GDPR for dance schools: a plain-English checklist

Most dance schools hold more personal data than they realise: names and ages of children, medical notes, emergency contacts, photos and payment history. GDPR is not about paperwork for its own sake. It is about knowing what you hold, why you hold it, and being able to show it.

Know what data you hold

Start with a simple list. For each item, write down where it lives, who can see it and how long you keep it. If the answer is "in a WhatsApp group" or "on my personal phone", that is the first thing to fix.

Dancer names, dates of birth and class allocations
Parent and emergency contact details
Medical conditions, allergies and access needs
Photo and video permissions
Payments, invoices and outstanding balances

Get consent right, and separately

Consent for photos is not the same as consent for marketing, and neither is required to run a class. Keep them as separate opt-ins so a parent can say yes to one and no to another, and record the date each choice was made.

Consent must be as easy to withdraw as it was to give. A parent portal where a family can flip a switch themselves is far safer than an email thread you have to remember to action.

Treat medical data as special category data

Health information carries extra obligations. Restrict it to the staff who genuinely need it (usually the teacher on the register and your safeguarding lead) rather than every helper with a login.

Set retention periods and stick to them

You do not need to keep a leaver's medical notes for a decade. Financial records typically need six years for HMRC; most operational data can go much sooner. Write the periods down and diarise a yearly clear-out.

Be ready for a parent request

A parent can ask for a copy of everything you hold about their child, and you have one month to respond. If your data is spread across spreadsheets, inboxes and chat groups, that request becomes a weekend of work. If it is in one system, it is an export.

Where My Dance School helps

Consents captured per family with timestamps and self-service withdrawal
Medical and access notes visible only to permitted staff roles
Hosted in the EU (GDPR-compliant), with UK GDPR safeguards and role-based access controls
One place to export a family's record if you receive a request

Common questions

Do dance schools need to register with the ICO?

Most UK dance schools that process personal data electronically need to pay the ICO data protection fee. It is a short online registration and the fee tier depends on your size and turnover.

Can we post class photos on social media?

Only where you hold a clear, specific photo consent for each child shown, and that consent has not been withdrawn. Keep a visible list of children who must not appear in public posts.