Guest data protection for dive centres

Last checked 1 November 2026.

A dive centre holds more sensitive paperwork than most small businesses: passports, signed health declarations, insurance details, and the names of minors and their guardians. Egypt's data protection law is now coming into force, and many guests bring the rules of the UK or EU with them. This page sets out the questions a centre needs to settle, what Waves does about them today, and what we are working towards.

What personal data does a dive centre hold?

• Identity: name, birth date, nationality, passport or ID number, sometimes a scan.
• Contact: email, phone, hotel or home address, emergency contact.
• Health: the DAN health declaration and any medical questionnaire. Health data counts as sensitive under UK and EU GDPR and under Egypt's law, with stricter rules.
• Insurance and certification: insurance details, certification cards, instructor numbers.
• Minors: a child's details plus a named guardian or supervisor.
• Money: bills, payments and invoices tied to a named guest.
• Staff: visa dates, addresses, CDWS card numbers.

Which rules apply?

Egypt. The Personal Data Protection Law (No. 151 of 2020) has executive regulations issued on 1 November 2025, with a one-year grace period that was due to end on 1 November 2026. According to a law firm summary, organisations that decide how data is used, and those that process it for them, need a licence; sending data outside Egypt, including to a cloud service, needs a separate licence; retention periods must be set and recorded; and breaches must be reported within 72 hours. Check the current position with a local adviser: the exact enforcement date was still being debated.

UK and EU. UK GDPR and EU GDPR can apply to a centre that markets to guests in those places, and to a UK-based software supplier. Whether they apply to you is a question for an adviser.

Six questions to settle

1. Who is responsible?

Your centre decides why and how guests' data is used, so you are responsible for it. Anyone who handles it for you, such as a software supplier, a cloud host or an accountant, needs a written agreement with you.

2. What do you keep, and why?

Keep what you need and no more. A passport scan that was needed to file a trip may not need to sit on file for years. Check with the CDWS and your insurer what you must keep before you decide.

3. How long do you keep each type?

Write down a period for each kind of record: ID scans, signed waivers and health forms, bills and payments, dive logs, incident reports, marketing contacts. Accounting law, your insurer and the time allowed for claims all push the periods up; the law pushes everything else down. There is no single right answer, and Egypt's rules ask you to record your periods.

4. Who can see it?

Not everyone at the front desk needs a guest's medical answers or passport number. Give each person only what their job needs.

5. What do you do when a guest asks?

A guest can ask what you hold about them, or ask you to delete it. You need a way to find everything held on one person, and a rule for what you must keep anyway, such as accounts.

6. Where is it stored, and what if it goes wrong?

Know where the data physically sits, who can reach it, and who you would tell, and how fast, if it leaked.

What Waves does today

• Guest data stays at your centre. The installed version runs on a PC at your centre and does not copy guest data to a server. The hosted demo at waves.oobab.co.uk holds invented data only.
• Access by person. Permissions are set per person and enforced by the database, not just hidden buttons. Passport, medical and insurance details, and scans of insurance and other documents, need their own permission. Boat crew and read-only logins cannot see payments or bills.
• A change history. Owners and managers can search who changed what and when, on a person, a booking, an equipment item or a trip. Personal details such as birth date, contact details, address and document names are recorded as "changed" without the value.
• Encrypted backups. Backups are locked with a password before they go to a USB stick or cloud storage.
• Records you can hand over. A guest's stay report, log book and course record print on one page, and reports download to Excel. That is a start on answering a guest who asks what you hold.
• Waiver and health declaration per stay, in the CDWS layout, kept with the guest's stay.

What we are working towards

Data protection is an area we want to do properly, so here is what is on our list. None of it is promised for a date.

• Retention rules you set for each type of record, with a "due for review" list for a manager to decide on.
• Removing a guest's identity when they ask, while keeping your bills, dives and totals correct.
• One-click export of everything held on one person.
• A marketing consent flag, a privacy notice line on the waiver and check-in forms, and a simple log for data breaches.

If you need any of these sooner, tell us. It helps us decide what to build first.

Questions

Does Waves make my centre compliant?

No software can do that for you. Compliance depends on what your centre decides and does. Waves gives you tools for several of those decisions, and we are adding more.

Where does Waves keep my guests' data?

On a PC at your centre. The installed version does not copy guest data to a server.

Can Waves delete a guest's data when they ask?

Removing a guest's identity while keeping your accounts correct is on our list but not built yet. If you need it now, talk to us.