Privacy policy
IFR Privacy Notice
1. This privacy notice explains how the IFR collects, uses, and shares information about you (‘personal data’) when carrying out its statutory functions as a public authority and running the organisation.
2. In its interactions with clubs, owners, officers, senior managers, competition organisers and other persons, the IFR may receive personal data for the purposes of fulfilling its statutory functions. The IFR recognises the importance of protecting this personal data and is committed to complying with its data protection obligations whilst delivering its work as a public authority.
3. As the IFR continues to develop its processes and consider the use of new technologies to enhance the way it works, it may be necessary to modify this notice. The IFR will keep this notice under review and update it as appropriate. The date of this document is December 2025.
What the IFR does and why it processes personal data
4. The IFR is an independent statutory regulator focused on the top five tiers of English men’s football, created by the Football Governance Act 2025 (the Act). The IFR’s core objectives are to protect and promote the financial soundness of regulated clubs, to protect and promote the financial resilience of English football and to safeguard the heritage of English football.
5. In order to meet its objectives, the Act provides the IFR with a number of functions and powers. For these purposes, and to run the organisation, the IFR will need to collect, use, and share information about individuals. Information about individuals is called ‘personal data’, as defined in the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018). Personal data is information about living individuals who can be identified from it. It is not information about organisations or companies. It includes voice recordings, photographs, CCTV images, and online identifiers.
6. Collecting, using, and sharing personal data is called ‘processing’. Anything at all that we do to, or with, personal data, including deleting it, or viewing it, is processing.
Why the IFR collects personal data and the purpose of processing
7. The IFR expects to receive personal data in the course of exercising its statutory functions and directly from individuals seeking to contact and provide information to the IFR. This will include (but is not limited to):
• As part of information received by the IFR by its statutory information gathering powers.
• As part of engagement with stakeholders for the purposes of gathering information for the State of the Game report, required to be published by the IFR under Section 10 of the Act.
• As part of its assessment of the suitability of individuals to be owners and officers of football clubs (under Part 4 of the Act).
• As part of the application process for football clubs to receive operating licences, and the IFR’s monitoring of clubs through the statutory licensing regime and clubs’ compliance with their licence conditions (under Part 3 of the Act).
• As part of clubs’ compliance with the duties placed them under Part 5 of the Act.
• As part of the IFR’s engagement with competition organisers.
• As part of information provided to the IFR through its correspondence function and through the submission of Freedom of Information Act requests submitted to the IFR.
• As part of the IFR’s ongoing engagement with stakeholders, including through its consultations.
• As part of sharing information with and receiving information from other relevant statutory bodies, competition organisers and others under information sharing gateways in the Act or other legislation.
• For other purposes which are ancillary to the IFR’s exercise of its statutory functions under the Act.
The IFR’s lawful basis for processing personal data
8. This section sets out the purposes for which we collect and use your personal data, what types of information we process, and our lawful basis for doing so.
Purpose 1: Exercising the IFR’s statutory functions
The IFR’s statutory functions are set out in the Act. The IFR’s responsibilities as a public authority include the following:
• Producing a State of the Game report on the on the state of English football so far as relevant to the exercise of the IFR’s functions.
• Producing and publishing guidance and rules relevant to the exercise of the IFR’s functions.
• Overseeing a statutory licensing regime for all regulated clubs, through which the IFR will gather information from clubs in compliance with their mandatory licence conditions in Schedule 5 of the Act, and for the IFR to monitor clubs’ compliance with the Threshold Requirements in Schedule 4 of the Act.
• Assessing the suitability of prospective and incumbent owners and officers of regulated clubs (by reference to the statutory tests set out in Part 4 of the Act).
• Monitoring the compliance of leagues and clubs with their duties under Part 5 of the Act.
• Using its powers of investigation, enforcement and sanctions to ensure the effectiveness of the regime.
The IFR may collect and process personal data for the purposes of carrying out each of these functions.
Purpose 2: Supporting the delivery of the IFR’s statutory functions through ancillary activities
Schedule 2 of the Act provides that the IFR may do anything which it considers will facilitate, or is incidental or conducive to, the carrying out of its functions under this Act.
The IFR has only recently been established and, as of this date, few of the IFR’s functions and powers have commenced. The IFR’s understanding of what incidental activities might facilitate the carrying out of its functions under the Act will develop over time. As part of these activities, the IFR might collect and process personal data.
Purpose 3: Activities carried out by the IFR to run and operate its organisation
For the purposes of managing its operations and running the organisation, the IFR will need to undertake various activities which could require the collection and processing of personal data. These activities include (but may not be limited to):
• Engaging and managing relationships with the IFR’s service providers (which may include tenders, negotiation and agreement of contracts, contract and relationship management, the payment of invoices and general correspondence with external parties related to the IFR’s organisation and operations).
• Maintaining the security of the IFR’s systems and premises (which might include monitoring access to, and activity in, our buildings to ensure the security of our premises - including through the use of CCTV).
• Receipt of and responding to enquiries, requests, and communications we receive from stakeholders. This includes general enquiries as well as requests under statutory frameworks (such as data subject rights requests and requests under the Freedom of Information Act).
• Hosting and facilitating meetings and events.
• Enabling clubs and others to sign up to receive communications from us about the IFR’s activities.
The types of personal data the IFR will process for the purposes described above
9. Depending on the activities we are undertaking, we may process the following categories of personal data when carrying out our statutory functions as a public authority and running our organisation.
Categories of personal data we process:
• identity and contact details including email address, telephone number and home address
• sex
• age and/or date of birth
• Sound recordings and visual images
• Financial details
• Intelligence material
• Complaint, incident and accident details
• Employment details
• Online identifiers such as IP addresses
• case-specific and evidence data
The personal data we collect and use will include personal data and special category personal data. Special category personal data (also referred to as sensitive processing) may include personal data revealing:
• Racial or ethnic origin
• Political opinions
• Religious, cultural or philosophical beliefs
• Trade union membership
• Physical or mental health
• Sexual orientation
• Genetic or biometric data
• Criminal conviction and/or involvement in criminal proceedings
The IFR will only use the minimum amount of relevant personal information it considers to be necessary to carry out a particular activity.
The IFR’s lawful basis for processing personal data for these purposes
10. The lawful basis for the processing of personal data by the IFR will usually be one or more of the following:
• the processing is necessary for the performance of a task carried out in the public interest by the IFR, or in the exercise of official authority vested in the IFR (Article 6(1)(e) UK GDPR);
• the processing is necessary for compliance with a legal obligation to which the IFR is subject (Article 6(1)(c) UK GDPR);
• the data subject has given consent to the IFR’s processing of the personal data for one or more specific purposes (Article 6(1)(a) UK GDPR); and/or
• the processing is necessary for the purposes of a recognised legitimate interest (Article 6(1) (ea) UK GDPR) or is necessary for the purposes of other legitimate interests pursued by the IFR (Article 6(1)(f) UK GDPR).
11. If the IFR needs to process your personal data for a new purpose, it may do so as per Article 6(4) UK GDPR in circumstances where it relies on a domestic law which constitutes a necessary and proportionate measure to safeguard one of the objectives referred to in Article 23(1).
12. We may process special category for the purposes of fulfilling our functions under the Act. Where we process special category data under Article 9 UK GDPR, we do so only where one of the following conditions applies:
• the processing is necessary for reasons of substantial public interest, including:
o fulfilling our statutory functions – for example, where we collect (or disclose) information, gather intelligence, and carry out enforcement activity during our work to ensure the suitability of owners of regulated clubs and to protect the financial soundness of clubs; and/or
o preventing or detecting unlawful acts,
• processing is necessary for the purposes of legal claims;
How long we retain your personal data
13. The IFR will retain your personal data in line with the requirements of data protection legislation, the obligations on the IFR under the Act, and other relevant legislative requirements, taking into account factors such as the content and sensitivity of the data, the purposes for which the data is processed, and any business requirements. We will securely dispose of your data when it is no longer necessary to retain it.
Information we obtain from other sources
14. Sometimes the IFR will collect personal data directly from the data subject. However, in certain instances it might collect this from third parties. The categories of third parties from which the IFR may obtain personal data include (but may not be limited to):
• competition owners
• the FA
• football clubs
• persons submitting information to the IFR’s enquiries team
• other statutory bodies such as HMRC, the Financial Conduct Authority, the National Crime Agency, the Serious Fraud Office and the Sports Grounds Safety Authority.
Who we share your personal data with
15. The IFR does not anticipate typically sharing personal data with third parties. However, the IFR may share your personal data with third parties or statutory bodies such as HMRC, the Financial Conduct Authority, the National Crime Agency, the Serious Fraud Office the Sports Grounds Safety Authority or other national or international agencies. This might be done where:
• it is necessary to do so in the exercise of our statutory functions;
• it is legally obliged to do so as a public authority or otherwise by law; or
• those organisations provide us with services that help us to operate our organisation.
The IFR will only share personal data to the extent it deems it necessary for these purposes and will share no more than it deems necessary.
What happens where your provision of information is a statutory requirement
16. In connection with the IFR’s functions, it has statutory powers to compel individuals, clubs and other persons to provide the IFR with specified documents and information that is relevant to our functions. The IFR will make clear when it is requesting information using its formal powers to gather information.
Your data protection rights
17. You have certain rights in relation to your personal data under applicable data protection laws as set out below. You can contact us using the details below (see “IFR Contact Details”) if you would like to request to exercise any of these rights.
• Your right of access: You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
• Your right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
• Your right to erasure and withdraw consent: You have the right to ask us to erase your personal information in certain circumstances. Where the IFR is relying on consent for the purposes of data processing, that person can withdraw their consent for the processing of their personal data at any time. The IFR’s contact details for this provided at the end of this policy.
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing: You have the right to object to processing if we are able to process your information because the process forms part of our public tasks or is in our legitimate interests.
• Your right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering a contract and the processing is automated.
18. Withdrawing your consent will not affect the lawfulness of any processing carried out by the IFR before the withdrawal (or any processing the IFR carries out on a lawful basis other than consent).
19. For details of the data subject rights, please see the guidance by the ICO.
When we record calls or meetings
20. We may process data to create records of meetings, events or calls. You will be notified in advance or at the beginning of any meeting if recording or transcription is in progress, and, where applicable, you will be provided with options to opt out of being recorded. For call recording and transcription, we use Microsoft Teams and other IFR approved applications.
Requesting Service adjustments
21. As a public authority, we have a legal duty to comply with the Equality Act (2010). This means we need to make reasonable service adjustments for anyone with a disability who contacts us in any capacity, to eliminate any barriers to accessing our services. Our lawful basis for processing this information is article 6(1)(c) of the UK GDPR as we have a legal obligation to provide this. Our processing of special category data, such as health information you give us, will be based on article 9(2)(a), which means we need your consent. We’ll create a record of your adjustment requirements. These will give your name, contact details and type of adjustment required, along with a brief description of why it is required. Relevant staff can access this to ensure they are communicating with you in the required way.
How to make a complaint
22. To complain about how the IFR has handled your personal data, write to us at: DPO Independent Football Regulator Bloc, 17 Marble St, Manchester, M2 3AW. We will acknowledge your complaint within 30 days. If your complaint is complex or unclear, we may request clarification. Complex cases may require more time, and we will inform you of any delays. If you are dissatisfied with our response, you have the right to lodge a complaint with the ICO. The ICO’s guidance is here.
IFR Contact Details
23. The IFR is the controller for the personal data we process, unless otherwise stated. You can contact the IFR at:
Independent Football Regulator
Bloc
17 Marble St
Manchester
M2 3AW
Email: correspondence@footballregulator.org.uk
Data Protection Officer
24. The IFR has appointed a Data Protection Officer. You can contact them at:
IFR Data Protection Officer
Bloc
17 Marble St
Manchester
M2 3AW
Email: dataprotectionofficer@footballregulator.org.uk