On 17 April 2026, the French Basketball Federation (FFBB) suffered an IT security incident. According to the federation, data on nearly 2 million licensed players and around 900,000 legal guardians may have been extracted: names, dates of birth, postal and email addresses, phone numbers and licence details. Bank details, passwords and health data were reportedly not affected. A 21-year-old suspect was arrested a few days later and charged.
Two weeks before the attack, the CNIL, France’s data protection authority, had announced that sports federations would be one of its three priority inspection themes for 2026. The two events tell the same story: the world of sport now handles volumes of data comparable to those of large companies, often with the resources of a voluntary association.
What the CNIL is inspecting in 2026
In its announcement of 3 April 2026, the CNIL explained its choice by the rise in club memberships after the Paris 2024 Olympic and Paralympic Games. Sports organisations process a very large volume of data, including health information and data relating to offences, and much of it concerns minors. The CNIL also noted that the sector has been a particular target of recent cyber attacks.
Inspections will look at whether the data collected is relevant, how long it is kept and what security measures are in place. The CNIL will also check how clubs and federations apply the guidance it has published for them. Priority themes account for around a fifth of the inspections it carries out each year.
A useful reminder: under the GDPR, and the UK GDPR for clubs in the United Kingdom, a personal data breach that poses a risk to individuals must be reported to the supervisory authority within 72 hours by the club or federation acting as data controller. When the risk is high, the people concerned must also be told directly, which means being able to reach families quickly.
Where a club’s data actually lives
In a club or a county association, personal data is rarely kept in one place. The medical certificate or health questionnaire arrives by email, the parental consent form is photographed and sent over a messaging app, the team sheet circulates in a group chat, and photos from the last tournament are shared on a free service hosted outside Europe. Every volunteer coach ends up holding some of this information on their phone, without the club really knowing what or for how long.
This scattering causes two problems. It makes security almost impossible to guarantee, since each tool has its own access rules, and it prevents the club from respecting retention periods, since nobody can delete what they cannot see. These are exactly the two points the CNIL inspections will focus on.
Steps to take this season
The first step is to list the data collected and ask, for each item, whether it is really needed. A club has no reason to keep the health questionnaire of a player who left three seasons ago, or to ask for parents’ occupations when registering a child for junior training.
The next step is to limit access. Committee members, coaches and volunteers do not all need to see the same information, and anyone leaving the club should lose the corresponding access. Finally, communication with families works better through a single channel controlled by the club than through coaches’ personal messaging apps.
How Whaller helps clubs and federations
Whaller brings club life together in a space hosted in France. Each team has its own sphere, where the coach posts team sheets, shares documents and talks with players and their parents. The committee keeps a sphere of its own, and sensitive documents such as parental consent forms or administrative paperwork are stored in spaces that only authorised people can open. When a member or volunteer leaves, deactivating their account removes their access to every sphere in a single step.
For leagues, associations and federations with thousands of members, Whaller ARENA provides a social network entirely in their own colours. Whaller RESILIENCE keeps a back-up communication channel available if the licensing system or the federation’s email is ever compromised, even in the middle of a competition. Whaller holds the Numérique France Garanti label.
Discover Whaller for your club or federation
Further reading
- Whaller for sport
- Interview with Olivier de Villeneuve, President of the Hauts-de-Seine Tennis Committee
- Members, volunteers, donors: your association holds more sensitive data than it thinks
- CNIL: the French data protection authority
0 Comments