For dive centres

Guest data and the GDPR

A dive centre processes more sensitive data than most businesses its size: health answers, ID copies, emergency contacts, signatures. That is permitted and necessary - but not in every form.

Why a centre may collect all this

Because it needs it for safety. The GDPR does not forbid collecting; it requires a reason, a limit and protection. The reason is easy to state here: without health information, nobody can take responsibility for who goes to 30 metres. The limit is: only what is needed for that. The protection is your job.

The four habits that cause problems

The binder under the counter. Health forms on a shelf anyone can reach is the classic case. Sensitive data has to be locked away.
The spreadsheet by email. Guest lists with health details travelling between desk and guides by email or messenger create copies nobody can collect again.
The shared account. One password for the whole team means nobody can say afterwards who saw what.
Never deleting anything. Retention periods are upper limits, not an invitation to keep everything forever. For the periods that apply to you, ask your accountant or lawyer once.

What Diver ID does about it

Data is stored encrypted on servers in the EU.
Each centre sees only its own guests - separated technically, not by agreement.
Staff accounts with individual permissions instead of a shared password.
The guest keeps access to their data and can export or delete it.
Every signature carries an audit record; every access belongs to an account.

The requests guests actually make

Two come up in practice, and you should be able to answer both without stress: "what data do you hold about me?" and "please delete my data". The first you answer with a printout of the guest record. For the second, the limit is that records you are legally required to keep may stay until the period ends - explain that straight away.

With Diver ID this is easier because the profile belongs to the diver: they can see what is stored and manage it in their own account. Your centre receives the documents it needs for check-in.

One sentence on data processing agreements

If you keep guest data in software operated by another company, you need a data processing agreement with that company. This is standard and not an obstacle - simply ask for it. What this text is not, and cannot be, is legal advice: the details depend on the country your centre operates in.

Frequently asked questions

May a dive centre store its guests’ health data?

Yes, to the extent it needs it for the safety of the dive. It must protect that data specifically, limit access to the people who need it, and not keep it indefinitely.

Where is the data held with Diver ID?

Encrypted, on servers in the European Union. Each centre sees only its own guests, and the diver keeps access to their profile.

What do I tell a guest who wants their data deleted?

That you delete what you are not required to keep - and that records under a statutory retention period stay until it ends. Their profile itself belongs to them and lives in their own account.

Try Diver ID for free

Your account takes a few minutes to set up and the first 20 guest check-ins are on us. No subscription, no base fee, no payment details required.

Create your centre account Watch the check-in process