Children’s data and AI are becoming increasingly important issues for UK activity providers, especially as booking systems, remote support teams and cloud software become part of everyday business operations.
This week I attended two conferences connected with children’s activity businesses and support services. I found myself asking the same question repeatedly:
“What countries does your booking platform share data with?”
Not one person could answer me.
That does not mean these businesses were careless or irresponsible. Most of the people I spoke to were thoughtful, committed professionals who care deeply about the children and families they work with. They had privacy policies, booking systems, registers and safeguarding procedures. Many genuinely believed they were “GDPR compliant”.
The problem was not a lack of good intentions. The problem was that nobody had ever explained what questions they should actually be asking once children’s data starts moving between platforms, staff members, devices and AI tools.
That matters because children’s activity businesses often handle far more sensitive information than they realise. This is not just names and email addresses. It may include allergy information, asthma details, behavioural notes, emergency contacts, additional needs, medication records or safeguarding concerns.
That is sensitive personal information about children. Once you understand that properly, the conversation changes.
If some of the terminology around data controllers, processors or children’s data feels unfamiliar, I covered some of the basics earlier in our article:
Data Privacy Jargon Buster for Your Child-Centred Business
“But my platform is GDPR compliant…”
I hear this constantly, and sometimes the platform may well have very good systems and sensible protections behind the scenes.
The issue is not usually that the software company is doing something wrong. In fact, when I asked some suppliers direct questions, they were able to answer them once asked. The bigger issue was that many customers had never realised these were questions they should be asking in the first place.
A well-known platform does not remove the need for due diligence. You can outsource the work, but you can never outsource the responsibility.
That does not mean you should stop using booking systems, cloud software, remote support teams or AI tools. Most modern businesses could not function without them. The real issue is understanding what is happening to the information once you collect it and making sensible decisions about how you use those tools.
In many cases, parents are trusting your business with their child’s information. They are not thinking about processor chains, cloud hosting or integrations running behind the scenes. They trusted you.
It is not always about what you cannot do
One of the biggest misunderstandings around GDPR is the idea that compliance is simply a list of forbidden activities. Most of the time, the real question is not “Can I use this?” but “What do I need to understand before I use this properly?”
You may decide to use:
- a booking platform
- a VA or remote admin support
- AI features within your software
- cloud storage
- WhatsApp groups
- online forms
- overseas support services
None of those decisions are automatically wrong. The important thing is understanding what sits behind them.
This is something we first started discussing back in 2024 when looking at common data privacy mistakes in child-centred businesses, particularly around booking systems, overseas transfers and sharing too much information with team members.
Is Data Privacy Hard for a Child-Centred Business?
Who can access the information? What happens when somebody leaves the team? Can spreadsheets be downloaded onto personal devices? Are AI features switched on by default? Is information syncing across phones, tablets and home computers? How long is information being retained? Which countries may be involved behind the scenes? Who is it being shared with?
This is not about turning small business owners into technology lawyers. It is about getting your ducks in a row before problems arise.
The hidden risk is often over-access
Many people expect the biggest risk to be hackers. In reality, one of the biggest problems I see is over-access. Too many people can see too much information, across too many systems, with too little control over what happens next.
Children’s activity businesses often rely on a mixture of coaches, session leaders, freelance admin support, VAs, holiday club staff and remote workers. Most are using personally owned phones and laptops as part of normal day-to-day working life.
That creates practical questions which many businesses have never considered properly.
If a team member downloads attendance lists onto a personal laptop, where else is that information syncing? If a browser assistant or AI writing tool is active in the background, what information can it “see”? If allergy notes or safeguarding concerns are sitting inside spreadsheets, who can access them? What happens if someone leaves suddenly but still has access through an old login or synced device?
Most people are not being reckless. They simply have not been shown how modern software ecosystems actually work.
Concerns around over-sharing children’s information to staff devices and cloud systems are something we have been warning about for several years. The technology has evolved quickly, but many of the underlying governance risks are not new. But the speed at which it can go wrong has increased massively now AI is in the room.
This affects VAs and support teams too
This is also important for VAs and outsourced support businesses working within the children’s sector.
If you manage bookings, answer parent emails, organise registers, upload forms, process attendance lists or help coordinate staffing, you may be handling children’s personal data every day without fully appreciating the sensitivity of that role.
Again, this is not about panic. It is about clarity.
Both the activity provider and the support team need sensible boundaries around access, devices, sharing, storage and AI use. “Helping with admin” can still involve highly sensitive information, particularly where medical details, additional needs or safeguarding issues are involved.
Parents do not see the software chain
Parents do not separate your business from your suppliers, software platforms or remote support teams. They are not sitting at home thinking about international data transfers or AI integrations.
They trusted your business with their child’s information.
And when things go wrong, the consequences can be very real. Last year we looked at a major nursery-chain children’s data breach and the practical lessons smaller activity providers could learn from it.
Children’s Data Breach: 3 Things to Check
That is why this matters.
Not because small businesses should avoid modern tools, but because understanding how those tools work is now part of running a responsible business in 2026.
Good governance is rarely about doing nothing. More often, it is about understanding what is happening, asking better questions and putting sensible boundaries in place.
In other words, getting your ducks in a row.
Coming up at ICAP
I’ll also be discussing some of these issues with my colleague Susan Mackie, in more detail during my upcoming session with the Institute of Children’s Activity Providers on 28th May at 11am, including:
- what has actually changed around children’s data since summer 2025
- where responsibility now sits as businesses grow or involve others
- booking systems, outsourcing and remote support teams
- AI-enabled software and hidden over-access risks
- practical governance for small activity providers
- what is sensible to review now, and what can realistically wait
If you are an ICAP member, booking details are available through the member portal.
If your business has grown to the point where you are no longer entirely sure where children’s data travels, who can access it or what systems are doing behind the scenes, that is usually a sign it is time to properly review your setup before small gaps become much bigger problems later on.
Need help reviewing your children’s data setup?
If you have reached the point where:
- different team members access different systems
- you are using booking platforms or remote support
- you are unsure where information is stored
- or you simply want a clearer picture of where responsibility sits
Then a practical GDPR health check can help you map what is happening now before problems appear later.
We support both smaller activity providers needing practical guidance and larger organisations managing more complex systems and supplier relationships.
Book a quick chat to discuss whether a GDPR Health Check would be the right next step for your business.
Book here
