Athlete data privacy: GDPR for cycling teams

Athlete data privacy in a cycling team comes down to three questions: what you hold about each rider, on what legal basis, and who can see it. Under the EU's General Data Protection Regulation (GDPR), rides, power files and bike fits are personal data. Morning HRV, resting heart rate, illness, injury and physio notes are likely to be data concerning health, which the GDPR treats as a special category with stricter rules. This guide is general information for managers, coaches and riders, not legal advice; for your own situation, talk to a data protection specialist.

Is athlete data health data under the GDPR?

Almost everything a team records about a rider is personal data, and some of it is health data. Illness, injury, the menstrual cycle and physio notes are health data, and heart rate, HRV and sleep are likely to be.

Personal data is any information relating to an identified or identifiable person. The GDPR defines data concerning health as personal data about a person's physical or mental health that reveals information about their health status. The UK regulator, the Information Commissioner's Office (ICO), uses the same definition in the UK's version of the GDPR. It lists data from fitness trackers among its examples, and notes that health data can be about past, current or future health.

Data	Usually	Why it matters
Rides with GPS tracks	Personal data	Start and finish points can show where a rider lives
Power, cadence, speed	Personal data	Shows ability and training; commercially sensitive for a professional
Heart rate, HRV, resting heart rate, sleep	Likely health data	Readings of the body's state, much like a fitness tracker's
Illness, injury, medication	Health data	About health status by definition
Menstrual cycle	Health data	Among the most sensitive data a team can hold
Body weight and composition	Treat with the same care	Can reveal health status, and riders feel strongly about who sees it
Bike fit numbers	Personal data	A note such as "saddle lowered after knee surgery" is health data
Physio and doctor notes	Health data	Clinical by nature

Inferences count too. The ICO says that if you use data to infer something like a person's health status, that is special category data, however sure or unsure the inference is. A readiness score that hints a rider may be falling ill deserves the same care as the illness itself. For the menstrual cycle in particular, our guide to menstrual cycle training covers how to talk about it, and record it, with care.

Do you need riders' consent to use their health data?

Not always. For an amateur team or club, the rider's explicit consent is often the most practical condition for using health data. You need a lawful basis under Article 6 of the GDPR and a separate condition under Article 9, which otherwise prohibits processing data concerning health. For professional riders employed by their team, consent may not be enough.

The consent must be explicit and given for one or more specified purposes (Article 9(2)(a)). It only counts if it is freely given, specific, informed and unambiguous (Article 4(11)). The European Data Protection Board (EDPB), which publishes official guidance on the GDPR, sets out what that means in practice in its consent guidelines:

• Granular. Separate purposes need separate consent. Bikes and fits, rides and training, and health notes are different questions.
• Active. Pre-ticked boxes are not valid consent. The rider ticks each box themselves.
• Not a condition. Making a place in the team depend on consent to data the team does not need weighs against the consent being freely given (Article 7(4)).
• Reversible. A rider can withdraw consent at any time, and withdrawing must be as easy as giving it (Article 7(3)).

Professional riders are a different case when they are employees of their team. The EDPB says that for most processing at work, an employee's consent is unlikely to be freely given, because of their dependence on the employer. A professional team may then need another Article 9 condition, such as obligations under employment law (Article 9(2)(b)) or occupational medicine under a professional duty of secrecy (Article 9(2)(h) and 9(3)). This is where a data protection specialist earns their fee.

Who in a cycling team should see a rider's data?

Each person in a team should see only the rider data they need to do their job. The GDPR asks that personal data be "adequate, relevant and limited to what is necessary" for the purpose (Article 5(1)(c)). In a team, that becomes a question for every role.

• A mechanic needs bikes and fit numbers, not HRV or illness notes.
• A sports director planning selection needs to know a rider is not fit to race, not the diagnosis.
• A coach needs rides, power and readiness, not the physio's confidential notes.
• A physio needs the fit history and the clinical picture, not every training file.
• Teammates need none of it, unless the rider chooses to share.

Shared folders and single team logins fail this test by design. So does a whiteboard in the team bus showing everyone's weight. Software that grants access by role, with the rider able to see who sees what, is the practical answer. Our article on cycling team management software sets out what each role typically needs.

Storage limitation is the other half: keep personal data no longer than the purpose needs (Article 5(1)(e)). Decide in advance what happens when a rider leaves. Either delete their data, or keep only what you need for a stated reason, such as results or a contract question, and stop receiving anything new from them.

What data rights do riders have under the GDPR?

Riders can ask to see their data, get a copy and have it deleted, and they can withdraw their consent at any time. Where processing rests on consent or a contract and is automated, they can also take the data they provided elsewhere. A team should normally answer a request within one month.

The month can be extended by two further months for complex or numerous requests, if you tell the rider within the first month (Article 12(3)).

• Access (Article 15). A rider can ask whether you hold their data and receive a copy of it.
• Portability (Article 20). Where processing rests on consent or a contract and is automated, a rider can receive the data they provided in a structured, commonly used and machine-readable format, and take it elsewhere. For rides, the original FIT file is the natural answer.
• Erasure (Article 17). A rider can ask you to delete their data, for example when they withdraw consent and nothing else justifies keeping it. There are exceptions, such as data you need for legal claims or to meet a legal obligation.
• Withdrawing consent (Article 7(3)). What you did before stays lawful, but processing that rested on that consent stops.

A rider who changes team in the winter uses these rights in practice, even if they never name an article. Make leaving easy and clean.

From what age can a junior rider consent under the GDPR?

For online services that rely on consent and are offered directly to a child, the GDPR lets a child consent alone from 16, and each member state can lower that age to as young as 13. Below it, a parent must give or authorise consent. Check the age that applies in your country before riders set up accounts.

Many clubs coach riders well under 18, and data about children deserves extra care. The age and its conditions are set in Article 8 of the GDPR.

In practice, a club should explain to parents and riders together what is recorded, who sees it and why, and keep the list short. Leave weight and body composition off anything shared, avoid public rankings of young riders' numbers, and send health questions to the family's doctor. Our guide to junior cycling training covers which numbers help young riders and which are better left alone.

What should a cycling team check before using software?

Before riders' data goes into any software, sign a data processing agreement, know the sub-processors and where the data goes, plan for a breach and consider an impact assessment. The software company is usually a processor, which processes personal data on the team's behalf (Article 4(8)). The team remains the controller and stays responsible.

• Sign a data processing agreement. Processing by a processor must be governed by a contract that sets out what is processed, about whom, why and for how long (Article 28(3)).
• Know the sub-processors. A processor may not bring in another processor without the controller's prior written authorisation (Article 28(2)). Hosting and AI providers are typical sub-processors.
• Know where the data goes. Transfers to countries outside the EU and EEA need a transfer mechanism, such as a European Commission adequacy decision or the Commission's standard data protection clauses (Articles 45 and 46). EU hosting makes this simpler, but AI features may still send text elsewhere, so ask.
• Plan for a breach. A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33). The exception is a breach that is unlikely to put riders at risk.
• Consider an impact assessment. The ICO lists hardware and software that offers fitness or health monitoring among its examples of processing likely to result in high risk, where a data protection impact assessment (DPIA) may be needed.

A checklist for a cycling team

• List what you hold about each rider, where it lives and who can see it.
• Mark the health data: HRV, resting heart rate, sleep, illness, injury, weight, the menstrual cycle and clinical notes.
• Write down the legal basis for each use, with advice if your riders are employees.
• Ask for consent part by part, with nothing pre-ticked and the exact words kept on record.
• Give each role only what its job needs, and retire shared logins.
• Keep weight and health off shared screens and noticeboards.
• Involve parents for juniors, and check your country's age of consent.
• Sign processing agreements with every software provider, and know where the data is hosted.
• Decide what happens to a rider's data when they leave, and tell them before they join.
• Rehearse answering an access request within a month, original ride files included.

In Velograph, the platform this blog belongs to, a team's invitation shows each part as its own box, and nothing is ticked for the rider. Notes that may hold health information can be asked for but never required. Every answer is recorded in the words shown, and Velograph runs in the EU, in Frankfurt. The same part-by-part choice applies when a fitter or a team scans a rider's bike fit passport: the rider answers on their own phone before anything is shared.

Further reading

• Guidelines 05/2020 on consent under Regulation 2016/679, European Data Protection Board, 2020.
• What is special category data?, Information Commissioner's Office, 2024.
• Special category data: a guide to lawful basis, Information Commissioner's Office, 2024.