LOPIVI for sports clubs: the 7 real obligations (2026)

LOPIVI (Spain's Organic Law 8/2021 of 4 June, on the Comprehensive Protection of Children and Adolescents against Violence, published in the Official Gazette on 5 June 2021 and effective since 25 June 2021) requires every entity that runs regular activities with minors to appoint a Protection Officer (DPI), have a written action protocol, deliver specific training to its staff and verify the Criminal Records Certificate (CDNS) of anyone — employee or volunteer — with regular contact with children and adolescents.

It applies to your club if you have teams, schools or any regular activity with people under 18. Size is irrelevant: a youth football club with 40 kids is bound just like a 400-pupil basketball academy. If you only run senior squads (over 18) it does not formally apply, although the good-practice baseline remains advisable.

Non-compliance is sanctionable: minor infringements 30 to 3,000 €, serious ones 3,001 to 30,000 € and very serious from 30,001 € up to 1,000,000 €. Beyond the fine, the reputational risk with families and the federation is high: a single badly handled complaint can blow up the club's trust capital overnight.

The good news: complying with LOPIVI in a small club costs between 500 and 1,500 € a year if the DPI is internal and unpaid. The real burden is not financial but organisational — documenting, training and communicating. This guide walks you through the 7 obligations step by step, with templates, a worked example, a checklist and the LOPIVI-vs-GDPR distinction that almost every club gets wrong.

LOPIVI does not distinguish between professional and amateur clubs, nor between non-profit associations and sports limited companies. The obligation kicks in whenever you organise regular activities with minors. Two real examples of clubs that thought the law did not apply to them — and it did.

Case 1: youth football club with 200 players

A neighbourhood club with four age groups (U10, U12, U14, U16), 200 players aged 7 to 15, 12 coaches (10 volunteer parents + 2 employees) and one adult amateur squad. LOPIVI applies because the club's main activity is youth sports training. It needs: an appointed DPI, a written protocol, CDNS certificates for all 12 coaches (volunteer parents included), initial staff training and protocol communication to families at the start of the season. The club could not limit itself to checking the CDNS of paid coaches only — volunteers with regular contact also need one.

Case 2: paddle academy with 80 under-age pupils

A private paddle academy with 80 pupils, of whom 60 are under 18 (junior school + youth performance pathway), 4 coaches on payroll and 3 occasional external collaborators. LOPIVI applies in full: contact with minors is regular and structural to the business. All 7 professionals need a CDNS, not just the payroll ones; the club must have a DPI (could be the sporting director with proper training), an active protocol and communicate to families at enrolment. Common confusion: thinking that being 'private' or 'small' exempts you. It does not.

If your club runs any regular activity with minors — youth football, paddle or tennis academy, basketball academy, swimming club with school, judo, gymnastics, athletics youth pathway — LOPIVI applies. The only formal exemption is the club that exclusively fields senior (18+) teams, although even there we recommend keeping the good-practice baseline (code of conduct and communications in particular).

A summary of the 7 pillars that structure compliance. Each one is developed in its own section below. This is the mental checklist you should keep current.

1. Appoint a Protection Officer (DPI). A person in the club — internal or external — responsible for receiving complaints, coordinating the protocol and overseeing training. It is the central obligation: without a DPI appointed in writing, none of the other obligations actually work.
2. Written action protocol. Document known to all staff that defines the types of situation, complaint channels (in-person, email, app), escalation (DPI → Board → authorities), confidential log and family communications. Without a formal protocol, situations are managed case by case and the risk of error rises.
3. Criminal Records Certificate (CDNS). Every professional or volunteer with regular contact with minors must produce one. Obtained free of charge from the Spanish Ministry of Justice's electronic site (sede.administracionespublicas.gob.es). Indefinite validity, but renewing every 1-2 years is recommended.
4. Specific training on children's rights. Staff with regular contact must receive training on children's rights and violence detection. Initial on joining + recommended annual refresher. There are free official courses from the Ministry and paid options from federations.
5. Explicit code of conduct. Clear rules on the adult-minor relationship: no unnecessary physical contact, communications ONLY through club channels (no personal WhatsApp coach-minor), one-on-one interviews with minors always with 2 adults present, no use of club photos/videos on staff personal social media.
6. Outreach and communication to families. Members, families and minors must know the protocol and the DPI: visible signage on premises, mention on the website, mandatory family briefing at season start and clear communication of the complaint channel.
7. Internal incident log. Every suspicion, complaint or DPI intervention is logged confidentially: date, description, parties involved, actions taken and outcome. Minimum 5-year retention. Access restricted to DPI and the Presidency.

The 7 obligations reinforce each other: a DPI without a protocol does not function, a protocol without training is just paperwork, training without family communication never reaches the people who should use the channel. Work them as a system, not as isolated boxes to tick.

The DPI is the single most important figure in your club's LOPIVI framework. The appointment must be formal — a written Board resolution with acceptance of the role — and communicated to staff and families. 'Pedro will do it' is not enough; it must be on record.

Ideal DPI profile

Someone from the club, accessible to minors and families, with sensitivity to the topic and willingness to train. No legal qualification required — specific LOPIVI training is. Typical in grassroots clubs: club secretary, sporting coordinator, volunteer parent with an empathetic and discreet profile, or a Board member. In larger clubs a dedicated part-time role makes sense (not just bolted on to an already-overloaded position).

Main DPI functions

• Receiver of complaints and concerns — single point of contact for staff, families and minors.
• Protocol coordinator — activates each step of the action process when a case arises.
• Internal training lead — coordinates initial and annual refresher training for all staff with regular contact.
• Custodian of the incident log — confidential, with restricted access.
• Liaison with authorities — escalates to Social Services, the Juvenile Prosecutor or the police as the protocol dictates.

Internal or external DPI: when to choose each

Internal DPI (a club member): standard in small and medium clubs. Pros: closeness, day-to-day knowledge, near-zero cost if volunteer. Risks: role conflict (if the DPI also coaches the team where a complaint arises), workload. External DPI (specialised legal advisor or compliance consultant): standard in large clubs or with high public exposure. Pros: independence, guaranteed training. Cost: typically 600-2,000 €/year. Recommendation: start internal and well trained; outsource only if volume justifies it or a complex case arises.

Time commitment and pay

In a grassroots club with 100-300 minors, the DPI's effective workload usually sits at 2-4 hours per month in normal operations, with occasional spikes during an incident. Paying the role is not mandatory in non-profit clubs with an internal volunteer DPI — most assume it pro bono. Funding initial training and refreshers (50-200 € per course) and giving visibility to the role on the website and on-site signage is recommended.

The protocol is the operational manual triggered whenever a suspicion or complaint appears. It must be in writing, known to all staff and reviewed at least annually. These are the 7 blocks that cannot be missing.

Minimum protocol structure

1. Scope and types of situation covered. Define what situations trigger the protocol: physical, psychological or sexual violence; neglect or abandonment detected in the minor; peer-on-peer bullying within the team; inappropriate behaviour by club staff. The clearer the catalogue, the fewer grey areas.
2. DPI identification and contact channels. Name, photo, dedicated email, phone or club messaging channel. This information must appear on the website, on visible signage at the premises and in family communications at the start of the season.
3. Complaint channels (at least two). In-person channel (DPI interview) and a written channel (web form, dedicated email or physical drop box). A third anonymous channel is recommended. The complaint must be possible from a minor, a family member or club staff equally.
4. Escalation process and time limits. Who receives → who decides → when does the Board step in → when are authorities (Social Services, Juvenile Prosecutor, 112 if immediate risk) contacted. Recommended timing: first DPI assessment within 24-48 h, decision to act within 72 h unless serious risk demands immediate action.
5. Precautionary measures during investigation. What to do with the person under complaint during the assessment phase: temporary separation from contact with minors, reassignment, temporary leave. Balance between protecting the minor and not condemning before investigating.
6. Communication to families and the affected minor. Who communicates, what is communicated and when. Information protocol for the family of the alleged victim, communication to other families if relevant (without exposing the minor) and emotional support for the minor.
7. Case record and retention. Confidential file with date, facts, parties, actions taken, resolution. Minimum 5-year retention, restricted access to the DPI and the Presidency. If the case is referred to criminal proceedings, retention runs while the proceedings are open.

The protocol is signed by the DPI and the Presidency. It is delivered to every staff member with regular contact upon joining, a summary is published on the club's website and it is formally reviewed every year. Never hide it in a drawer: if no one knows it, it does not exist.

The CDNS — Spain's Certificate of Sexual Offences and Human Trafficking — proves that a person has no criminal record on the relevant Central Registry. Without it, that person cannot have regular contact with minors at your club. Period.

Who must produce a CDNS

Every professional and volunteer with regular contact with minors at your club. 'Regular' means recurring contact during the activity, not occasional. In practice, at a grassroots sports club this includes:

• Coaches in every age group with minors (paid or volunteer).
• Sports monitors, strength coaches and physiotherapists with session contact.
• Volunteer team delegates (typically parents) who travel with the team to matches, locker rooms or trips.
• Sporting coordinators and technical directors who attend training sessions.
• Office staff if they regularly deal with minors or run on-site enrolment.
• Event volunteers if they work with minors (does not apply to a parent who occasionally helps at the tournament bar without direct contact).

How to obtain the CDNS (free and online)

Each person requests it individually on the Ministry of Justice's electronic site (sede.administracionespublicas.gob.es), logging in with a digital certificate, electronic ID card or Cl@ve. The process is free and the PDF is downloaded within minutes. For those without electronic ID there is an in-person option at Ministry offices with prior appointment. The club cannot request it on behalf of its staff — the request is always made by the individual, who then hands it to the club.

Storage and validity

The CDNS does not formally expire but renewing it every 1-2 years is sensible, especially at the start of each season. Store it digitally in the worker's or volunteer's personal file, with access restricted to the Presidency / DPI / Office and never shared outside the club. GDPR-compliant: legal basis is a legal obligation (LOPIVI), retention while the relationship lasts plus 5 additional years, right to erasure upon termination.

What if someone refuses to produce it

If a person refuses to produce the CDNS, they cannot keep regular contact with minors at the club. Non-negotiable — not optional, no legal wiggle room. It usually comes up with volunteer parents offering to be delegates or to drive players to away games: explain that the law makes no distinction between volunteer and professional. If they still refuse after the explanation, thank them and reassign them to tasks without contact with minors. Always document the request and the refusal in writing — it protects the club.

All staff with regular contact with minors must receive specific training. Without training, the signed protocol is just paper and the club is exposed in any inspection or real case.

Minimum training contents

• Legal framework: LOPIVI, UN Convention on the Rights of the Child, applicable regional rules.
• Types of violence against minors: physical, psychological, sexual, neglect, peer bullying.
• Detection indicators — what signals in the minor can alert the trained adult.
• The club's protocol: DPI role, complaint channels, how a case is activated, what to do and what NOT to do.
• Staff code of conduct: physical contact, communications, photos/video, one-on-one interviews with minors.

Where to find official or recognised training

The Spanish Ministry of Social Rights and 2030 Agenda offers free materials on its website. Regional and national federations regularly organise specific courses for federated clubs (ask your federation — many now require LOPIVI training to issue sporting licences). Private platforms (Save the Children, UNICEF, sports-compliance consultancies) offer paid courses between 50 and 200 € per person with a valid certificate. If your club has zero budget, the combination 'Ministry materials + internal session led by the DPI' is legally defensible to get started.

Recommended frequency

Mandatory initial training when any new person (coach, volunteer, monitor) joins, before their first contact with minors. Recommended annual refresher of 1-3 hours for all staff with regular contact. After a real incident or a regulation change, an extraordinary session. Always log attendance: signed list, date, content delivered and duration. That list is the proof of compliance.

One of the most underrated obligations and, paradoxically, the one that best protects the club in case of conflict. Families and minors themselves must know the protocol and the DPI. If they do not know, they cannot use the channel — and the club is exposed.

Information letter at the start of the season

A 1-2 page document delivered or emailed to every family at the start of the season. It includes: what LOPIVI is in plain language, what a DPI is and who yours is, what the complaint channels are and how confidentiality is guaranteed. Attach a summary of the staff code of conduct — families appreciate knowing what they can (and cannot) expect from their child's coach.

Mandatory family briefing at the season-start meeting

In the typical season-opening meeting (where coaches, calendar and fees are presented), dedicate 10 specific minutes to LOPIVI: introduce the DPI in person, explain the complaint channel, remind everyone of the basic rules (no direct WhatsApp coach-minor) and open the floor for questions. Best investment of minutes in the year in terms of protection and reputation.

Communication aimed at the minors themselves

Minors themselves must know there is someone (the DPI) they can talk to if something is not right, inside or outside the club. Adapt the language to age: simple signage in locker rooms, a brief mention by the coach at the start of the season, a reminder that 'no one is going to judge you for speaking up'. The minor who does not know there is a channel does not use it, and abuse thrives in silence.

Any DPI intervention — from a conversation with a worried family to a formal complaint — is logged. Human memory is not evidence; the document is. And a good log protects the minor, club staff and the DPI themselves.

• Date and time of the entry and of the reported facts.
• Objective description of the situation, separating observed facts from the observer's impressions.
• Identity of parties involved (minor, family, club staff, third parties if any).
• Actions taken by the DPI and the club: interviews, precautionary measures, internal and external communications.
• Case resolution — archived, referred to Social Services, reported to authorities, internal sanction.
• Signatures: DPI and Presidency. In serious cases, the affected party or their legal representative.

The log is kept for a minimum of 5 years from resolution. If the case has moved to criminal proceedings, it is kept while those proceedings are open. Restricted access to the DPI and the Presidency, stored either under lock and key in physical form or in encrypted digital archive with permission-based access. GDPR-compliant: legal basis is the LOPIVI legal obligation.

Here is a realistic scenario — plausible although fictitious — so you can see how the protocol, the DPI and the log work together when something happens. It is the kind of situation no club wants and every club must know how to resolve.

A mother writes to the club's DPI: her 12-year-old daughter (a player in the U13 girls' basketball team) has told her that the coach shouted at her in front of the team at the last training session and said 'you're useless, you're never going to get anywhere'. The girl came home in tears and does not want to go back. It is the second time in a month the mother hears something like this. How is it handled?

6 DPI steps

1. Acknowledgement within 24 h. The DPI replies to the mother confirming receipt, thanks her for the trust, guarantees confidentiality and explains that the protocol is being activated. Schedules an in-person meeting or video call within 48-72 h. Opens an incident file with the basics.
2. Family interview (without the minor at first). The DPI listens to the mother with two people present (ideally DPI + Presidency or Sporting Coordinator, neither in conflict). Gathers facts: when did it happen, what was said exactly, were there witnesses, how is the girl now. Asks whether the family wants to keep the case internal or move it forward formally.
3. Initial assessment and precautionary measures. The DPI assesses severity. Repeated insults at a minor are psychological violence under LOPIVI — action required. Activates a precautionary measure: the coach is temporarily suspended from contact with the team while the investigation runs (preventive suspension, not punitive). The team is led by the assistant coach or sporting coordinator.
4. Interview with the coach. Formal meeting of DPI + Presidency with the coach. Facts are presented without revealing the source. The coach's account is heard. They are informed that during the assessment they are temporarily suspended from team contact. Everything is documented in writing and signed by both parties.
5. Decision and communication. If facts are confirmed (witnesses, prior pattern), internal sanction applies per the club's by-laws: formal warning, definitive suspension or contract termination as relevant. The family is told the decision without disclosing internal disciplinary detail about the coach (which also protects their privacy). The minor receives support — brief interview if she is willing, with external psychological support if needed.
6. Closure and learning. The incident file is closed with the resolution. It is kept for 5 years. In the next internal training session, the case (anonymised) is used to reinforce the staff code of conduct. If the family is satisfied with the handling, most commonly the girl returns to the team with the new coach. A case well handled = a club that earns the families' trust.

What the DPI must NOT do: minimise ('coaches always lose it'), rush to fire without listening to the coach, share the case in the parents' WhatsApp group, leave the coach in contact with the team during the investigation or fail to log anything. Each of these mistakes triggers club liability. Protocol-based handling is slow by design — and that is what protects every party.

Almost every club we advise confuses LOPIVI with GDPR, and the Protection Officer (DPI) with the Data Protection Officer (DPO). They are different things, different regulations and different roles — although in small clubs both functions can sit with the same person if they have the right training.

Practical rule: if the issue involves a minor and their integrity → LOPIVI. If it involves personal data (photo, address, health, medical history) → GDPR. Many cases touch both. Your DPI and your GDPR lead must talk to each other, especially when handling team photos and videos on the club website and social media.

18 binary items telling you whether your club is up to date with LOPIVI. If you fail more than 4 — get to work this week. If you fail more than 8 — serious exposure in any inspection or complaint.

• We have a DPI formally appointed in writing by the Board.
• The DPI appointment has been communicated to staff and families.
• We have a written action protocol, signed by the DPI and the Presidency.
• The protocol defines at least two distinct complaint channels (in-person + written).
• All staff with regular contact have produced a valid CDNS.
• CDNS certificates are stored securely with restricted access.
• Volunteers (including parent delegates) have also produced a CDNS.
• Staff with regular contact have completed initial LOPIVI training.
• There is an annual schedule of training refreshers in place.
• There is a written code of conduct signed by staff with regular contact.
• The protocol has been communicated to families by letter or email at season start.
• The season-start meeting dedicates a specific block to LOPIVI.
• There is visible on-site signage with the DPI's identity and contact details.
• The club website mentions LOPIVI and the DPI.
• A confidential incident log exists, even if empty.
• The incident log has guaranteed minimum 5-year retention.
• We can distinguish a LOPIVI incident from a GDPR incident.
• The protocol has been reviewed at least once in the past 12 months.

OneClub does not replace the DPI or the protocol, but it does remove the operational friction that makes most clubs end up non-compliant out of disorder rather than bad faith. What we automate:

• Protocol custody and communications. Upload the protocol and code of conduct to the club profile. When a new coach or volunteer joins, they sign digitally from their portal. An automatic acceptance log with date and hash is created.
• CDNS verification and expiry. Each staff member's file includes a CDNS field with upload date and automatic 12-18-month reminder to renew. Access to the document is restricted to Presidency and DPI by permissions.
• Family communications and DPI portal. Mass sending of the season-start information letter with read receipts. Public page with photo and DPI contact, accessible from the member portal. Direct family → DPI channel built in.
• Traceable incident log. Digital case file with timeline, parties, actions and attachments. Permission-based access. Automatic retention and PDF export for audits or authorities.

Free up to 50 members — no card required. If your club already has an appointed DPI and a written protocol, an afternoon is enough to have the system running for all staff.

Always work from the official source. These are the main links maintained by the Spanish Administration — mandatory bookmark for any DPI.

• BOE — Organic Law 8/2021 (LOPIVI) consolidated text — Current text of the law with all amendments — official version.
• Ministry of Social Rights — Child protection — Official materials, guides and campaigns on child protection.
• Ministry of Justice — Criminal Records Certificate — Free electronic procedure to obtain the individual CDNS.
• Spain's Higher Sports Council (CSD) — Information and national-level sports regulation, including child protection.
• Save the Children — Safer environments materials — Practical guides and recognised training for sport and education professionals.
• UNICEF Spain — Children's rights — Training resources on the UN Convention on the Rights of the Child and violence prevention.