1. Purpose and Scope

This policy sets out the practical rules and statutory procedures EDGA volunteers follow when handling personal data. It applies across all Association operations including membership administration, junior activities, tournament registrations, payment processing, club affiliation, safeguarding records, website systems, and Board governance.

This policy reflects the statutory obligations established under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Statutory Controller Identity and Roles

• Data Controller: English Disc Golf Association was formally incorporated on 25 September 2026 as a Company Limited by Guarantee (Company No. 17481886; approved exemption for omission of ‘Limited’), acting as the legal Data Controller.
• Board Accountability: The EDGA Board is collectively accountable for statutory data protection compliance, approving data protection policies, high-risk processing, and material information assets.
• Data Protection Lead: The Digital Officer acts as Data Protection Lead, coordinating Subject Access Requests (SARs), maintaining the processing register, managing security audits, and advising the Board.
• Dual Authorisation: A second Board officer must approve significant disclosures, refusal of individual rights requests, indefinite data retention, reportable breach notifications, or high-risk data sharing.
• Public Contact Route: The public and members can exercise data rights via [email protected] or the EDGA contact form.

3. Core Data Handling Principles

Every EDGA volunteer must adhere to the seven fundamental everyday data rules:

1. Purpose Limitation: Use personal data only for agreed, legitimate EDGA purposes (membership, events, safeguarding, official notices).
2. Data Minimisation: Collect and retain only the minimum data strictly required to deliver the specific task.
3. Accuracy: Keep records accurate and update or remove obsolete data promptly.
4. Storage Limitation: Do not retain personal data indefinitely. Adhere to agreed retention schedules.
5. Integrity and Confidentiality: Store data securely within official EDGA Google Workspace infrastructure. Never store data on personal unencrypted devices or unsecured cloud shares.
6. Individual Rights: Respect members’ statutory rights to access, rectify, or erase personal data.
7. Accountability: Maintain clear processing logs and document the lawful basis for all activities.

4. Systems Security and Access Controls

• All volunteers with access to personal data must use official @edga.org.uk individual accounts. Shared or generic logins for administrative access are prohibited.
• Multi-factor authentication (MFA) is strictly mandatory on all EDGA Google Workspace accounts.
• Personal data exports (e.g. tournament eligibility rosters or membership lists) are tightly restricted. Before an export is supplied, the requester must obtain written approval from the Digital Officer and state the task, lawful basis, minimum fields required, intended recipient, storage method, and deletion date. Approval and deletion must be recorded.
• Official data must never be transmitted via unsecured consumer messaging platforms (such as WhatsApp groups) or stored in personal Google Drives.

5. Protection of Junior and Vulnerable Participant Data

• Junior personal information (<18) requires heightened care. Junior details are collected only for membership eligibility, tournament check-in, and safeguarding duty of care.
• Adult account holders manage family and junior registrations. A parent or guardian does not automatically own every data-protection right of a competent child.
• Junior contact details, full dates of birth, and home addresses must never be published in public directories, online ranking tables, or open spreadsheets.
• Photography and videography of juniors at sanctioned events requires prior written consent from a parent, carer, or legal guardian.

6. Individual Rights and Subject Access Requests (SARs)

• An individual may exercise statutory rights (access, rectification, erasure, restriction, objection) verbally, in writing, via [email protected], or through the EDGA contact form.
• EDGA will log and acknowledge all requests without undue delay and respond fully within one calendar month.
• Erasure is not absolute where legitimate legal obligations exist, such as accounting records, incident records, or safeguarding records. Any decision to refuse or restrict an erasure request requires approval by two Board officers.

7. Personal Data Breach Management and 72-Hour Reporting

• A personal data breach includes unauthorized access, sending personal data to incorrect recipients, lost devices containing unencrypted association records, compromised accounts, or supplier security failures.
• Any volunteer who identifies a suspected breach must report it immediately to the Data Protection Lead at [email protected] or through the EDGA contact form.
• The Data Protection Lead will immediately contain the incident, assess the risk to affected individuals, and maintain a formal Breach Log.
• Where a breach is likely to result in a risk to the rights and freedoms of individuals, EDGA will notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
• Where high risk to individuals is identified, affected individuals will be notified directly with clear mitigation advice.

8. Annual Review and Governance

The Board will conduct an annual Data Protection Governance Review confirming controller details, ICO fee registration status, access permissions, MFA compliance, and review of the Breach Log.