GDPR for online bookings: the basics for small organisations

1. Collect only what you need

The law calls this data minimisation. The ICO puts it plainly: you must not collect personal data on the off-chance that it might be useful in the future.

For a hall hire, that usually means a name, a way to contact the hirer, the date and time, and what the room is for. It doesn't mean date of birth, home address "just in case" or a copy of someone's ID. Every extra field is more to protect, more to explain and more to delete later.

A quick test for each field on your form: what would go wrong if we didn't ask? If the answer is "nothing", remove it.

2. Say why you're collecting it

People have a right to know what you do with their details. The simplest way is a short privacy notice, linked from the booking form, in plain language. It should cover:

• who you are and how to contact you
• what you collect and why
• who you share it with (for example, your card payment provider)
• how long you keep it
• people's rights, and how to make a data protection complaint to you

That last point matters more now: since 19 June 2026, every organisation must give people a way to make data protection complaints.

3. Keep it secure

Most small organisations don't lose data to clever hacking. They lose it through a stolen password on an email or booking account. The National Cyber Security Centre calls turning on 2-step verification one of the most effective ways to protect online accounts.

• Turn on 2-step verification for the email, booking system and any shared drive that holds booking details.
• Give access only to the people who need it, and remove it when they step down.
• Avoid booking lists living in personal inboxes or on someone's home laptop.

4. Decide how long you'll keep it

UK GDPR doesn't set a fixed number of years. You decide, based on why you hold the data, then delete or anonymise it when that time is up. Financial records are different: they have their own rules. For example, GOV.UK says a limited company must keep its records for 6 years from the end of the last company financial year they relate to. Other structures have their own rules, so check which apply to you.

Worked example (made up): a village hall takes about 200 bookings a year. It decides to keep hirers' contact details for 12 months after the hire, in case of damage or a deposit query, then delete them. Invoices are kept for as long as its accounting rules require. Once a year, the booking secretary deletes anything past its date. It's a one-hour job.

5. Check whether you need to pay the ICO fee

Most organisations that use personal data must pay the ICO a data protection fee each year, unless they're exempt. For most small organisations it's tier 1: £52 a year, for those with a turnover of no more than £632,000 or no more than 10 staff. Charities only ever pay the tier 1 fee, whatever their size. Paying by direct debit takes £5 off. The ICO's online self-assessment tells you whether you need to pay at all.

Your one-page checklist:

1. List the fields on your booking form, and cut the ones you don't need.
2. Write or update your privacy notice, and link it from the form.
3. Turn on 2-step verification on every account holding booking data.
4. Write down how long you keep each type of record, and put a yearly clear-out in the diary.
5. Take the ICO fee self-assessment, and pay if it says so.

If you're about to move bookings online, our step-by-step guide to taking village hall bookings online covers the rest of the setup.

Sources

• ICO: Guide to the data protection fee
• ICO: Data minimisation
• ICO: Storage limitation
• NCSC: Turn on 2-step verification
• GOV.UK: Company and accounting records

Related

• Taking village hall bookings online, step by step
• Booking systems for village halls
• Our privacy policy

← No-code or custom software: which should you choose?Three website accessibility fixes you can do in under an hour →