Dojo Instructor Access Control: Who Should See Payment Data?

Most dojo owners hand out access the same way: one login, shared with whoever needs to mark attendance tonight. It works right up until the evening a part-time instructor opens the wrong screen and sees which families are behind on tuition, which ones are on a reduced rate, and what everyone's bank details are.

Nobody did anything wrong in that story. That's the point. Access control isn't about suspecting your instructors. It's about making sure the question never comes up, for their sake as much as your students'.

Key Takeaways

• In EMEA, 29% of data breaches involve an internal actor, and roughly two-thirds of those are honest mistakes rather than deliberate misuse (19% error vs 8% misuse). The North American figure is 5% (Verizon 2025 DBIR, EMEA, April 2025).
• 73% of UK businesses restrict IT admin and access rights to specific users, which means more than a quarter still don't (DSIT Cyber Security Breaches Survey 2025/2026, April 2026).
• Your instructors need the roster and the attendance sheet. They do not need billing, plans, bank details, or school settings to teach a class well.
• Under GDPR, who inside your dojo can see member data is a legal question, not a preference: Article 5(1)(c) requires data be limited to what is necessary, and Article 32 requires appropriate security measures (EUR-Lex).
• Offboarding matters more than onboarding. Revoke access the day someone stops teaching, not the week you remember to.

If you're setting up your school's admin from scratch, this fits inside the bigger picture covered in the complete guide to dojo management.

What Role-Based Access Control Actually Means for a Dojo

Role-based access control means each person who logs in gets a role, and the role decides what they can see and do. Instead of granting permissions person by person, you define a handful of roles once (owner, admin, instructor, member) and assign people to them.

For a 40-student school with two part-time instructors, this sounds like enterprise overkill. It isn't. The alternative, one shared login that everyone uses, means every person who has ever helped at your front desk can see every financial detail of every family in your school, and you have no way of knowing who looked at what.

CISA's guidance for small-business leaders puts the principle plainly: "Grant access and admin permissions based on need-to-know and least privilege" (CISA Cyber Essentials). Need-to-know is the whole idea. An instructor needs to know who is in tonight's class. They don't need to know who is three months behind on payments.

Why Instructors Shouldn't See Payment Data

The strongest argument isn't that your instructors are untrustworthy. It's that most internal data incidents aren't malicious at all.

Verizon's 2025 Data Breach Investigations Report, built on more than 22,000 security incidents and 12,195 confirmed breaches, found that 29% of breaches in EMEA involved internal actors. The split inside that number is the part worth reading twice: 19% came from unintentional mistakes and only 8% from misuse (Verizon, April 2025). Both figures are shares of all EMEA breaches, and as published they don't sum exactly to the 29% headline, so treat the remaining couple of points as rounding or incidents attributed to more than one internal pattern. North America sat at 5% and APAC at 1%, so the exposure is meaningfully higher for European schools.

What this looks like in a dojo

Translated to a dojo: the realistic risk isn't an instructor selling your member list. It's an instructor leaving a laptop open on the reception desk with the billing screen visible, screenshotting the wrong tab to ask you a question in a group chat, or mentioning to a parent that another family is on a reduced rate because they had no idea it was sensitive.

None of those are discipline problems. They're design problems, and the fix is to not put that data in front of someone who has no reason to act on it.

There's a second, quieter reason. Payment status is genuinely sensitive socially, in a way that matters more in a dojo than in most businesses. Your students train together twice a week. A student who knows an instructor can see they're behind on tuition may simply stop coming rather than have that conversation on the mat. Keeping billing away from teaching staff protects the training relationship, not just the data.

How to Audit Who Can See What in Your Dojo Right Now

Before changing anything, find out what your current exposure actually is. This takes about twenty minutes and most owners are surprised by the result.

1. List every login that exists. Not every person: every login. Include the shared one, the old one you made for the instructor who covered summer classes, and any account your web designer or bookkeeper still has.
2. For each login, open it and check four screens: the member list, the billing or payments screen, the membership plans screen, and school settings. Write down what's visible from each account.
3. Check what can leave the building. Can that account export the member list to CSV? An export is a copy that lives outside your system permanently, and it's the single most overlooked permission.
4. Check who is no longer with you. Every instructor, assistant, or front-desk helper who stopped working with you in the last two years: can their login still get in?
5. Check whether you'd know. If someone opened a member's financial record last Tuesday, is there any record of it?

What the Dutch hospital cases show

That last one is the question the Dutch data protection authority asked two hospitals, and both failed it. In 2019 it fined Haga Hospital EUR 460,000 after dozens of staff viewed one patient's file. The regulator found the hospital "failed to regularly monitor who was consulting which records" and did not use two-factor authentication (Autoriteit Persoonsgegevens, July 2019). A March 2021 update on that same regulator page records that The Hague District Court later reduced the fine to EUR 350,000, and that the judgment is final. In February 2021 the same regulator fined OLVG hospital EUR 440,000, after data breach reports about "work placement students and other staff accessing medical records even though it was not necessary for their work" (Autoriteit Persoonsgegevens, February 2021).

To be clear about scale: hospitals process special-category health data and are held to a much higher bar than a martial arts school. No dojo is getting a six-figure fine for a shared login. Quote these cases for the principle, not the price tag. Both turned on staff being able to reach records they had no work reason to open, and on nobody checking who looked. That failure mode is identical at 40 students and at 40,000 patients.

One Shared Login vs Individual Staff Accounts

The single highest-value change most schools can make isn't a sophisticated permission model. It's ending the shared login.

The shared login wins exactly one row, and it's the row that matters least after the first week.

What Each Role Should Actually Be Able to Do

Here is a permission model that fits how martial arts schools really operate. The table describes access levels rather than scoring them: "no billing access" for an instructor is the correct outcome, not a worse one.

Two design decisions in that table are worth spelling out, because they're the ones owners push back on.

Admins don't get billing either. It's tempting to give your most trusted senior instructor the keys to everything. Resist it. The person who manages your schedule and promotes students has no operational need for bank details, and giving them that access adds risk without adding capability. Financial access should track financial responsibility, not seniority or how much you like someone.

Instructors get the full roster, not a filtered one. Some owners go the other way and restrict instructors to only their own classes. In practice this breaks covering for a colleague, running a grading, or checking whether a student is cleared to train. The roster is operational data your teaching staff genuinely needs, and so is attendance. Whoever teaches the class should be the one marking who showed up. Payment data isn't in that category. Neither is belt promotion history, which is a grading decision rather than a teaching one, though plenty of schools reasonably put that with their admins.

DojoMaster uses the same four roles. An instructor can see the member list, take attendance for any class, and cancel their own classes. Beyond that they get read-only views of the school profile, the staff list, and the belt system, and no write access anywhere else. Billing, accounting, membership plans, changing staff roles, and the audit log are owner-only, and admins get member management, the schedule, belt promotions, events, and the kiosk without billing or accounting access.

If Your Dojo Runs on Spreadsheets, Check Those Permissions Too

Everything above assumes your member data lives somewhere that has roles. Plenty of schools are one step behind that: the roster is a Google Sheet, payments are a second tab, and the link has been pasted into a WhatsApp thread at some point in the last two years. If that's your setup, the access question doesn't go away. It moves to a file whose sharing settings you probably haven't opened since you created it.

So open it. Click Share and read the line under General access. If it says "Anyone with the link," Google's own description is exactly as broad as it sounds: "Anyone who has the link can use your file, without signing in to their Google Account" (Google Drive Help).

A link is not a person

The problem isn't the first person you sent it to. It's the fourth. You send the roster link to the instructor covering Tuesdays, he forwards it to the assistant standing in for him that week, and she opens it on a laptop the rest of her household also uses. Nobody did anything wrong at any step, which is the same pattern as everything else in this article. But now you cannot answer the only question that matters: who can open this right now?

An account you can revoke, and the audit earlier in this article will find it. A link that has been forwarded three times you cannot revoke, because you don't know where it went. You can only change the setting and wait to see who complains.

Be honest about what's in that file, too. A dojo roster sheet is rarely just names. It's phone numbers, parent emails, dates of birth for the under-16s, sometimes medical notes, and, because it was convenient at the time, a column for who has paid and who is on a reduced rate. In a system with roles, that last column is the one you keep to yourself. In a spreadsheet it travels with everything else.

A spreadsheet has one permission, and it covers the whole file

This is the part that tidying up doesn't fix. Sharing grants access to the file, not to a tab or a column. You cannot give an instructor the roster and withhold the payments tab, because "can view" means view the workbook. The entire table in the previous section, roster yes and billing no, has no equivalent in Sheets or Excel.

The usual workaround is to protect the sensitive tab, or hide it. Both vendors are unusually blunt that this is not what those features are for. Google's help page on protecting a sheet or range says: "This shouldn't be used as a security measure. People can print, copy, paste, and import and export copies of a protected spreadsheet. Only share spreadsheets with people you trust." On hidden sheets it is blunter still: "All spreadsheet editors can unhide and view these sheets for convenience" (Google Docs Editors Help). Microsoft says the same about Excel: "Worksheet level protection is not intended as a security feature. It simply prevents users from modifying locked cells within the worksheet" (Microsoft Support).

Both statements invert what owners assume they're getting. Protection stops accidental edits. It does not hide anything from someone who can open the file, and it leaves no record of who looked. A password-protected tab in an .xlsx on an instructor's laptop is a speed bump, not a permission, and maintaining one across a workbook you edit every week is enough of a chore that most people set it up once and then quietly stop.

The one workaround that genuinely holds is two files with two sharing lists: a roster your staff can open, and a financial sheet only you can. It works. It also means maintaining the same student list in two places forever, and the copies start drifting apart within a term.

Emailed files and Google Forms have the same problem

An .xls or .xlsx you email to your staff is worse than a link, not better. The moment it arrives it lives on their laptop, their phone, and whatever backup runs behind both, and the version you keep updating is no longer the version they have. The only control you have left is the offboarding step further down this article: asking them to delete any exports they saved, which is to say a polite request.

Google Forms deserve a specific mention, because dojos reach for them for exactly the data you'd most want controlled: trial signups, grading registrations, emergency contacts and medical notes for a summer camp. The form itself is usually fine. The response spreadsheet behind it is the file that now holds a parent's phone number and a child's allergies, carrying whatever sharing settings it was given on the day it was created.

There's an accuracy problem stacked on top of the access one. A review of 35 years of research found that 94% of spreadsheets used in business decision-making contain errors (Poon et al., Frontiers of Computer Science, 2024). Access control decides who can see the wrong number. It doesn't stop there being one.

What to do about it this week

1. Change every dojo file from "Anyone with the link" to named people. Google's term for that setting is Restricted: "Only people with access can open the file." Two minutes per file.
2. Read the named list and remove whoever has left. Same quarterly check as the account audit above, run against your Drive instead of your software.
3. Split payments out of the roster file if you're staying on spreadsheets for now. Two files with two sharing lists is the only version of role-based access a spreadsheet can offer you.
4. Check the response sheet behind every Google Form you've made for the school, including the one from a camp two summers ago.
5. Stop emailing exports. Share a link with a named person instead, so there is something to revoke later.

Then give the spreadsheet a deadline. Most arguments for leaving one are efficiency arguments: the cross-referencing, the error rate, the hours. Efficiency problems can wait a year without getting much worse. This one doesn't wait. Every instructor you add, every link that gets forwarded, and every export you email widens an exposure you cannot measure and cannot undo. If that's your school, the seven clear signs your dojo has outgrown Excel covers the rest of the case for moving, and the roles table above is what you get on the other side of it.

Why Risk Grows as You Add Staff

The UK government's Cyber Security Breaches Survey, based on 2,112 businesses surveyed between August and December 2025, found that 43% of businesses identified a breach or attack in the previous 12 months, and that the likelihood climbs steadily with headcount: 42% of micro businesses, 46% of small, 65% of medium, and 69% of large (DSIT, April 2026).

That is UK government data, and no equivalent US federal survey publishes the same cut for small businesses, so treat the pattern rather than the absolute numbers as the transferable finding. The same survey found that 73% of businesses restrict IT admin and access rights to specific users, which is the flip side worth sitting with: more than a quarter still don't. The mechanism is intuitive even though the survey doesn't measure it directly: every additional account is another way in. A solo instructor teaching every class has a small surface. The same school two years later, with a manager, three part-time instructors, and a teenager helping at the front desk on Saturdays, has a much larger one, and usually the same single password it started with.

What to Do When an Instructor Leaves

Martial arts instruction runs on part-time staff, and part-time staff turn over. The US Bureau of Labor Statistics describes the occupation directly: "Many fitness trainers and instructors work variable or part-time schedules that may include nights, weekends, or holidays," and some "hold jobs in other fields and conduct training sessions or teach fitness classes" around them (BLS Occupational Outlook Handbook, data as of May 2025). There were 388,400 such jobs in the US, with about 68,000 openings projected per year over the decade.

The churn shows up in the separations data too.

In arts, entertainment and recreation, 6.1% of all jobs turned over in an average month during 2025, against 3.3% across all industries (BLS JOLTS Table 20). That's a monthly rate averaged over the year, not an annual turnover figure, but the comparison holds: your sector churns staff at roughly twice the all-industry rate. This one is US-only, and honestly so: no EU-wide equivalent of JOLTS publishes a monthly separations rate for sport and recreation, so European owners should read the pattern rather than import the number.

The five-minute offboarding routine

Build it once and run it the day someone stops teaching:

1. Remove their account the same day. Not "deactivate later." If they might come back to cover classes, removing and re-inviting takes two minutes.
2. Change any shared credential they knew. The kiosk PIN, the wifi password for the office machine, the shared email account.
3. Ask about exports. If they ever downloaded a roster to a personal laptop or phone, ask them to delete it, and note that you asked.
4. Reassign their classes before you remove access, so you don't lose the schedule while tidying up.
5. Check the list again quarterly. Put it in the calendar. This is the step everyone skips, and it's where ghost accounts come from.

Worth being honest about a gap here: there is no good public survey of how long small businesses actually take to revoke a departing employee's access, and the numbers that circulate are vendor telemetry with no stated methodology. What DSIT does show is that only 47% of businesses use two-factor authentication at all (DSIT, April 2026), so the revocation number is unlikely to be flattering.

How to Explain This to Your Instructors

This is where well-designed access control goes wrong in practice. Get the technical part right and the conversation wrong, and a good instructor hears "my owner doesn't trust me."

Frame it as their protection, because it genuinely is. An instructor who cannot see payment data can never be the person who leaked it, can never be asked by a parent to check someone else's balance, and can never be in the room when that question comes up.

What to say

Clear and neutral (use these):

1. "I'm setting up proper logins for everyone so you each have your own account instead of the shared one. Yours covers the roster and attendance, everything you need to run a class. If you ever need something you can't reach, tell me and I'll either do it or change your access."
2. "Billing stays on my account only. That's deliberate: it keeps you out of any conversation about who owes what, which is honestly a favour."
3. "If a parent ever asks you about a payment, you can say truthfully that you don't have access to that and send them to me. That's the point of setting it up this way."
4. "Nothing about this is about trust. It's the same reason I don't have a key to your house: there's no reason for me to, so I don't."
5. "You'll still be able to cancel your own classes and take attendance for anyone's, so nothing about how you actually teach changes."

What to avoid

Worth avoiding:

1. "I've restricted what everyone can see for security reasons." (Accurate but reads as a response to an incident nobody knows about.)
2. "New policy: instructors no longer have access to financial information." (Policy language for a two-person team invites the question of what prompted it.)
3. "It's just what the GDPR requires." (True-ish, but it outsources your decision to a regulation and sounds like you'd prefer otherwise.)
4. "Don't worry, I still trust you." (Nobody had raised trust until you did.)
5. Nothing at all, letting them discover a missing menu item mid-class. (The most common approach, and the one that actually generates suspicion.)

From my own dojo: when I was running my 40-student Aikido school off Google Sheets and Stripe invoices, there was exactly one login that mattered, and it was mine. When an instructor covered for me, I'd hand over the laptop already logged in. One evening a student asked him whether her sister's membership had gone through, and he checked, because he could and because helping was the obvious thing to do. He also saw two other families' payment history on the way to finding it. Nothing came of it. But I realised I had put a colleague in a position where the helpful action and the correct action were different, and that was my fault, not his.

What Not to Do

• Don't hand out owner access "temporarily." Temporary access becomes permanent the moment the immediate need passes. Grant the role you actually want them to keep.
• Don't build a role per person. Four roles cover almost every school. A custom permission set for each instructor is unmaintainable and you will lose track of who has what.
• Don't confuse restricting access with hiding information from staff. Your instructors should still know how the school works, what plans cost, and how pricing is structured. That's a conversation, not a database permission.
• Don't export the member list to a spreadsheet to get around the permission model. An emailed CSV has no access control at all, and it's a copy you can never revoke.

What the Law Actually Requires (and What It Doesn't)

GDPR Articles 5 and 32

For European schools, this is not optional. GDPR Article 5(1)(c) requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed," and Article 32(1) requires controllers to "implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk" (EUR-Lex, Regulation (EU) 2016/679). Article 32(4) goes further and addresses staff specifically: anyone acting under the controller's authority who has access to personal data must not process it except on the controller's instructions.

What the ICO says

The UK's ICO translates the same duty into something you can act on: access rights "must be understood, limited to those users who reasonably need such access to perform their function and removed when no longer needed" (ICO, A guide to data security).

A SEPA mandate contains your student's name, IBAN, and a unique mandate reference. That is personal and financial data, so Articles 5(1)(c) and 32 govern who inside your school may see it. If you collect by direct debit, see the guide to SEPA direct debit mandates for dojo owners for what a mandate involves.

Why PCI DSS probably isn't your obligation

One thing to be careful about, because it gets overstated: PCI DSS Requirement 7 probably does not apply to you. It is titled "Restrict Access to System Components and Cardholder Data by Business Need to Know" and it governs cardholder data. If you take payments through a hosted processor and never touch a card number yourself, you have no cardholder data in your environment, and Requirement 7 is not part of the self-assessment you would complete as an SAQ A merchant, whose eligibility criteria the PCI Security Standards Council updated in its v4.0.1 changes (PCI SSC, January 2025). The instinct behind that requirement is exactly right and worth borrowing, but for most dojos the legal obligation runs through GDPR, not PCI. One exception worth knowing: a school running its own card terminal at the front desk falls under a different SAQ, where Requirement 7 can apply. On the US side there is no single federal equivalent of GDPR covering a small business's member records, which is why the European framing above is the stricter and more useful one to design against.

Setting this up once costs an evening. Most schools already pay for software that supports roles and simply never assigned them, because the shared login worked on day one and nobody revisited it. If you're comparing options, role support is worth checking before price. See free vs paid dojo management software for what the tiers actually include, and the dojo owner's guide to payment collection for where billing responsibility should sit.

Frequently Asked Questions

What is dojo instructor access control?

It is the practice of giving each staff member a role that determines what they can see and do in your school's system. A typical model has four roles: owner, admin, instructor, and member. Instructors get the roster and attendance; billing, plans, bank details, and settings stay with the owner.

Should instructors be able to see whether a student has paid?

No. Teaching a class well does not require knowing anyone's payment status, and giving instructors that visibility creates an awkward dynamic on the mat without adding any operational benefit. Route payment questions to whoever handles billing, usually the owner.

Is restricting staff access actually required by law?

In the EU and UK, effectively yes. GDPR Article 5(1)(c) requires personal data be limited to what is necessary, and Article 32 requires appropriate security measures. The ICO states that access rights must be limited to users who reasonably need them and removed when no longer needed. PCI DSS Requirement 7 covers cardholder data and generally does not apply to a school that uses a hosted payment processor.

What should I do when an instructor stops teaching at my school?

Remove their account the same day rather than deactivating it later, change any shared credentials they knew such as a kiosk PIN or office wifi password, reassign their classes first so you do not lose the schedule, and ask them to delete any roster exports they saved locally. Re-check the full account list quarterly.

Isn't role-based access overkill for a school with two instructors?

The setup cost is a few minutes per person, once. The alternative is a shared login, which makes it impossible to limit what anyone sees, to tell who did what, or to remove one person's access without disrupting everyone else. Two instructors today is often five in two years, with the same password.

Can I run my dojo on a Google Sheet and still control who sees what?

Not in any meaningful way. Sharing a spreadsheet grants access to the whole file, so you cannot give an instructor the roster while withholding the payments tab. Protecting or hiding a tab does not close the gap: Google states that sheet protection "shouldn't be used as a security measure" and that all spreadsheet editors can unhide hidden sheets, and Microsoft states that Excel worksheet protection "is not intended as a security feature." The only workaround is separate files with separate sharing lists, which means maintaining your student list twice.

DojoMaster ships with owner, admin, instructor, and member roles out of the box, so instructors get the roster and attendance while billing, plans, and the audit log stay with you. Start free at dojomaster.app for up to 20 students, with paid plans from EUR 24/month.

Written by Daniil Pavliuchkov, 4th dan Aikido Aikikai and founder of DojoMaster. Sources: Verizon 2025 Data Breach Investigations Report (EMEA), DSIT Cyber Security Breaches Survey 2025/2026, ICO A guide to data security, CISA Cyber Essentials, EUR-Lex Regulation (EU) 2016/679, Autoriteit Persoonsgegevens, US Bureau of Labor Statistics, BLS JOLTS Table 20, PCI Security Standards Council, Google Drive Help, Google Docs Editors Help, Microsoft Support, Poon et al., Frontiers of Computer Science.