If you store student names and contact details, data protection law applies, whether or not you operate in the EU. Here's a plain-English guide for martial arts school owners, without the consultant speak. This isn't legal advice; it's an operator's orientation.
Why this is worth a post
Most martial arts school owners have heard the word GDPR and think it's an EU-only problem. It mostly is. But:
- Many state-level US laws (CCPA, Virginia, Colorado, Connecticut) borrow from GDPR's vocabulary.
- If you have one EU resident in your roster (military families, expat students), the rules apply to that record.
- Even outside any law, the principles are good practice: minimize, secure, delete on request.
What counts as personal data
Anything that could identify a person. At a school, that's almost everything you collect:
- Names of students and parents.
- Email addresses and phone numbers.
- Home addresses on waivers.
- Dates of birth.
- Photos used for any purpose.
- Medical or special-condition notes.
- Attendance records, which can imply religious observance or other personal patterns.
The most sensitive bucket: anything about minors, anything medical, anything that's collected without a clearly opt-in moment.
Your obligations, in plain English
1. Have a lawful reason for each piece of data
You don't need to write a legal opinion, but you should know why you're collecting each field. "We need their email to send class confirmations" is a lawful reason (contract performance). "We have a field for their kid's school" without a clear reason might not be.
2. Tell people what you collect and why
One short privacy notice on your signup form. Plain language. Three or four sentences. What you collect, what you use it for, how long you keep it, who else sees it (your payment processor, your school software). That's the minimum.
3. Get marketing consent separately
The email about a class cancellation is transactional. The monthly newsletter is marketing. Same email inbox, different legal basis. Marketing requires an explicit opt-in, separate from the main signup. Don't pre-check the box.
4. Secure what you store
Use software that takes security seriously. Don't email spreadsheets of student data to staff. Don't store waivers as photos in someone's phone. If a laptop or phone with student data is lost, you should be able to honestly say "but the data is encrypted at rest."
5. Honor deletion requests
When a family leaves and asks for their data to be deleted, you should be able to do it within a reasonable window (30 days is a common standard). Some things can be kept for legitimate business reasons (tax records, completed waivers, payments) but the rest should be deletable.
The right-to-erasure flow is the single most revealing test of whether your software was built this decade.
The right-to-erasure flow done correctly
When someone asks for their data deleted, a good flow looks like:
- Verify the request is from the actual person (or their parent/guardian if a minor).
- Anonymize rather than cascade-delete. The historical attendance and payment records should stay (they're business records) but the personal identifiers should be replaced with anonymized values.
- Keep an audit trail of the erasure. Not the deleted data, but a record that the erasure happened.
- Notify any sub-processors (your payment processor, your email vendor) where required.
What your software needs to do for you
- Encrypt data at rest.
- Use HTTPS for all access.
- Support role-based permissions so not every staff member sees everything.
- Provide an export so a family can request a copy of their data.
- Provide an anonymize-on-request flow.
- Maintain an audit log of who saw or modified records.
If your current tool can't do most of these, you have a compliance risk on top of an operational one.
What you have to do yourself
- Train staff not to email spreadsheets of student data.
- Lock the front-desk computer.
- Have a clear policy on what staff can text from personal phones.
- Keep marketing-consent and transactional-consent separate in your records.
Three things to do this week
- Read your current signup form. If it doesn't say what you'll do with the data, add three sentences that do.
- Check your marketing-consent capture. Is it a separate, unchecked box? If not, fix that.
- Ask your software vendor: how do you handle a deletion request? If the answer is "we don't have a flow for that," that's a real concern.
None of this requires a lawyer for a 200-student school. It does require five minutes of attention. For most schools, that's all that's missing.