Running clubs should not keep every membership form, emergency contact, attendance register and incident report forever. They should not delete everything as soon as somebody leaves either.
The practical answer is a data retention schedule: a short document that states what records the club holds, why they are needed, when they will be reviewed and what should happen when they are no longer required.
There is no universal period that works for every running club record. The correct period depends on the purpose of the information, any applicable requirements and whether the club can justify continuing to identify the people concerned. This guide provides a practical process rather than legal advice.
What is a data retention schedule?
A retention schedule is a working table covering the main categories of information held by the club. For each category, it should identify:
- what the record contains;
- why the club keeps it;
- where it is stored;
- who is responsible for it;
- what starts the retention period;
- when it must be reviewed; and
- whether it will be deleted, anonymised or retained with a documented reason.
The Information Commissioner’s Office guidance on data protection principles explains that personal information should be kept in identifiable form for no longer than necessary for its purpose. It also places responsibility on organisations to demonstrate how they comply.
A schedule turns that broad principle into instructions a membership secretary or committee volunteer can actually follow.
Start with purpose, not an arbitrary number of years
Before choosing a period, write down why the club holds each record. “We might need it one day” is not a clear purpose.
Better descriptions include:
- managing an active membership;
- contacting somebody in an emergency during a club session;
- confirming attendance at a particular run;
- administering payments and financial records;
- responding to an accident, complaint or insurance matter;
- managing a welfare or safeguarding concern; or
- respecting a person’s communication preferences.
The purpose determines what information is needed and when that need is likely to end. An emergency contact may be necessary while somebody regularly attends but unsuitable for indefinite storage after their participation finishes. A financial or incident record may require a different decision.
List every place where club data is stored
A schedule is ineffective if it covers the membership database but ignores the copies volunteers use elsewhere.
Check for personal information in:
- membership and check-in systems;
- paper registers and printed contact sheets;
- spreadsheets and shared drives;
- committee and personal email accounts;
- online forms and their exported responses;
- messaging groups;
- cloud storage and device downloads;
- accounting records;
- incident and welfare files; and
- backups and archived folders.
Use the club’s GDPR data audit checklist to find duplicate files and forgotten storage locations before finalising the schedule.
Build the schedule by record type
A simple spreadsheet or controlled committee document is enough. Avoid one broad rule such as “delete all records after six years”. Different information serves different purposes and carries different risks.
Membership profiles
Include contact details, membership status, joining and leaving dates, membership category and administrative notes.
The schedule should distinguish the information required for an active member from the minimal record, if any, needed after membership ends. Use the end of membership as a review trigger and connect the process to the club’s member leaver checklist.
Emergency contact and health information
Emergency information can be important during club activity, but that does not justify keeping an old copy indefinitely. Health information is special category data, so committees should be particularly clear about necessity, access and deletion.
Set review triggers for renewal, a reported change, the end of a trial period and the end of membership. Do not assume that retaining an outdated emergency contact is safer than deleting it; inaccurate information can create its own problems.
Guest and trial-runner records
A guest’s details may be needed to administer their trial visits, contact them about the club and respond if something happened during a session. If they do not join, decide when that operational purpose ends.
Separate guest administration from marketing. A person registering for a trial should not automatically remain on general promotional lists indefinitely.
Attendance history
Attendance records can support session safety, reporting, member engagement and investigation of an incident. Decide how long the club needs information linked to named individuals for each purpose.
If the committee only needs long-term totals or trends, consider whether anonymised or aggregated figures can replace identifiable records.
Payment and accounting records
Do not place all payment information inside general membership notes. Identify which financial records the treasurer must retain and why, then confirm the appropriate period with the club’s accountant, governing documents or applicable requirements.
At the end of that period, remove unnecessary supporting copies held in email inboxes or membership folders as well as the official record.
Incident, accident and near-miss reports
These records may remain relevant after membership or attendance ends. The period should reflect the nature of the event and any requirements set by the club’s insurer, governing body or professional adviser.
Record the decision separately from the ordinary membership profile, restrict access and review the guidance on what a running club should record after an incident.
Welfare and safeguarding information
Do not apply an automatic general-membership deletion rule to welfare or safeguarding records. These files may involve sensitive information, referral requirements and record-keeping guidance that differs from routine club administration.
The welfare officer or safeguarding lead should confirm the relevant governing-body procedure. Access should remain limited to people with a genuine need to know.
Communications and photographs
Cover mailing lists, communication preferences, event photographs and publicity permissions. The schedule should state how opt-outs are respected and whether a minimal suppression record is needed to prevent somebody being added again from an old list.
Review photographs separately from membership records. A person leaving the club does not answer every question about historical website or social media material, so define how removal requests and future use will be considered.
Use clear review triggers
A calendar period is easier to apply when the starting event is unambiguous. Suitable triggers might include:
- the date a guest last attended;
- the end of the membership year;
- the effective date of resignation;
- the date an incident was closed;
- the completion of a financial year;
- the end of a volunteer role; or
- the last meaningful contact with an enquirer.
“Review after membership ends” is clearer than “review old records regularly”. Record the review date where the system allows it, or run a scheduled committee review at defined points during the year.
Decide what happens at the end of the period
Reaching a review date does not always mean pressing delete immediately. The reviewer should choose and document one of four outcomes:
- Delete: the information is no longer required.
- Anonymise: the club needs statistics but no longer needs to identify individuals.
- Retain a smaller record: unnecessary detail is removed while a justified minimum remains.
- Extend with a reason: an incident, dispute, legal obligation or other documented need justifies continued retention.
Do not routinely extend periods because nobody has time to check the files. Assign ownership to a committee role and include the review in the annual admin calendar.
Align the schedule with the privacy notice
The ICO’s privacy information checklist says people should be given the retention period or the criteria used to determine it.
Compare the finished schedule with membership forms, guest registration wording and the club privacy notice. If one document says records are deleted when membership ends but the schedule retains particular information afterwards, the discrepancy needs resolving or explaining.
Be ready for erasure requests
A member or former member may ask the club to delete their information. Treat the request promptly and pass it to the volunteer responsible for data protection.
The ICO explains that the right to erasure is not absolute. The committee should assess which information can be removed and whether any specific record must still be retained for a lawful and documented reason. Do not respond with either an automatic refusal or a promise to delete everything before checking.
A practical retention schedule template
Use these headings for each entry:
- Record category: What information is covered?
- Purpose: Why does the club need it?
- Storage locations: Where do the original and copies exist?
- Owner: Which committee role is responsible?
- Review trigger: What event starts the retention period?
- Retention rule: How long is it retained, or which criteria determine that?
- End action: Delete, anonymise, reduce or review?
- Authority: Is the decision based on an operational need, insurer, governing body or professional advice?
- Last reviewed: When did the committee last confirm the rule?
Keep the wording specific enough that a new volunteer can apply it without relying on the memory of the person who wrote it.
Make retention part of ordinary club administration
A good schedule should work during membership renewals, guest follow-up, committee handovers and leaver processing. It should also prompt volunteers to remove exported spreadsheets, printed sheets and email attachments once they have served their purpose.
Bringing essential club records into fewer, controlled locations makes this easier. Explore Running Club Check-In’s GDPR and data protection features to see how organised member records and controlled access can reduce reliance on scattered files.
If your committee is ready to bring attendance, membership, guest, welfare and incident administration into one place, you can create a free club site without providing payment details.
