[Authors: Sarvottma Sanghmitra, Student at National Law University, Delhi and Junior Editor at SLRI; Ananya Joshi, Student at Government Law College, Mumbai]
The modern sporting world is increasingly being driven by data. There has been considerable debate surrounding the collection and processing of athlete data across jurisdictions. Most notably, Project Red Card in the UK has brought the issue of the use and processing of athlete data to the forefront, with many footballers challenging the manner in which their personal data is utilised by gaming, betting and sports data companies.
Athlete data encompasses a wide range of information, including health data, performance data and statistics. Such data is used by clubs, private academies, and companies for a variety of purposes. In India, as early as the trial or application stage, private football academies including RFC Football Academy in Bengaluru, State Football Academy in Jammu and Kashmir and others, require applicants to disclose information relating to food allergies, pre-existing medical conditions, prior injuries, and in some instances even congenital deformities.
This raises an important question regarding the legal basis for collection of such data at a stage when no contractual relationship has yet been established. Under the Sensitive Personal Data or Information Rules, 2011 (“SDPI Rules”) information relating to athlete’s health condition and medical records would have fallen under the category of ‘sensitive personal data or information’. However, the Digital Personal Data Protection Act, 2023 (“DPDP Act”), which is expected to become fully operational from May 2027, does not categorise personal data in separate buckets such as sensitive personal data and instead regulates such data through its general framework governing personal data.
Against this backdrop, this piece examines the course that private academies would have to follow in terms of compliance with the DPDP Act, specifically in relation to the legal bases for the collection of athletes’ personal data at the application and trial stage in line with the grounds for processing recognised under Section 4 of the DPDP Act, and analyses how existing processes might need changes in light of the DPDP Act.
Legal Basis for Processing Athlete Data
Section 2(x) of the DPDP Act defines ‘processing’ as “includes operations such as collection, recording, organisation, structuring, storage, adaptation…”. Consequently, when private academies require athletes to disclose information relating to allergies, injuries and other aspects of their health, such collection falls within the scope of DPDP Act and must be justified under one of lawful grounds recognised by the DPDP Act. The DPDP Act broadly identifies two grounds basis which personal data of a data principal may be processed by a data fiduciary, viz. for which a data principal gives her consent and for legitimate uses. Each of the two may be relied upon by private academies in relation to processing of athlete personal data at the trial stage, and each carries its own nuances which are discussed below.
A. Through Consent
The consent framework envisaged under the DPDP Act requires data fiduciaries to present to data principals two documents, i.e., a request for consent and an itemised notice, which may either accompany a consent request or precede it. The itemised notice presented to Data Principals is for detailing the purpose for collection and processing of any data, informing data principals of the manner in which they may exercise their rights and the manner of making a complaint to the Data Protection Board (“DPB”). The consent request serves the purpose of obtaining consent from data principals through a clear affirmative action, in a manner that such consent is “free, specific, informed, unconditional and unambiguous”.
The DPDP Act also seeks to limit the collection of such personal data to what is necessary for the specified purpose (both of which form key tenets of globally recognised data protection principles and are discussed in further detail in the latter portions of this piece). The significance of such a requirement is that private academies cannot be allowed to collect data beyond what is necessary for the purpose of conducting the trials or for other clearly identified purposes connected with the application process. Thus, given that the notice should include the ‘specified purpose’, which would be conducting trials in this case, the health data and other information collected by the academies should be processed for the limited purpose of processing applications and conducting the trials safely.
Section 5 mandates that the consent must be informed. If the academy application forms merely require details regarding allergies or medical conditions without clearly explaining why such information is sought and how it will be used, it becomes difficult to justify that the athlete has made an informed choice. Where processing of athletes personal data is based on consent, it is crucial that athletes are sufficiently informed about the purpose of processing and their rights – this makes presenting an itemised notice along with a consent request a crucial compliance.
Similarly, where personal data beyond what is necessary for the specified purpose of processing applications and conducting trials (for example, requiring athletes to share government identifiers, family details, etc.) is collected, the consent collected would only be limited to processing of personal data for the specified purpose and anything beyond that would constitute a breach of the DPDP Act.
Finally, seeking consent through fine print in privacy policies or trial terms and conditions would not amount to consent obtained through a ‘clear affirmative action’ and the application forms would accordingly have to be accompanied by an itemised notice and consent request, with requisite information as prescribed under the law.
Therefore, the challenge for the private academies is that while the collection of certain categories of health information may be justified in the context of conducting trials, they would have to review and revise existing processes and the manner in which the information is presently sought, including the documentation presented to athletes, to reconcile the same with the safeguards under the DPDP Act.
B. ‘Legitimate Uses’
Other than the question of consent, the collection of athlete data by private academies may still be justified under the ground of ‘certain legitimate uses’, which would not require private academies to present itemised notices and consent requests to athletes in relation to collection and processing of their data at the trial stage. Unlike EU’s GDPR, Section 7 provides a ‘closed list’ of specific legitimate uses for which the data can be processed without obtaining consent of the Data Principal. This section therefore examines the two uses that are most likely to be invoked by private academies in relation to collection of athlete data at the application stage, namely the voluntary disclosure by the Data Principal for a specific purpose under Section 7(a) and for employment purposes under Section 7(i).
(i) Voluntary Disclosure
Section 7(a) permits processing of personal data when a Data Principal voluntarily provides personal data for a specific purpose and does not object to such processing. Where young athletes disclose health-related information while applying for academy trials, private academies might take the view that they have voluntarily provided their data for the specific purpose of participating in the trials.
The illustrations provided under the DPDP Act in this regard provide some clarity on the intention behind this provision. They indicate that if personal date has been voluntarily provided for a specific purpose, then the authority to process such data does not continue indefinitely but subsists only so long as that purpose remains. In the absence of any jurisprudence around instances where this ground can be invoked, one may view this as a ‘data push’ exemption, where no personal data is sought by a Data Fiduciary yet the Data Principal shares such data of its own volition, as against a ‘ data pull’ where Data Fiduciaries require specific data sets to be shared by Data Principals, where such data sets are determined by the Data Fiduciary.
For processing applications and conducting trials, private academies seek specific data sets, such as health data, from athletes that help them conduct trials efficiently and safely. This is in the nature of a ‘data pull’ and is unlikely to be justified under the ‘voluntary processing’ legitimate use under the DPDP Act.
(ii) Employment Purposes
Section 7(i) permits processing “for the purposes of employment…”. Since the DPDP Act has not defined the term, commentators have suggested that its scope may extend beyond the traditional employer-employee relationship. Given the expansive language, it is possible that “employment purposes” encompasses activities undertaken at the recruitment stage. For private academies, the process of conducting trials helps academies narrow down athletes and recruit them, and may therefore be characterized as an employment purpose, potentially bringing the collection of athlete data within the ambit of Section 7(i). Given the lack of jurisprudence in this regard, it also remains to be seen the extent to which such compliance requirements would apply in case of consultants, contract workers, etc. who are not employees in the traditional sense – the same arguments could be made about athletes being engaged by academies.
However, the wide nature of “employment purposes” has already attracted criticism as violating employees’ privacy. In this regard, employers should be cautious in ensuring that even where processing is justified under Section 7(i), any processing of employee data should be within the four corners of the DPDP Act, specifically data minimisation and purpose limitation.
Accordingly, even if the private academies are able to establish that conducting trials fall within the scope of “employment purposes”, they must still demonstrate that the athlete data being collected is genuinely necessary for their purpose and processing is limited to such purpose.
Guiding Principles Governing Data Processing
The common thread emerging from examining the possible legal bases for collection of athlete data, is that there are certain overarching principles that must guide all processing activities. The DPDP Act rests on seven core principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. The sporting world should ensure compliance with all. In particular, private academies should ensure that the collection of athletes’ personal data at the trial stage is compliant with principles such as purpose limitation and data minimisation.
The global understanding of purpose limitation is consistent as it directs that the processing of personal data should only be undertaken for the specified purpose and that it cannot be later used for a different, incompatible purpose. Similarly, data minimisation ensures that only information which is relevant and necessary for the specified purpose is collected. In this regard, the necessity test helps in determining the scope of permissible data collection. According to the test, the data collection must be genuinely necessary for the specific purpose for which the data has been processed, and not merely convenient or beneficial.
To take an example, consider an athlete applying for trials at a private football academy. The online application form requires disclosure of past injuries, allergies as well as details of family members. If the purpose for collection is conducting the trials safely, information regarding injuries and allergies might be necessary. However, the necessity of details of family members might be questionable. Even if these details might be necessary for post selection, such as for providing family insurance coverage, these need not be relevant at the application stage unless academies are able to demonstrate that this information is ‘necessary’ to be collected for the purposes of selecting athletes through trials.
Considering that DPDP Act has been framed with guidance from global data-protection frameworks such as EU’s GDPR, it is important to understand how the principle of necessity is understood in other jurisdictions. Described as the data minimisation principle, Article 5(1)(c) of the GDPR requires personal data to be “adequate, relevant and limited to what is necessary”.
In the case of Meta v. Bundeskartellamt which was related to Meta’s practice of combining personal data collected from Facebook with information obtained from its other services and third-party websites, the CJEU held that processing is “necessary” only when it is “objectively indispensable for a purpose that is integral to the contractual service” (para 98). The Court rejected the idea that data is necessary merely because it may be useful or convenient. It drew a sharp distinction so that processing cannot automatically expand to every piece of information that may be useful.
India seems to be moving in a similar direction. In K.S. Puttaswamy v Union of India, the Supreme Court recognised informational privacy as a constitutional right and held that any corresponding intrusion into the same must satisfy the requirements of proportionality and necessity. If this logic is adopted in interpreting the DPDP Act with respect to the necessity test, then it would be a difficult case for the private academies to differentiate between the category of personal data which is absolutely needed and what would just be merely considered useful. For the purposes of conducting trials and selecting athletes, certain categories of health information, such as existing injuries, chronic medical conditions or severe allergies, may have a direct relationship with athlete safety and participation. However, it is less clear on how ‘necessary’ it would be to collect data on family members or demographic data. If every piece of potentially useful information is treated as necessary, the distinction between necessity and usefulness becomes difficult to maintain. The problem would, thus, arise in identifying the point at which collection exceeds what is necessary for the stated purpose.
Conclusion
The forthcoming implementation of the DPDP Act is likely to bring attention to the protection of athlete data in general, especially where such personal data includes health data. While private academies may attempt to justify the data collection at the application or trial stage on the grounds of ‘consent’ or ‘certain legitimate uses’, neither basis would justify the concerns in existing practices.
The boundaries of collection remain unclear in sports as the data is often collected for ensuring athlete safety and training. The manner in which the DPDP Act ultimately addresses this tension between athlete welfare and protection against excessive data collection will depend upon how its provisions are interpreted and applied once the framework becomes operational. In that sense, the issue is not merely whether athlete health data can be collected, but how far the law permits such collection to extend in the name of safety, selection and performance management. This piece demonstrates that difficulties remain regarding the validity of consent and when the collection exceeds the limits of the stated purpose and highlights the need for academies to stop, assess and revise existing data practices to conform to the DPDP Act.
*DISCLAIMER- The opinions and views expressed in this article are that of the Author(s) and not of SLRI- the expressed opinions do not, in any way whatsoever, reflect the views of any third party, including any institution/organisation that the Author(s) is/are currently associated to or was/were associated to in the past. Furthermore, the expressions are solely for informational and educational purposes, and must not be deemed to constitute any kind of advice. The hyperlinks in this blog might take you to webpages operated by third parties- SLRI does not guarantee or endorse the accuracy or reliability of any information, data, opinions, advice, statements, etc. on these webpages.
PREFERRED CITATION: Sarvottma Sanghmitra, Ananya Joshi, “Before the Starting Line: The Protection of Athlete Data under the DPDP Act” Sports Law Review India, published on 31 July 2026.
LET'S TALK SPORTS LAW 
Leave a comment