Clubs post photos of junior players for good reasons. Showing the junior section on your Instagram tells prospective families that your club is active, welcoming, and worth joining. A photo of a Dynamos session with smiling eight-year-olds is the most powerful recruitment asset a junior section has.
The problem is that publishing an identifiable photo of a child without the right consent is a data protection breach. Most clubs doing it do not know they are doing it.
What UK GDPR actually requires for cricket clubs
The UK GDPR applies to any club that processes personal data. A photo of an identifiable child is personal data. Publishing it on a public Instagram account is a publication, which counts as processing under the Regulation.
The lawful basis for processing in this context is consent. That means you need:
- Explicit consent from a parent or guardian of the child in question
- Consent that is specific to the image being shared, not buried in a general membership form
- A record that the consent was given, and when
- The ability for a parent to withdraw consent at any time, with the photo removed promptly on request
The Information Commissioner's Office (ICO) guidance on children and data protection states that organisations working with under-18s should treat their data with extra care. For clubs, this means the default position when in doubt is not to post.
ECB Safe Hands rules on photography
The ECB's Safe Hands safeguarding code applies to all ECB-affiliated clubs and adds specific requirements on top of UK GDPR.
The key rules from the ECB Photography Guidance (2023 edition) are:
- Clubs must display a notice at the ground advising that photography is taking place
- Written consent from a parent or guardian is required before publishing images of under-18s on club websites or social media
- The consent form must be separate from the membership or registration form
- Consent must be refreshed annually or when circumstances change significantly
- Clubs should have a system for tracking who has given consent and for which children
The ECB Photography Guidance is explicit: a general membership form does not cover social media photography. You need a dedicated consent form.
Why clubs need both UK GDPR and ECB Safe Hands
UK GDPR is law. The ECB Safe Hands code is a condition of your club's affiliation to the ECB. Both apply. They do not replace each other.
In practice, the ECB guidance gives clubs a more specific framework for cricket-related photography, while UK GDPR sets the legal minimum for data protection more broadly. Running both correctly means using the ECB's own consent form and keeping a club register of who has consented.
Clubs sometimes ask whether UK GDPR applies if they are not formally incorporated or if they are just a village club with no employees. The answer is yes. Any club that collects personal data (including images of members) is a data controller under UK GDPR and must comply.
The practical consent system a club needs
A compliant consent system does not need to be complicated. It needs to be followed.
The consent form
Use the ECB's own Photography and Video Consent Form, available from the ECB Safe Hands resource library on the ECB website. It is written in plain English, covers both UK GDPR and ECB requirements, and has been reviewed by the ICO. Do not draft your own form unless your club has specific circumstances that the standard form does not cover.
The consent register
Keep a simple register: player name, parent name, date consent given, and which channels are covered (website, Instagram, Facebook, all). You do not need to store the consent forms themselves in digital form, but you must be able to demonstrate that consent exists for any photo you publish.
Refresh and review
Consent should be refreshed at the start of each season. A player's circumstances change. Parents separate. Guardianships change. A consent form signed in 2024 may not reflect a 2026 situation. Annual refresh keeps your register current.
The photo decision checklist before you post
Before publishing any photo that includes identifiable junior players, run through these five questions:
- Is the player clearly identifiable in this image (face, name, or squad details)?
- Is this player on our consent register?
- Does the consent cover this specific channel (Instagram, Facebook, website)?
- Is the player in a vulnerable or distressed situation in this image?
- Would the player or their family be comfortable with this being seen by anyone, indefinitely?
If you answer no to question two or three, do not post. If you are unsure about question four or five, do not post. The safest post is the one you did not publish.
When in doubt: the alternative posts
You do not need to stop posting about your junior section. These approaches do not require individual consent:
- Action shots from behind (shows the game, not the face)
- Squad-level photos where players are not individually named
- Ground, facilities, and equipment shots
- Graphics and templates that represent the junior section without showing specific children
- Named posts that credit coaches or volunteers rather than named players
What to do before your next post goes live
If your club has been posting junior photos without a dedicated consent system, the time to fix it is now, not after a complaint.
The steps are:
- Download the ECB Photography and Video Consent Form from the ECB Safe Hands resource library
- Send it to every parent with a child in the junior section and collect completed forms before the next match or training session
- Build a simple consent register (a spreadsheet with name, parent, date, and channels is sufficient)
- Put the ECB ground photography notice up at your ground and your clubhouse
- Brief whoever manages club social media on the decision checklist
- Remove any posts that feature identifiable junior players where you do not have consent on file
Related: