GDPR for dive centers: a practical guide

Your guests fill out registration forms, liability releases, course forms and medical questionnaires. That makes your dive center responsible for a lot of personal data, some of it about their health. This guide goes through what the European data protection rules ask of you, one practical step at a time.

We build software for dive centers; we are not a law firm. This page explains how we read the rules and is not legal advice. When you are unsure, ask a data protection professional in your country.

Does the GDPR apply to my dive center?

The General Data Protection Regulation (GDPR) has applied across the European Union since 25 May 2018. It applies to your business if:

• your dive center is in the EU or the wider European Economic Area (Iceland, Liechtenstein, Norway), or
• you are elsewhere but offer your trips and courses to people while they are in Europe: you take bookings from them at home, advertise to them, or price for them in euros.

The second point covers far more centers in Thailand, Indonesia, Egypt or the Caribbean than you might think. Many centers outside Europe follow the GDPR anyway: their European guests expect it, the agencies and partners they work with ask for it, and it is simply a good standard for looking after people's data. Fines can reach €20 million or 4% of annual worldwide turnover, but most of what the rules ask is common sense.

The six principles

Everything else follows from these:

1. Purpose. Tell your guests why you collect each piece of data: insurance, safety, the dive agency, the law, marketing.
2. Lawfulness. Use the data only for the purposes you told them about. No consent to your newsletter means no newsletter, and that includes the birthday email.
3. Data minimisation. Ask only for what you need. Shoe size for fins is fine, as long as you can say why you ask.
4. Accuracy. When a guest tells you something changed, you must be able to find and correct it.
5. Storage limitation. Decide how long you keep each kind of record, and tell your guests. Some agencies and some countries require course records for years; others need none.
6. Integrity and confidentiality. Protect the data against loss, damage and anyone who should not see it, on paper and on screen.

Step 1: Go through your registration form

Put your customer form in front of you, paper or online, and work through it.

Group the fields and give each group a reason

Sort the fields into sections such as personal data, contact details, certification and equipment. For each section write one plain sentence saying why you need it, for example: "We ask for your date of birth because some dives and courses have a minimum age."

Cross out what you don't need

Go back over every field. Passport number, nationality, home address: if the law, your insurer or the local authorities require it, keep it and be ready to say so. If not, remove it.

Inform, then ask for consent where it is needed

Not everything needs a checkbox. The GDPR allows several legal bases, and two of them cover most of what a dive center does:

• To provide your service (the contract with your guest): the data you need to take someone diving or teach a course. You inform them; you don't ask.
• A legal obligation: registering guests with local authorities, keeping invoices for the tax office.

Say in the same plain words who you pass data to as part of the service: the dive agency that issues the certification, local authorities, your accountant, and the software you use to store it.

Marketing needs consent. Your newsletter and any sharing with partners for their offers each get their own checkbox, and the box must start empty. Consent has to be given freely, and withdrawing it must be as easy as giving it.

Finish the form

• Say how long you keep the data, and why.
• Give an email address where guests can ask what you hold about them, correct it or have it deleted.
• For divers under 16, ask for a parent's or guardian's details and signature.
• Write it all for a teenager or a non-native speaker: short sentences, no legalese. If you translate the form, check the translation.

Should European and other guests get different forms? You can, but then you maintain two processes, and you can't always tell who falls under the rules: a guest with an Australian passport may live in Berlin. One good form for everybody is simpler, and guests notice the care.

Step 2: Treat medical forms as sensitive data

Medical statements and doctors' clearances contain health data, one of the GDPR's special categories. Processing it is forbidden unless an exception applies, and for a dive center that is normally the diver's explicit consent. When you ask for it, tell your guests:

• where the form is kept, and who can see it;
• how long you keep it, and why;
• whether anyone else receives it (an agency, an insurer, a doctor), and who they are.

Keep medical forms apart from everything else, so an instructor checking an old course file doesn't see health data they don't need. A separate locked folder with a reference number works on paper; restricted access does the same on screen.

Step 3: Look after paper and screens

Paper

• Forms go into a locked cabinet, not a box behind the counter. Know who has the key, and don't leave it under the flower pot.
• Protect the cabinet against water, fire and the odd curious guest.
• Once data has been typed into your software, decide whether the paper still needs to exist. If it does, lock it away; if not, shred it.

Computers, tablets and phones

• Install system updates and keep the devices protected against malware.
• Lock screens automatically, and never share logins. Every staff member gets their own.
• No passwords on sticky notes on the monitor.
• Give guests their own Wi-Fi, separate from the office network.
• Collect data through an encrypted online form (https://), not as attachments sent back and forth by email.
• Back up regularly, and encrypt the backup or lock it away with the paper forms.
• Don't save exports with guest data on a shared desktop. Delete them when you're done.

Step 4: Check the software you use

Make a list of every tool that touches guest data. These categories help:

• customer records and booking
• accounting and payroll
• newsletter and marketing
• website, contact and booking forms
• email, chat and messaging (WhatsApp included)
• cloud storage and spreadsheets
• dive agency portals

You are the controller, they are your processors

You decide which data you collect and why, so you are the controller. A company that stores or handles that data for you is a processor, and the GDPR requires a written contract with each one: a data processing agreement (DPA, Article 28). Reputable providers publish one. If a provider can't show you theirs, that is your answer.

Where does the data go?

Data may move freely inside the EEA and to countries the European Commission has found to protect it adequately. The Commission keeps the current list.

For providers in the United States, the 2016 Privacy Shield no longer counts: the EU Court of Justice struck it down in 2020. Since July 2023 its successor is the EU–US Data Privacy Framework, and you can check whether a company is certified on dataprivacyframework.gov. Elsewhere, a provider needs other safeguards, usually the EU's Standard Contractual Clauses, written into its DPA.

Mark each tool on your list: green when it has a DPA and keeps data in Europe or a safe country, a question mark when you can't tell. Replace the question marks, or tell your guests plainly that their data may leave Europe and why.

Step 5: Write it down

The GDPR expects you to keep a record of what you do with personal data. Small businesses are normally exempt, but not when they handle health data regularly, and medical forms mean most dive centers do. Add a data protection chapter to the operations manual you train new staff with. It should answer:

• How do you collect guest data: paper, an online form, or both? Does someone retype it?
• Who can open the cabinets, the devices and each piece of software? Who sees medical data?
• How long do you keep each kind of record, and how do you delete it?
• Which records must stay even after a guest asks to be deleted (invoices, signed releases, course records)?
• What do you do if data is lost or stolen? A serious breach must be reported to the authority within 72 hours.

Step 6: Be ready for guest requests

Guests may ask what you hold about them, ask you to correct it, or ask you to delete it. You have one month to answer. That only works if you can find all of a person's data quickly. Sometimes you must keep part of it anyway: tax law and legal claims come before deletion. Tell the guest which parts you keep, and why.

How Geek Divers helps

Geek Divers handles your guests' data as your processor, under a Data Processing Agreement that is part of our terms. In the software:

• Your data protection text on the registration form. You write it once in Settings → Data Protection, and every guest reads it on the online registration form before submitting.
• Separate, empty consent boxes for your newsletter and for partner offers. When a guest ticks one, the date is stored with it, and you see both on the guest's profile.
• Guardian details for young divers. When the date of birth makes a diver younger than 16, the form asks for a parent's or guardian's name and email.
• Newsletter exports and marketing audiences can be limited to guests who agreed.
• One login per staff member, with rights per location, so nobody shares a password and you decide who sees what.
• Hosted in Germany. The database runs on servers in Frankfurt, uploaded files stay in the EU, and backups are made daily. Every sub-processor is named in the DPA.

Want to see it with your own forms? Book a short video call, write to info@geekdivers.com, or see what else Geek Divers does.

First published in April 2018 as a four-part series on the Geek Divers blog. Updated October 2026.