Privacy policy

What this notice covers 

1. This privacy notice explains how the Independent Football Regulator (“IFR)” as data controller collects, uses and shares information about you (‘personal data’) when carrying out its functions as a public authority and running the organisation.   

2. In its interactions with clubs, owners, officers, senior managers, competition organisers and other persons, the IFR may receive personal data for the purposes of fulfilling its statutory functions.  The IFR recognises the importance of protecting this personal data and is committed to complying with its data protection obligations whilst delivering its work as a public authority. 

3. As the IFR continues to develop its processes and consider the use of new processes and/or technologies to enhance the way it works, it may be necessary to modify this notice. The IFR will keep this notice under review and update it as appropriate.  

What the IFR does and why it collects personal data 

4. The IFR is an independent statutory regulator focused on the top five tiers of English men’s football, created by the Football Governance Act 2025 (“Act”).  The IFR’s core objectives are to protect and promote the financial soundness of regulated clubs, to protect and promote the financial resilience of English football and to safeguard the heritage of English football.   

5. To meet its objectives, the Act provides the IFR with several functions and powers.  For these purposes and to run the organisation, the IFR will collect, use and share information about individuals.  This includes the publishing of public registers that the IFR considers necessary to support its functions.   

6. Information about individuals is called ‘personal data’ as defined within the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA).  Personal data is information about living individuals who can be identified from it.  It is not information about organisations or companies.  It includes voice recordings, photographs, CCTV images and online identifiers. 

7. Collecting, using or sharing personal data is called ‘processing’.  Anything at all that we do to, or with, personal data including deleting it, viewing it is processing.  Where we process personal data, we must do so in accordance with the requirements of UK GDPR and DPA. 

Why the IFR collects personal data and its purpose for processing 

8. The IFR expects to receive personal data while exercising its statutory functions and directly from individuals seeking to contact and provide information to the IFR.  This will include (but is not limited to): 

• As part of information received by the IFR through its statutory information gathering powers. 
• As part of engagement with stakeholders for the purposes of gathering information for the State of the Game report, required to be published by the IFR under section 10 of the Act. 
• As part of its assessment of the suitability of individuals to be owners and officers of football clubs (under Part 4 of the Act). 
• As part of the application process for football clubs to receive operating licences, and the IFR’s monitoring of clubs through the statutory licensing regime and the clubs’ compliance with their licence conditions (under Part 3 of the Act). 
• As part of clubs’ compliance with the duties placed upon them under Part 5 of the Act. 
• As part of the IFR’s engagement with competition organisers. 
• As part of information provided to the IFR through its correspondence function and through the submission of Freedom of Information requests submitted to the IFR. 
• As part of its ongoing engagement with stakeholders, including through its consultations. 
• As part of sharing information with and receiving information from other relevant statutory bodies, competition organisers and others under information sharing gateways in the Act or other legislation. 
• To publish public registers (including owners and officers register) and notices of determinations or such other notices. 
• For purposes which are ancillary to the exercise of IFR’s functions under the Act. 

The IFR’s purpose and lawful basis for processing personal data 

9. This section sets out the purpose for which we collect and use personal data, what types of information we process, and our lawful basis for doing so. 

Purpose 1: Exercising the IFR’s statutory functions 

10. The IFR’s statutory functions are set out in the Act.  The IFR’s responsibilities as a public authority include the following: 

• Producing a State of the Game report on the state of English football so far as relevant to the exercise of the IFR’s functions 
• Producing and publishing guidance and rules relevant to the exercise of the IFR’s functions 
• Overseeing a statutory licensing regime for all regulated clubs, through which the IFR will gather information from clubs in compliance with their mandatory licence conditions as set out in Schedule 5 of the Act, and for the IFR to monitor clubs’ compliance with the Threshold requirements in Schedule 4 of the Act 
• Assessing the suitability of prospective and incumbent owners and officers of regulated clubs (by reference to the statutory tests set out in Part 4 of the Act) 
• Monitoring the compliance of leagues and clubs with their duties under Part 5 of the Act 
• Using its powers of investigation, enforcement and sanctions to ensure the effectiveness of the regime 

The IFR may collect and process personal data for the purpose of carrying out each of these functions. 

Purpose 2: Supporting the delivery of the IFR’s statutory functions through ancillary activities  

11. Schedule 2 of the Act provides that the IFR may do anything which it considers will facilitate or is incidental or conducive to the carrying out of its functions under the Act. 

12. The IFR has recently been established and not all IFR’s functions and powers have commenced.  The IFR’s understanding of what incidental activities might facilitate the carrying out of its functions will develop over time.  As part of these activities, the IFR may collect and process personal data. 

12.  An example of such activity is the publication of a register of owners and officers to support its function of monitoring owners and officers’ suitability and informing the public of owners and officers of clubs. 

Purpose 3: Activities carried out by the IFR to run and operate its organisation 

14. For the purposes of managing its operations and running its organisation, the IFR will need to undertake various activities which would require the collection and processing of personal data.  These activities include but are not limited to: 

• Engaging and managing relationships with the IFR’s service providers (which may include tenders, negotiation and agreements of contracts, contract and relationship management, payment of invoices and general correspondence with third parties related to the IFR’s organisation and operations) 
• Maintaining the security of the IFR’s systems and premises (which might include monitoring access to, and activity within our systems or premises to ensure security including the use of CCTV) 
• Receipt of and responding to enquiries, requests and communications we receive from stakeholders.  This includes general enquiries as well as requests under statutory frameworks (such as data subject rights requests and requests under the Freedom of Information Act) 
• Hosting and facilitating meetings and events 
• Enabling clubs and others to sign up to receive communications from us about the IFR’s activities 

The types of personal data that the IFR will process for the purposes described above 

15. Depending upon the activities that we are undertaking, we may process the following categories of personal data when carrying out our functions as a public authority and running our organisation. 

Categories of personal data we process: 

• Identity and contact details including email address, telephone number and home address 
• Sex 
• Age and/or date of birth 
• Information requested as part of our application process for owner and/or officer as detailed in our rules and guidance 
• Audio recordings and/or visual images 
• Financial details 
• Information to demonstrate honesty, integrity and financial soundness 
• Information relating to criminal and disciplinary matters 
• Information relating to competence including qualifications, experience and training 
• Information relating to source of wealth 
• Intelligence material 
• Compliant, incident and accident details 
• Employment details 
• Online identifiers such as IP addresses 
• Case specific and evidence data 

16. The personal data that we collect, and use may include special category personal data.  Special category personal data (also referred to as sensitive processing) includes personal data revealing: 

• Racial or ethnic origin 
• Political opinions  
• Religious cultural or philosophical beliefs 
• Trade union membership 
• Health data (physical and/or mental) 
• Sexual orientation  
• Genetic or biometric data 

17. We may also collect and use criminal offence data.  This is information relating to criminal convictions and offences or related security measures.  This covers information that includes: 

• Criminal activity 
• Offences 
• Allegations 
• Investigations; and  
• Proceedings 

18. The IFR will only use the minimum amount of relevant personal information it considers to be necessary to carry out a particular activity. 

The IFR’s lawful basis for processing 

19. The lawful basis for the processing of personal data by the IFR will be either of the following: 

• processing is necessary for the performance of a task carried out in the public interest by the IFR, or in the exercise of official authority vested in the IFR (Article 6(1)(e) UK GDPR); 
• processing is necessary for compliance with a legal obligation to which the IFR is subject (Article 6(1)(c) UK GDPR); 
• the data subject has given consent to the IFR’s processing of the personal data for one or more specific purposes (Article 6(1)(a) UK GDPR); or 
• processing is necessary for the purposes of a recognised legitimate interest (Article 6(1)(ea) UK GDPR) or is necessary for the purposes of other legitimate interests pursued by the IFR (Article 6(1)(f) UK GDPR). 

Special Category Data and Criminal Offence Data 

20. To process Special Category Data and Criminal Offence Data, UK GDPR requires additional provisions to be met.  Where Special Category Data is processed our lawful basis for this processing is: 

• Processing is necessary for reasons of substantial public interest.  (Article 9(2)(g)) together with one or more of the substantial public interest conditions set out within the Criminal Offence Data provision below. 

Where Criminal Offence Data is processed, we do so in compliance with Article 10 UK GDPR and where a condition is to be met, the relevant condition for processing is either: 

• Condition 6 (statutory etc. Government purposes) 
• Condition 11 (protecting the public against dishonesty) 
• Condition 28 (Standards of behaviour in sport) 

Examples include: 

• where we collect (or disclose) information, gather intelligence, and carry out enforcement activity during our work to ensure the suitability of owners of regulated clubs and to protect the financial soundness of clubs and/or 
• Preventing or detecting unlawful acts 
• For legal claims 

IFR has an appropriate policy document to safeguard Special Category Data and Criminal Offence Data.  

Law enforcement processing 

21. As part of our statutory functions, we have powers to prevent, detect and investigate individuals and organisations for criminal offences committed under the Act.  Where we process personal data for the primary purpose of law enforcement processing, the UK GDPR does not apply.  Any processing will be carried out under Part 3 Data Protection Act 2018. 

How long we retain your personal data 

22. The IFR will retain your personal data in line with the requirements of data protection legislation, the obligations on the IFR under the Act, and other relevant legislative requirements, considering factors such as the content and sensitivity of the data, the purposes for which the data is processed, and any business requirements. We will securely dispose of such data when it is no longer necessary to retain it. 

Information we obtain from other sources 

23. In most cases, IFR will collect personal data directly from the data subject.  However, in certain instances, it may collect personal data from third parties.  The categories of third parties from whom IFR may obtain personal data include (but is not limited to): 

• Competition owners 
• The Football Association (FA) 
• Football clubs 
• Persons submitting information to the IFR’s enquiries team 
• Other statutory bodies such as HMRC, the Financial Conduct Authority, the National Crime Agency, the Serious Fraud Office and the Sports Grounds Safety Authority. 

Who we share your personal data with  

24.  The IFR does not anticipate typically sharing personal data with third parties.  In some cases, it may be necessary to share personal data with third parties.  This may be done:  

• Where it is necessary for the exercise of our statutory functions e.g. to undertake suitability assessments and verify information provided to us 
• Where we are legally obliged to share personal data as a public authority or otherwise required by law 
• Where we use data processors and they carry out services for us.  We have contracts in place with our data processors.  This means that they cannot do anything with personal data unless we have instructed them to do it.  They will not share your personal information with anyone apart from us.  They will hold the data securely and retain it for the period we instruct unless they are permitted to retain it by law. 
• Where disclosure is necessary under Section 86 of the Act to HMRC, Secretary of State, Welsh Ministers, Financial Conduct Authority, National Crime Agency, Serious Fraud Office or the Sports Grounds Safety Authority for the purpose of facilitating the exercise of that organisation’s function. 
• Where disclosure is necessary under Section 86(3) of the Act to Football Association, Football Association Premier League Limited, Football Association of Wales Limited, Football Conference Limited, Football League Limited or Women’s Professional Leagues Limited for the purpose of facilitating the exercise of that organisation’s function. 

Information shared with above organisations may not be used by the organisation for any other purpose or further disclosed unless permitted by law or court order. 

• The police or other law enforcement agency to investigate and detect crime  
• The courts (in connection with court proceedings) 
• Another third party where we satisfy ourselves that we have a lawful basis to share personal information  

What happens where the provision of information to the IFR is a statutory requirement 

25. In connection with the IFR’s functions, it has statutory powers to compel individuals, clubs and other persons to provide the IFR with specified documents and information that is relevant to its functions.  The IFR will make clear when it is requesting information using its formal powers to gather information. 

When we record calls or meetings 

26. We may process personal data to create records of meetings, events or calls.  You will be notified in advance or at the beginning of any meeting if recording or transcription is in progress and, where applicable, you will have the option to opt out of being recorded.  For call recording and transcription, we use Microsoft Teams and other IFR approved applications. 

Requesting service adjustments  

27. As a public authority, we have a legal duty to comply with the Equality Act 2010.  This means that we need to make reasonable service adjustments for anyone with a disability who contacts us in any capacity, and to eliminate any barriers to accessing our services.  Our lawful basis for processing this information is Article 6(1)(c) of the UK GDPR as we have a legal obligation to provide this.  Our processing of special category data, such as health information that you give us, will be based on Article 9(2)(a), which means we need your consent.  We will create a record of your adjustment requirements.  This will include your name, contact details and type of adjustment required along with a brief description of why it is required.  Relevant staff can access this to ensure that they are communicating with you in the required way. 

Security 

28. We have put in place appropriate technical and organisational measures to protect the security of your information.  We treat the security of your data very seriously. We have strict security standards, and all our staff who process personal data on our behalf receive regular training about how to keep information safe.  Where we use data processors, we have agreements in place to ensure that they keep our information safe and secure. 
29. We have put in place procedures to deal with any suspected data security breach and will notify you and the regulator of a suspected breach where we are legally required to do so. 

Changes to our Privacy policy 

30. We keep our privacy notices under regular review. If there are changes, we will update this page to tell you, for example, about any new uses of personal data. 

Your Data Protection rights 

31. You have certain rights in relation to your personal data such as the right of access and right of rectification.    You can contact us using the details below (see “IFR Contact Details”) if you would like to exercise any of these rights.   

• Your right of access – you have the right to ask us for copies of your personal information.  This right always applies.  There are some exemptions which may mean that you do not always receive all the information that we process. 
• Your right of rectification – you have the right to ask us to rectify information you think is inaccurate.  You also have the right to ask us to complete information you think is incomplete.  This right always applies. 
• Your right to erasure and withdraw consent – you have the right to ask us to erase your personal information in certain circumstances.  Where the IFR is relying on consent for the purposes of data processing, that person can withdraw their consent for the processing of their personal data at any time.  
• Your right to restriction of processing – you have the right to ask us to restrict processing of your personal information in certain circumstances. 
• Your right to object to processing – you have the right to object to processing in certain circumstances.  This right is available where we process your personal information and rely upon the public task lawful basis or where processing is for our legitimate interests.  Whether this right is available will depend upon the purpose of processing. 

32. Withdrawing your consent will not affect the lawfulness of any processing carried out the by the IFR before the withdrawal of consent (or any processing the IFR carries out relying on a lawful basis other than consent). 
33. For further details of data subject rights, please see the guidance issued by the Information Commissioner’s Officer (ICO). 

How to make a complaint 

34. To complain about how the IFR has handled your personal data, you can write to our data protection officer using the contact details set out below in the ‘Contact Us’ section.  We will acknowledge your complaint within 30 days.  If your complaint is complex or unclear, we may request clarification.  Complex cases may require more time, and we will inform you of any delays.  If you remain dissatisfied with our response, you have the right to lodge a complaint with the ICO.  The details for the ICO are set out below.   

Contact Us  

The contact details for the data controller are: 

The Independent Football Regulator (IFR) 

4th Floor 

One New Bailey 

New Bailey Street 

Salford, 

Manchester 

M3 5AY  

Email: dataprotectionofficer@footballregulator.org.uk 

The Data Protection Officer provides independent advice and monitoring of IFR’s use of personal information. 

35. If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:  

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 
 
0303 123 1113 
casework@ico.org.uk  

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

Version History