Activity data checklist for early-stage companies
A practical checklist for founders of start-ups that collect or receive sports and activity data. It covers the obligations that apply from the first user, and the practices that are easiest to adopt at an early stage. Each item explains how to do it, how long it typically takes and, where useful, provides a model text.
This checklist summarises obligations under European legislation and does not constitute legal advice. Effort estimates are indicative, for a small team with a single product. Model texts are examples and should be adapted to your service. This is a draft and will be revised following expert and member review.
Before you start: determine your role
Which rules apply depends on what your company does with activity data. A company can have more than one role.
- Every company
- The GDPR applies to every company that processes personal data of people in the European Union, regardless of its size or where it is established.
- Device makers
- A company that makes a connected device, or provides a service that controls one, may also be a data holder under the Data Act. See item 11.
- Receiving services
- A company that receives data from another platform at an athlete's request is a receiving service. The Data Act limits how it may use that data. See item 6.
- Companies outside the EU
- A company established outside the European Union that offers its service to athletes in the EU may need to appoint a representative in the EU (Article 27 GDPR).
What legislation requires from the first user
These obligations apply regardless of company size, unless stated otherwise.
-
Every use of personal data requires a legal basis. In the Alliance's reading, heart rate, heart rate variability and sleep data are health data, which additionally requires explicit consent.
How to do this
- List every purpose for which you use data: providing the core service, product analytics, marketing, model training, sharing with partners.
- Choose a legal basis for each purpose. Use the contract for what the athlete signed up for, and consent for optional extras.
- Where a purpose involves health data, also obtain explicit consent. The contract alone is not sufficient for health data.
- Record the result in your record of processing activities (item 8).
Example for a coaching application Purpose Legal basis Health data Show activities and statistics Contract Explicit consent Generate training plans Contract Explicit consent Product analytics Legitimate interests Exclude health data Newsletter Consent Not applicable Model training Consent Explicit consent (item 5) Common mistake: a single checkbox covering all purposes. Consent must be specific to each purpose.
Young athletes: where your service relies on consent and is offered to children under 16, consent must be given or authorised by a parent. Member States may lower this age to as low as 13.
-
Limit the data you collect to what is necessary for the purposes you have stated, and keep it no longer than necessary.
How to do this
- Review every data field and device permission you request, and remove those you do not use.
- When connecting to another platform's API, request only the scopes your service needs.
- Set a retention period for each category of data, for example deletion of inactive accounts after a defined period, and document it.
Common mistake: importing every available data type from a platform "in case it is useful later".
-
Your privacy notice must state, in clear and plain language, how and why you use data, at the time you collect it.
How to do this
Your privacy notice must include:
- your company's identity and contact details, and those of your data protection officer if you have one;
- each purpose and its legal basis, and the legitimate interests you rely on, if any;
- the recipients or categories of recipients, including suppliers;
- any transfers outside the European Economic Area, and the safeguards used;
- how long you keep each category of data;
- athletes' rights: access, rectification, erasure, restriction, objection and data portability;
- the right to withdraw consent at any time, and to lodge a complaint with a supervisory authority;
- whether providing data is required, and any automated decision-making, including profiling.
Tip: use a layered approach. Show a short explanation in the app at the moment data is collected, with a link to the full notice.
-
Respond to requests free of charge and within one month. Exports must be in a structured, commonly used and machine-readable format, and transmitted directly to another service where technically feasible.
How to do this
- Offer export and account deletion in the app's settings, so that most requests need no manual handling. Item 13 describes a suitable export.
- Provide an address for requests, and log each request with its date and outcome.
- Verify identity proportionately. A request from a logged-in account is normally sufficient.
- Where a request is complex, you may extend the deadline by up to two further months, provided you inform the athlete within the first month.
- Document how deleted data is removed from backups and from your suppliers' systems.
Common mistake: deleting the account but leaving the athlete's data in analytics tools, email platforms or support systems.
-
Training artificial intelligence models is a separate purpose from providing your service. For health data, it requires its own explicit consent, which athletes must be able to withdraw without losing access to the service.
How to do this
- Present model training as a separate, optional choice that is not selected by default.
- Record when and how each athlete consented, and which version of the text they saw.
- When consent is withdrawn, exclude the athlete's data from future training.
- Sending an athlete's data to an external AI service to generate insights for that same athlete is part of providing the service, not model training. The provider is then your supplier (item 7). Confirm in its terms that it does not use your data to train its own models.
Model text: consent to model training Help improve [Service] (optional)
We would like to use your activity data, including heart rate and sleep data, to train the models that generate training advice in [Service]. This data can reveal information about your health.
☐ I agree that [Company] may use my activity and health data to train its models.
Your choice does not affect your use of [Service]. You can change it at any time under Settings › Privacy.
-
Data received from another platform at an athlete's request may only be used for the purposes agreed with that athlete. It may only be passed on to others where the athlete has agreed to that.
How to do this
- For each connection, record the source platform, the date of authorisation, the scopes granted and the purposes agreed with the athlete.
- Do not pass received data to analytics, advertising or other partners unless the athlete has agreed to that specific recipient.
- When an athlete disconnects a platform, stop retrieving data and delete what is no longer needed (item 14).
- Note that the source platform's API terms may impose further restrictions. Item 15 explains how to keep track of them.
-
Providers that process data on your behalf require a data processing agreement. Transfers of personal data outside the European Economic Area require appropriate safeguards.
How to do this
- List every service that receives athletes' data: hosting, database, email, analytics, error tracking, customer support and AI services.
- For each, confirm that a data processing agreement is in place. Most large providers include a standard agreement in their terms, which you can accept or download.
- Note where each provider stores data. For transfers outside the European Economic Area, record the safeguard used: an adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or standard contractual clauses.
Common mistake: error tracking and session recording tools that capture heart rate, location or other health data without anyone noticing.
-
Companies with fewer than 250 employees are normally exempt from this obligation, but not when they process health data. Most activity data services therefore need a record.
How to do this
A spreadsheet is sufficient. Create one row per purpose, with these columns:
- purpose and legal basis (from item 1);
- categories of athletes and of data, marking health data;
- recipients and suppliers (from item 7), and any transfers outside the European Economic Area;
- retention period (from item 2);
- a general description of your security measures.
Tip: add a column marking each data type as raw, cleaned or derived. Item 12 builds on it.
-
An impact assessment is required before processing that is likely to result in a high risk to athletes. In the Alliance's reading, many activity data services meet that threshold, because they combine health data with location data or new technology.
How to do this
- Check the list of processing operations that require an assessment, published by the supervisory authority in your country.
- If an assessment is required, or you are unsure, describe the processing and its necessity, identify the risks to athletes, and record the measures you take to reduce them.
- Review the assessment when you add a new purpose, data type or supplier.
Tip: an assessment written at an early stage is short, and it is also useful when talking to investors and partners.
-
A personal data breach must be reported to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to athletes. Where the risk is high, athletes must also be informed directly. Every breach must be documented.
How to do this
Write a one-page plan that states:
- who decides whether a breach is reported, and who replaces them when they are unavailable;
- which supervisory authority is responsible for your company, and how to submit a notification;
- what a notification contains: the nature of the breach, the data and athletes concerned, the likely consequences and the measures taken;
- where you log breaches, including those you do not report.
-
Micro and small enterprises are exempt from the Data Act's obligations to give users access to device data. The exemption does not apply to an enterprise linked to a larger one, and medium-sized enterprises are exempt only for a limited transition period of one year.
How to do this
- Determine your size: a micro enterprise has fewer than 10 staff and an annual turnover or balance sheet of at most €2 million; a small enterprise has fewer than 50 staff and at most €10 million.
- Include partner and linked enterprises, such as a parent company or a significant investor, in the calculation.
- Record the outcome and the date. Review it when you raise investment, grow or are acquired.
Note: the exemption covers only the Data Act. The right to data portability under the GDPR (item 4) continues to apply.
What to adopt early
These practices go beyond the legal minimum. They are voluntary, and least costly to adopt before a product grows.
-
Store data as it was recorded, and document whether each type of data is raw, cleaned or derived. This makes exports, deletions and future obligations straightforward.
How to do this
- Store original files, such as uploaded FIT files, unchanged, separately from the data your service derives from them.
- When you filter or correct data, keep a short description of the method.
- Mark each data type in your record of processing activities as raw, cleaned or derived (item 8).
-
An export in widely supported formats takes less effort to build early than to handle requests manually later.
How to do this
A suitable export is a single archive containing:
- original activity files, such as FIT files, unchanged;
- activities in GPX or TCX for wide compatibility;
- daily data, such as sleep and resting heart rate, in CSV or JSON;
- account details and settings in JSON;
- a short text file describing the contents and any processing applied.
Tip: generate the archive in the background and send a download link that expires after a few days.
-
When an athlete disconnects a service or withdraws consent, stop processing and delete the data concerned, including copies held by your suppliers.
How to do this
- Revoke the access token with the source platform and stop all synchronisation.
- Handle deauthorisation notifications sent by the source platform in the same way as a disconnection in your own app.
- Delete received data within a defined period, and instruct suppliers holding copies to do the same.
- Test the complete flow before launch, and after each change to an integration.
-
Record which terms apply to each data source you connect to, and review them against Article 13 of the Data Act. Contractual terms on that list that were imposed unilaterally are not binding on your company.
How to do this
Record for each platform:
- the version and date of the terms you accepted;
- restrictions on use, storage, model training and sharing;
- attribution and display requirements;
- fees, rate limits and the notice period for changes.
Tip: review the record whenever a platform announces new terms, so that changes do not take you by surprise.
-
Even where your company is exempt, giving athletes direct access to their data from the start avoids costly changes once the exemption no longer applies.
How to do this
- Make recorded data available in a standard format, such as FIT, from the first product version.
- Document the data fields your device records, including units and sampling rates.
- Plan for an API that athletes can authorise other services to use, even if you build it later.
Further guidance
This checklist is based on the Activity Data Compliance Guide and the Recommended Practices, both available in draft to members of the Alliance. Questions and suggestions are welcome at hello@opensportsdata.org.