In a lot of clubs, the WhatsApp group took over without anyone deciding it should. A volunteer set it up, members were added as they joined, and today it's the club's official channel. That deserves a closer look, because the data protection responsibility sits with the club. (If you're weighing up other tools, see the best WhatsApp alternative for a club.)
- A club that uses a WhatsApp group for its activities is the controller of its members' data in that context, even though the app belongs to Meta.
- The main risk isn't the content of the messages, which is end-to-end encrypted, but phone numbers on show to every member and people being added without their agreement.
- Special category data (health, religion, beliefs, trade union membership) and children call for extra care.
- You can cut the risks a lot: tell members, invite rather than add, limit who posts, remove former members, or pick a tool that doesn't rely on phone numbers.
Which law applies: UK GDPR, EU GDPR
In the UK, the rules come from the UK GDPR, the version of the EU regulation kept in UK law after Brexit, read alongside the Data Protection Act 2018. The core principles are the same as in the EU. The regulator is the Information Commission, which took over from the Information Commissioner's Office (ICO) on 30 September 2026; its guidance, including a section for small organisations, groups and clubs, is on ico.org.uk. If your group is based in Ireland or elsewhere in the EU, the EU GDPR applies directly and your national data protection authority is the regulator.
Your club is responsible, even on WhatsApp
Data protection law applies as soon as you handle information about identifiable people: names, phone numbers, photos, who came to training. The organisation that decides why and how that information is used is the controller. A club that runs its membership, communications and activities is the controller for those purposes, including when it chooses WhatsApp to talk to members.
The law doesn't apply to “purely personal or household” activity (Article 2 of the UK GDPR): a chat between friends isn't caught in the same way. But a group that acts as the club's official channel, built from its membership list and run by its committee, is in principle part of the club's activity, not its members' private lives.
Seven sensitive points in a club WhatsApp group
1. Phone numbers are visible to every member
In a standard WhatsApp group, every member sees everyone else's number. For the club, that means sharing part of its membership records with the whole membership. Yet the law sets a principle of data minimisation (Article 5): share only what's needed, with those who need it. Members' details aren't meant to be available to all members.
WhatsApp is gradually rolling out usernames in 2026, which will mean showing your number less, and the announcement groups of WhatsApp “Communities” already hide members' numbers (but not admins'). A phone number is still required to create an account, though, and it remains visible in many existing groups. Check in the app what your members can actually see.
2. Adding people without asking
Adding a member straight from the number on their membership form uses that data for something they may not have expected: signing them up to a third-party platform and showing their number to everyone else. The law requires people to be told how their data is used (Article 13). It's better to announce the group and let each member join through an invitation link.
3. The address book
WhatsApp's UK privacy policy explains that you can use contact upload to share your phone's address book with it regularly, including contacts who don't use WhatsApp. That's each user's choice. But a club that asks volunteers to save every member's number in their phone “for the group” is feeding it indirectly.
4. Metadata at Meta
Message content is end-to-end encrypted. WhatsApp does, however, process metadata: who is in which group, when people connect, from which device. In the UK, the service is provided by WhatsApp LLC, the US company, under UK-specific terms; in the EU, by WhatsApp Ireland, which the Irish regulator fined €225 million in 2021 for a lack of transparency.
5. Former members keep everything
The law says not to keep data for longer than needed. In a WhatsApp group, a member who leaves the club keeps the numbers, history, photos and documents on their phone until they delete the chat. The club can't tidy up for them, but removing leavers promptly limits what they receive afterwards.
6. Special category data
For some groups, simply being a member reveals special category data under Article 9: a patient support group, a faith community, a trade union branch, a political group, a recovery group. Exposing the member list, even among members, is then more delicate. The same goes for a scanned medical note or a child's allergy posted in the chat.
7. Children and photos
In the UK, 13 is the age from which a child can consent on their own when an online service is offered directly to them (Article 8 of the UK GDPR); in July 2026 the government decided not to change that for now. WhatsApp's UK terms also set a minimum age of 13. For a junior section, a parents' group is the safer set-up, and governing bodies have their own safeguarding rules: The FA's guidance, for instance, asks officials to copy a parent or carer, or the welfare officer, into messages with 16 and 17-year-olds who hold a position of responsibility. As for photos, a picture of an identifiable person is personal data: ask before sharing, and ask parents for children.
If you keep WhatsApp: eight good habits
- Tell members: mention the WhatsApp group in the club's privacy notice or on the membership form (why you use it, which app, what other members can see).
- Invite, don't add: share an invitation link and let each person choose to join. Offer another channel (email) to anyone who doesn't want WhatsApp.
- Separate uses: an “announcements” group where only admins write, apart from the free chat.
- Several committee admins, so the group doesn't depend on one phone.
- No special category data, and no documents with personal details (member lists, bank details, medical notes) in the chat.
- Tidy up: remove members who leave, and review the group at the start of each season.
- Write a few rules: no screenshots shared outside the group, no photos of other people without their agreement.
- Keep a simple record: Article 30 asks controllers to keep a record of their processing. The exemption for organisations with fewer than 250 people doesn't apply when processing isn't occasional or involves special category data, so a short note of what you hold, why and where is a sensible habit. A not-for-profit club may also be exempt from the data protection fee if all its processing is for its membership and activities; the ICO's self-assessment will tell you.
Choose a tool that reduces the problem at source
Most of the difficulties come from the fact that WhatsApp is built on the phone number. A group tool that doesn't need one solves a large part of the issue. What to look for:
- Sign-up possible without a phone number.
- Members' contact details that can be hidden, and a member list the admin can hide.
- A channel where only the committee posts, separate from the chat.
- A way for leavers to delete their contributions.
- Hosting in Europe, no ads, no selling of data.
- A clear privacy policy and an identified contact.
What YouTim does on these points
- No phone number required: an email address is enough, or sign in with Google or Apple.
- Contact details under control: in each YouTim, anyone can turn off “Publish my contact details” on the Members page; other members then see neither their email nor their phone number. The YouTim's admins always see them, because they need them to manage members. An admin can also turn on “Hide the participant list”: members then only see the admins.
- Announcements are for admins only, with “Read by x/y”; the chat can be restricted so that only admins write.
- Joiners and leavers: a new member only sees chat messages posted after they joined, unless an admin gives them access to the history; a member who leaves a YouTim can delete their messages, reactions, votes and photos at the same time.
- Hosting and security: the app is hosted in Amsterdam and files are stored with Scaleway in Paris; data is protected in transit (TLS 1.2 or higher) and content is encrypted at rest (AES-256). No ads, no public profile, no selling of data. YouTim is published by Simplycards, a French company.
With a tool that doesn't rely on phone numbers, most of the phone-number risks go away. The club just keeps a few good habits: telling members, keeping a record, deciding how long to keep data and answering access or deletion requests.
The committee checklist
- We know which tools we use to talk to members, and who runs them.
- Members know about these tools and what other members can see about them.
- Everyone joins voluntarily, and there's another channel for those who'd rather not.
- Official information goes through a channel where only the committee posts.
- No special category data or personal documents circulate in the chat.
- Leavers are removed, and we review things every season.
- At least two committee members are admins.
- For juniors, we go through parents and follow our governing body's safeguarding guidance.
- We have a short written record of the data we hold, including member communications.
Frequently asked questions
Is a club allowed to use WhatsApp?
No law forbids it. But the club stays responsible for its members' data: it must tell them, limit what is shared and avoid exposing special category data. How the group is run matters more than the app itself.
Do we need members' consent to add them to a WhatsApp group?
UK GDPR doesn't always require consent, but it does require you to tell people and to use only the data you need. Adding someone directly shows their number to every member and signs them up to a third-party platform, so the safest approach is to share an invitation link and let each person choose.
Does a WhatsApp group set up by one member count as the club's?
A group of friends set up privately is a personal matter. If it serves as the club's official channel, is run by the committee or is built from the membership list, it is in principle part of the club's activity.
Does our small club have to pay the ICO data protection fee?
Not necessarily. The fee regulations treat processing by a not-for-profit body for its membership and activities as exempt, but only if all of its processing fits that description. Use the self-assessment on ico.org.uk to check, and remember the UK GDPR rules apply either way.
How does YouTim help our club with GDPR?
No phone number required, contact details and member list that can be hidden, hosting in Europe, content encrypted at rest, and anyone leaving can delete their contributions. The club keeps its good habits: telling members, keeping records and deciding how long to keep data.
Sources
- UK GDPR, Article 8: children's consent (legislation.gov.uk)
- UK GDPR, Article 30: records of processing (legislation.gov.uk)
- The Data Protection (Charges and Information) Regulations 2018, Schedule (legislation.gov.uk)
- GOV.UK: Information Commission succeeds the ICO as UK's data protection regulator
- GOV.UK: Growing up in the online world, government response (July 2026)
- The FA: guidance note 6.2, digital communications and children (PDF)
- WhatsApp: Terms of Service UK
- WhatsApp: Privacy Policy UK
- Regulation (EU) 2016/679 (EU GDPR), official text
This article is general information, not legal advice. For your own situation, see the ICO's advice for small organisations on ico.org.uk or speak to a data protection professional. Information correct as of 8 November 2026.