why, who receives it (including your booking provider), how long you keep it and how to ask questions. The Irish regulator’s guidance recommends a clear privacy notice given up front, often as its own page.
Two practical points for booking:
- Link the notice from the booking page itself, not only from the club website footer.
- Do not lean on consent for everything. Most booking data is needed to run the membership you already provide, so the legal basis is usually the contract or the club’s legitimate interests. Choose the basis deliberately and write it down.
Do you need to register with the ICO?
A lot of committees worry about this, so here is the direct answer. The ICO says that using an online booking system does not mean you have to pay the data protection fee, even if the data sits in the cloud. The same page notes that CCTV used for certain purposes can change the position.
If your clubhouse or car park has cameras, check the ICO’s fee self-assessment before assuming you are exempt. Being exempt from the fee does not exempt you from the rest of the law.
Emails: where clubs actually go wrong
The most common slip is not a hacker. It is a well-meaning secretary sending a competition reminder with 150 addresses in the CC line.
The ICO’s monetary penalty notice against Central YMCA concerned a 2022 incident under Articles 5(1)(f) and 32 of the UK GDPR, the security provisions. The case involved a different sort of organisation, but the lesson reaches every club: if you email groups, you need a documented process, not a hope that everyone remembers.
A simple routine:
- Never put a group in CC. Use BCC, or a mailing tool that sends individually.
- Prefer sending tee sheets and notices from the booking system rather than from a personal mailbox.
- Keep a short written rule for whoever runs competitions, and brief new volunteers when they take over.
- Treat the tee sheet itself with care. Share it with members who need it, not with the public.
If something goes wrong
A personal data breach is not only a cyber attack. A misdirected email, a lost laptop or a tee sheet shared with the wrong people can all count.
Where a breach is likely to put people at risk, the ICO must be told without undue delay and, where feasible, within 72 hours of you becoming aware of it. Where the risk is serious, affected members must be told directly too.
Prepare before it happens:
- Name one person who decides whether a breach is reportable, and a deputy.
- Agree with your booking provider how and when it will alert you.
- Keep a simple log of incidents, including ones you decide not to report, with your reasoning.
If you are unsure whether an incident is reportable, contact the ICO’s helpline promptly rather than waiting until the 72 hours have run out.
Our perspective: fairness and privacy are the same discipline
We built BallChute because popular tee times vanish in seconds and members resent the scramble. When we talk to clubs, privacy rarely comes up first. Fairness does. But the two share a root: both are about the club setting clear rules and applying them evenly.
In BallChute, the club sets the rules. It defines its own booking rules and time limits, uses member verification, and chooses how groups are selected. That control is useful for privacy for a simple reason: the club decides how the booking process works, so the club can decide how little data the process needs. We would encourage any committee to start from the smallest possible set of fields and add only what a competition truly requires.
We also think the controller-and-processor distinction deserves more attention than it gets. The club remains the party members hold to account. Our job, and that of any supplier, is to make the committee’s decisions easy to carry out and easy to explain to members. We are not a replacement for your membership or competition management platform, and we do not want to hold more of your members’ information than the booking needs.
If you want to see how that works in your own setting, ask us your data questions during the trial. We would rather you ask them before signing up than after.
— Simon
A fair queue also treats members fairly
Privacy and fairness meet in the booking queue. When a release becomes a race, the people who lose are often those less confident online, and the people who win may be using automation. We have written about bots that give some members an unfair head start and about setting a booking fairness policy that fits the way UK venues operate. A written policy is also something you can point to in your privacy notice: it shows the club has thought about how booking works and why.
If you are comparing approaches, our page on waiting rooms, fastest-finger booking and tee-time ballots sets out the differences.
Trying BallChute at your club
BallChute is a tee-time booking tool for golf clubs: an online waiting room where members join a queue and take turns to choose, with club-set rules and time limits, group selection, member verification and tee sheets that can be downloaded or emailed. Clubs can try it free for 14 days, with no automatic fees.
Plans, as published on our site:
| Plan | Monthly | Annual |
|---|---|---|
| Standard | £29 per month per club | £290 per year per club |
| Intelligent Golf | £35 per month per club | £350 per year per club |
The Intelligent Golf plan is for clubs on that membership system; see how it works with Intelligent Golf.
A one-page privacy checklist for your committee
- Name the club as controller and record who is responsible day to day.
- Get a written processing agreement from every booking and email supplier.
- List the booking data you hold, why, and for how long.
- Cut any field you cannot justify.
- Publish a privacy notice and link it from the booking page.
- Replace CC with BCC or system-sent emails, and write the rule down.
- Name your breach lead and rehearse the 72-hour clock.
- Review all of it once a year, and whenever you change supplier.
FAQ
Does GDPR apply to a small, volunteer-run golf club?
Yes. The UK GDPR and the Data Protection Act 2018 apply to any organisation handling information about identifiable people, and that includes members’ clubs run by volunteers. What changes is scale: a small club’s documentation can be short, but the duties to be fair, secure and transparent still apply.
Is the club or the booking provider responsible for member data?
The club, as controller, stays accountable. The provider acts as a processor on the club’s instructions, and the ICO expects a written contract between the two. Checking a provider’s security and terms before you sign is part of your own compliance.
Do we need to pay the ICO data protection fee because we take online bookings?
No. The ICO says an online booking system alone does not trigger the fee, even when data is held in the cloud. CCTV can, so check the ICO’s guidance if you have cameras on site.
What should a golf club’s booking privacy notice include?
Say what data you collect, why you need it, who it is shared with (including your booking provider), how long you keep it and how members can exercise their rights or raise a concern. Keep it short and in plain language, and link it where members actually book.
How quickly must we report a data breach?
If a breach is likely to put people at risk, you must tell the ICO without undue delay and, where feasible, within 72 hours of becoming aware. If the risk to members is serious, you must tell them directly as well.
Sources
- Data Protection Act 2018, legislation.gov.uk
- Data protection principles, definitions and key terms, ICO
- What needs to be included in the contract? ICO
- Paying a data protection fee: other service activities, ICO
- Central YMCA monetary penalty notice, ICO
- Nene Golf GDPR privacy policy and data processing statement
- Tell people what you do with their data, Data Protection Commission (Ireland)
- Data protection in clubs and associations, FDPIC (Switzerland)