The GDPR for course providers: the essentials at a glance

The principles in three sentences

For a course booking you may process the data you need for the contract – name, contact details, payment data and the attendance itself (Art. 6(1)(b) GDPR). Collect only what you really need and delete it when the purpose falls away (Art. 5(1) GDPR). Anything beyond that – newsletters, photos, health questions – generally needs its own legal basis, usually consent.

Software providers and processing on behalf

If you use a course management system, a newsletter tool or a web host, that provider processes your participants' data on your behalf. For this you need a data processing agreement with the mandatory contents of Art. 28(3) GDPR – subject matter and duration, types of data, the right to issue instructions and technical safeguards, among others. The agreement has to be in writing; electronic form is sufficient (Art. 28(9) GDPR).

Children and young people

Age limit of 16: for consent to online services the GDPR limit of 16 years applies in Germany (Art. 8 GDPR); there is no different German rule. Below that age the parents consent.
Only for consent: the age limit concerns consent, not the contract itself. Whether minors can book a course effectively follows contract law (§§ 106 ff. German Civil Code). That is why parents usually book children's courses.

Health information

If you ask about pre-existing conditions, allergies or limitations – for yoga, back courses or swimming, for example – you are processing health data. It is specially protected (Art. 9 GDPR) and generally requires explicit consent. Ask only what is genuinely necessary for safety in the course, restrict access to the course leader and record reasons for absence in general terms (“excused”) rather than with a diagnosis.

Photos from the course

Anyone wanting to publish photos of participants – on a website or in social networks – needs consent under the German Art Copyright Act, apart from statutory exceptions (§§ 22, 23 KUG). Taking the photograph itself already falls under the GDPR; how the two laws interact is disputed. In practice you therefore obtain consent beforehand, from the parents in the case of children, and make clear that it can be withdrawn.

Consent beforehand: advertising by email requires prior explicit consent (§ 7(2) German Unfair Competition Act). There is a narrow exception for existing customers (§ 7(3)).
Provable: you must be able to show that consent was given (Art. 7(1) GDPR).
Double opt-in: confirming through a link in an email is not in the statute, but it is the usual evidence and has been recognised by the German Federal Court of Justice for email advertising.
Ask separately: the newsletter consent does not belong hidden inside the booking, nor as a pre-ticked box in the form.

Keeping and deleting

Since 1 January 2025 shorter periods apply to receipts in Germany. This affects all documents whose previous period was still running at the end of 2024.

Documents	Period
Invoices and accounting receipts	8 years (§ 147(3) AO, § 257(4) HGB, § 14b UStG)
Books, records, annual accounts, inventories	10 years
Business letters and other tax-relevant documents	6 years

The periods begin at the end of the calendar year, and no retention period ends while the tax assessment period is still running. Whether SEPA mandates or registrations count as accounting receipts or as other documents is best clarified with your tax adviser. Anything not subject to a retention obligation you delete as soon as you no longer need it – the contact details of former participants after a fixed period, for example.

Not legal advice. This article gives a general overview of German law as at 22 September 2026. For your own case consult a data protection adviser, your tax adviser or the data protection authority of your federal state.

Data protection in Kursimple

Hosting in Germany with a daily backup and a data processing agreement.
Individual logins and roles for your team instead of a shared password.
Deletion periods for customers, participants and instructors, between six months and three years. Who is due is shown under “data protection”; there you anonymise those people – invoices and orders are kept for the statutory retention period.
Documented consents, such as how a direct debit mandate came about.
A newsletter with double opt-in (from the Plus plan).
Follow-up forms after the booking (from the Plus plan), when you need details such as health questions only from the participants of a particular course.

More about security & data protection

Sources

Read on: Keeping an attendance list · Online registration checklist