<p>Player data has become a vital element of the modern sports industry, serving medical, commercial, and entertainment purposes. Sports organisations and businesses increasingly treat such data as a valuable economic asset, similar to athletes’ image rights, as highlighted in the Project Red Card case. Player data is used to improve fan engagement and enable objective performance analysis, often through technological devices and medical interventions that collect biometric and health-related information directly from athletes. Despite the significant commercial and sporting benefits derived from this data, athletes frequently receive neither fair compensation nor sufficient privacy protection. This raises important legal concerns regarding the ownership, control, and protection of player data, particularly against unlawful or non-consensual use by sports organisations and businesses. The article therefore examines how lawfulness and transparency can be ensured in the handling of player data within the sports ecosystem. Its primary aim is to explore the application of data protection law, especially the EU General Data Protection Regulation (EU GDPR), by proposing a reclassification of player data through the analysis of academic literature, sporting regulations and documents, arbitral awards rendered by the Court of Arbitration for Sport (CAS), and judgments delivered by the European Court of Human Rights (ECtHR) concerning sports-related data. Through this approach, the research seeks to prevent the exploitation of athletes’ data, strengthen privacy protections, and promote greater fairness and accountability across the sports industry.</p>