Children's data protection in play centres and nurseries (GDPR)
What data you may process, which consents you need, and how to align daily operations with GDPR without slowing reception.
Running a nursery or indoor play centre means processing children's data and guardian details. GDPR does not forbid operations; it requires clear purpose, minimisation and security. Risk grows when data lives in notebooks, WhatsApp photos and loose sheets.
Data you typically need (and what to avoid)
Justifiable for access, billing and alerts:
- Responsible adult ID and contact.
- Child name or in-venue alias (per your policy).
- Entry/exit times, wristband, amounts.
Avoid without real need:
- Child ID number unless legally required.
- Photos for "membership cards" unrelated to access.
- Medical history unless sector rules require it in writing.
LudoSAFE compliance covers versioned consents and panel roles.
Consents at the desk
Families must understand why each datum is used:
- Visit management (entry, time, payment, pickup).
- Operational messages (end-of-time alerts, incidents).
- Other purposes (newsletter, promo photos) only as separate opt-in.
One unreadable "I accept terms" is not enough.
Controller vs processor
You are usually controller for customer data. Your software vendor is typically processor. Before signing: art. 28 agreement, sub-processors, breach procedure.
Daily practice
| Situation | Risk | Practice |
|---|---|---|
| Rush enrolment | Wrong data | QR pre-check-in or short form |
| Visible paper lists | Unauthorised access | Logged panel |
| Party groups | Mixed guardians | Register per responsible adult |
| Staff leaving | Active accounts | Disable users immediately |
Family rights
Access, rectification, erasure and objection need a channel (email/form). Register requests and respond in legal time — not necessarily in 30 seconds at the desk.
Want to see LudoSAFE at your venue?
We'll walk you through enrolment, wristbands and alerts with no obligation.