Dive centre compliance: dive logs, medicals, data and the records regulators ask for

What compliance actually means for a dive centre

For a dive centre, compliance is the set of records you must be able to produce if a regulator, an insurer or an incident investigation asks: who dived, when, with whom, whether they were medically cleared, whether the staff were qualified, and whether the money was receipted correctly. None of it is optional, and most of it is time-stamped, so reconstructing it after the fact is exactly what you cannot do.

The safest position is a system that captures each record at the moment it happens and keeps it durably. DiveOps builds compliance into the daily flow rather than bolting it on: the dive log, medical declarations, certification records and staff credentials all sit inside the operations platform, so the paperwork is a by-product of running the day, not a second job at the end of it.

Dive logs and the Malta Reg 18 case

A dive log is the signed, per-dive record of what actually happened in the water: the diver, the site, the depth and time, the supervising professional, and their sign-off. It is the first document anyone reaches for after an incident, and increasingly it is a legal requirement rather than a courtesy. Malta's diving regulations, for example, require a specific per-dive record kept and signed to a defined standard.

DiveOps includes a mode-aware Dive Log built with that kind of requirement in mind: a signed per-dive record that adapts to how the centre works, with the supervising professional's sign-off captured and a history you can produce on demand. Because it reads from the same dive groups and trip sheet the crew already use, the log reflects the day that actually ran, rather than a form filled in from memory afterwards. The operational side of that day is covered in the trip sheet guide.

Medical declarations and retention

Every diver should complete a medical declaration before they get in the water, and that declaration has to be kept. It is both a safety gate, the centre needs to know about conditions that make diving unsafe, and a liability record, the centre needs to prove the diver was asked and cleared. A drawer of paper forms fails on both counts: it is slow to search and easy to lose.

The fix is to attach the declaration to the booking and the customer record, so it is captured once, timestamped, and retrievable in seconds. Medical information is health data, so it belongs in a system with proper access controls rather than a shared inbox or a photo on a phone. Handled this way, the declaration is checked at the point of booking and retained for as long as your insurer and local law require.

GDPR for a dive centre

A dive centre holds exactly the data GDPR cares about most: names, contact details, passport and certification details, and health information from medical declarations. If you take a single European diver, the rules apply. That means a lawful basis for holding the data, the ability to export or delete a diver's records on request, and honest security around health information.

Three practical things make compliance manageable. First, where the data is hosted: DiveOps runs on EU infrastructure in Frankfurt, so diver data stays in Europe. Second, the right to leave: your data is exportable and there is no lock-in, so you are never held hostage by your software. Third, access control: role-based permissions decide who can see medical and personal data, so a new divemaster trainee does not have the same visibility as the owner.

• EU hosting in Frankfurt, so diver personal and health data stays in Europe
• Data export on request and no lock-in, so a diver's records, or your own, can always be produced or moved
• Role-based access, so sensitive medical and financial data is visible only to the people who need it

Certification records, and where DiveOps stops

A dive centre needs to know each diver's certification level and each staff member's teaching qualifications, and it needs to track a student from enrolment through every course dive to sign-off. DiveOps keeps those records: per-diver certification level, per-instructor teaching permissions, and course progress that only completes when the instructor signs the dives off.

It is important to be clear about the boundary. DiveOps is operations software, not a certification agency system. It records the day on the water and the centre's own paperwork, and it works alongside SSI, PADI and other dive agencies rather than replacing them. The agency's own system issues the certification card; DiveOps makes sure the operational record that leads up to it, the dives, the sign-off, the staff qualifications, is complete and to hand.

Fiscal receipts across the EU

Taking payment is also a compliance activity. Divers expect a proper receipt, and many countries require a specifically formatted tax receipt or fiscalised record for every sale. DiveOps issues tax receipts and invoices with the tax worked out and the sale recorded in the books, so the paper trail behind each payment exists by default.

Fiscalisation rules differ sharply by country, and some, such as Germany and Croatia, impose specific technical requirements on how receipts are generated and stored. Treat the receipt your system produces as the baseline and confirm your local fiscalisation obligations separately, because there is no single EU-wide format. The finance side of this, card fees, deposits and a real P&L, is covered in the dive centre finance guide.