The FA Group Privacy Policy
Welcome to The Football Association (“The FA”, “us” or “we”) privacy policy.
Key Updates to Our Privacy Policy – 5 March 2026
We updated our Privacy Policy on 5 March 2026 to provide clearer information about how we handle personal data. The main updates are:
• More transparency about third-party data – We’ve added more detail on when we may receive personal data from third parties and the types of organisations involved.
• Clearer explanations of how we use personal data – We’ve expanded some sections to explain how data may be used in specific situations, such as CCTV use or disciplinary processes.
• New section on marketing and social media advertising (opt-ins only) – We’ve added information about how personal data may be used for marketing and social media advertising, where individuals have chosen to opt-in.
--------------------------------------------------------------------------------------------------------------------------------------
OVERVIEW
This policy will inform you about how The FA collects and uses your personal data.
It applies to personal data provided to us, both by you and by third parties and supplements any other privacy policies provided by The FA which may apply.
ABOUT US
The Football Association Limited (a company with registered office address at Wembley Stadium, Wembley, London, HA9 0WS and incorporated under company number 00077797) is a “Controller” of your personal data, which makes us legally responsible for the personal data we collect and hold about you.
As a Controller, it’s our responsibility to tell you about the different ways we use your personal data and how we will protect it. For example, what information we collect (and our legal basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it. We also need to tell you about your rights in relation to your personal data. This policy should be read in conjunction with any other privacy notices you are given from time-to-time by The FA relevant to any specific data collection.
The terms “personal data” or “personal information” are used to describe any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you in order to communicate with you, or to provide you with services or information. We may also collect data about you as part of your role in football. Depending on the nature your relationship with us, this may include:
CATEGORY OF DATA | TYPE OF DATA |
| Identity Data | such as your first and last name, data of birth and gender; |
| Contact Data | such as your billing address, delivery address, email address and telephone number(s); |
| Profile Data | such as your FAN number and password, purchases or orders made by you, your interests, marketing preferences, feedback and survey responses; |
| Image Data | such as a photograph or video you are featured in; |
| Financial Data | such as your bank account and payment card details; |
| Football Data | such as your football club, your role within a club and performance data; |
| Discipline Data | such as intelligence or evidence gathered about integrity or disciplinary matters, internal records of decisions and written reasons in respect of disciplinary matters; |
| Health Data | such as medical conditions, injuries, allergies and medical records; |
| Safeguarding Data | such as completion of mandatory or recommended checks or training, including DBS checks and any safeguarding investigations that may have been conducted; |
| Education Data | such as your coaching/refereeing qualifications and courses you have taken; |
| ED&I Data | such as your ethnicity, your religion and your sexual orientation (we call this equality, diversity and inclusion data); and/ or |
| Technical Data | such as your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and information about how you use our website, products and services. |
In the event that you choose to provide us with unsolicited personal data, this personal data will be handled with the same care as any other personal data we process and in accordance with data protection legislation as laid out in this notice.
We will also collect personal information about website usage through cookies in accordance with our Cookie Policy.
We will only use your personal data to the extent which is permitted by law. The drop-downs below show some examples of how might use your personal data, and how we have a lawful basis for those uses. We may also receive data from third parties to support us in any of these activities, with specific examples included below.
- Participant in Grassroots Football
- Participant in Professional Football
- Research and Survey Participants
We might have to share your personal data with the parties set out below for some of the purposes outlined in the section above:
• Online payments: if you decide to make online payments to The FA, some information will be disclosed to The FA’s service provider for validation purposes.
• External third-party service providers: there may be times when external organisations use your personal information as part of providing a service to us or as part of checking the quality of our service, such as our auditors
• Sponsors: we may share personal data with our sponsors, for promotional purposes, or to administer a particular campaign or project with a partner
• Football bodies: we may share personal data with other governing bodies (such as FIFA or UEFA), County FAs, clubs and/or leagues where necessary for any of the purposes set out above
• Sporting bodies, gambling operators and regulators: we may share personal data with these bodies to uphold our rules and regulations, their rules and regulations, and for safeguarding purposes. This could include UKAD, the Gambling Commission, governing bodies in other sports
• Law enforcement or other government and regulatory agencies: we may share personal data where required by law or on the request of the police or another relevant authority in circumstances where we consider it necessary to share the information (e.g. to assist a criminal investigation or where you or someone else is at risk of harm).
We may also receive requests from third parties requesting the disclosure of personal data. We will only fulfil such requests where we are permitted to do so in accordance with applicable law or regulation.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes (unless you have provided your consent) – we only permit them to process your personal data for specified purposes and in accordance with our instructions.
Occasionally we may transfer personal data outside the UK where necessary to provide you with a service or to fulfil one of our functions. Whenever we do this, we will ensure that the transfer is compliant with UK data protection laws and that your personal data is treated securely and transferred via a legally approved mechanism. In the case of transfers to UEFA and FIFA, personal data is transferred to a country considered to adequately protect personal data under a UK adequacy decision.
A copy of the relevant transfer mechanism can be provided for your review on request by contacting us using the details set out below.
We take the protection of your privacy extremely seriously and do our utmost to ensure that our security systems are able to protect your personal data. Data protection laws require us to ensure that we have effective security procedures in place regarding the storage and disclosure of personal data to guard against unauthorised loss or access.
Your data is protected by industry-standard security and procedures to protect it from unauthorised misuse and loss. We have an established set of protocols to respond to suspected personal data breaches and will notify you and the Information Commissioner’s Office (or any other applicable regulator) of a breach where we are legally required to do so.
We will only retain your personal data for as long as it is necessary for the purpose we collected it for, or where we’re required to keep it for any legal, accounting or reporting requirements. We retain your personal data as follows:
CATEGORY | DURATION |
General policy | As long as you are an active user of our sites and for 5 seasons after this. For recorded calls, we hold this for six months from the date of the call, unless we extract information from calls to provide evidence in relation to any membership disputes or complaints in which case this is held for 5 years from the date it is extracted. We hold information relating to visitors to our venues for one (1) month. |
Participant Data | Disciplinary information (including referee reports) reviewed every 7 years to consider justification for continued retention. Data relating to serious cases, or where you have a continued role in football, may be held indefinitely to ensure this data is retained should you return to football. Decisions taken on charges and cases for 5 full seasons following the decision, unless any ban or suspension imposed is longer than this period. Information related to anti-doping matters reviewed every 7 years to consider justification for continued retention. Information relating to a negative test will be retained for 11 seasons (beginning with the season after the season in which the negative test occurs). Information, statistics images and footage of matches will be retained indefinitely to keep a record of the match. |
Intermediary Data | The FA retains all information relating to intermediaries for as long as you remain registered as an intermediary. The FA will also retain information after your registration lapses or is rejected for a minimum of 5 full seasons, or in accordance with the retention period for the reason of rejection (e.g. safeguarding retention periods apply to removal for safeguarding reasons). |
Image Data | 4 years from the date of the image, or longer as indicated. For CCTV footage, we hold this for one (1) month, unless we have been asked to extract footage, in which case this is held for 10 years from the date it is extracted. Footage and images captured during an FA competition, such as The FA Cup), maybe retained indefinitely for historical records of the match. |
Safeguarding Data | In accordance with NSPCC guidelines, as there is no normal retirement age to be involved in football, safeguarding concerns are retained indefinitely. |
Education Data | As long as you are enrolled on a course and for 7 years after this. Details of qualifications gained are retained indefinitely. |
Match Official Data | Information relating to inactive officials (i.e. not registered for 2 seasons) will be removed after 5 seasons. Information about a match official's appointments, fitness tests and performance during appointments will be held for a minimum of 7 seasons. Information about discipline you have administered, and the fact of your appointment, may be held indefinitely in order to maintain a record of the game. |
Research | 3 years from the date we end the relevant survey. |
Where your data is held on FA systems, then at the end of the retention periods set out above, we will not irrevocably delete your information for another 3 months – your data will be held in an inactive form for this time to ensure that any consequential links across our systems remain intact in the event that your data is removed in a particular location.
Under certain circumstances, you may have the following rights in relation to your personal data:
Right | What does this mean? |
| 1 | A right to access the personal data we hold about you (known as a "data subject access request"). |
| 2 | A right to request that we rectify any inaccurate personal data we hold about you. This right is qualified and we will need to verify the accuracy of any new data you provide. |
| 3 | A right to request that we erase personal data we hold about you where we no longer need to process it. This right will only apply where, for example, we no longer need the personal data we collected; or where we collected data based on your consent and you withdraw that consent. Please note: we may not be able to comply with your request for legal reasons. Where these apply, we will explain them to you when we respond to your request. |
| 4 | A right to restrict processing of personal data we hold about you. This right allows you to limit the way that we use your data and is an alternative to requesting the erasure of your data. You have the right to restrict the processing of your personal data for a particular reason. This may be where you have issues with the content of the information we hold or how we have processed your data. In most cases we will not be required to restrict our processing of your personal data indefinitely, but will need to have the restriction in place for a certain period of time. If there are legal reasons that mean we can’t comply, we will explain them to you when we respond to your request. |
| 5 | A right to receive personal data you have provided to us, in a structured, commonly used and machine readable format. You can also require us to transfer this personal data to another organisation. |
| 6 | A right to object to our processing of personal data we hold, which applies when we use your data for marketing, or where we are relying on a legitimate interest (or those of a third party), and you object as you feel it impacts on your rights and freedoms. In some cases, we may demonstrate that we have legitimate grounds to continue processing your data which override your rights and freedoms. |
| 7 | A right to withdraw your consent, where we are relying on it to use your personal data. We will advise you if withdrawal of consent means that we are unable to provide certain services to you. |
| 8 | A right to ask us not to make automated decisions about you. |
If you wish to make a request, you can do so via our online form, which can be found here. If you have any questions or queries about how we process your data, you can get in touch at [email protected] or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.
You also have the right to lodge a complaint with the UK Information Commissioner's Office and details can be found here. The ICO recommend that you should first discuss any concerns with the organisation before going to them, so please do contact us in the first instance to see if we can help to put things right.
WHAT OTHER FA GROUP PRIVACY POLICIES ARE IN PLACE?
Full-Time | |
England Online Store | |
Matchday | |
Platform For Football | |
HR Privacy Policy | |
Recruitment policy | |
Referee body camera trial privacy policy | |
Children's Privacy Policy |
Last updated: 5 March 2026