A national sports federation is, organizationally, a serious entity. It administers competition for an entire country. It certifies coaches and referees. It selects national teams for international representation. It manages anti-doping compliance under World Anti-Doping Agency standards. It receives and disburses public funding running into millions of euros annually. It holds the legal status of public utility in most European jurisdictions, including Spain.
Infrastructurally, it is often something else entirely.
This study examines how mid-tier national sports federations on the Iberian Peninsula operate their core digital infrastructure. The findings are drawn from direct engagement with several federations across Spain. All have been anonymized. The operational profile in each case is real.
What we mean by infrastructure
The infrastructure of a sports federation is not its facilities, its training centers, or its physical assets. The infrastructure relevant to this study is the digital substrate on which the federation conducts its actual operations: the registry of all federated athletes including personal data, medical clearances, and competitive history; the calendar and logistics of national and regional competitions; the licensing of coaches, referees, and technical officials; the documentation chain for anti-doping testing and results management; the financial flows associated with public grant programs; and the communication channels with regional delegations and member clubs.
This is not peripheral data. It is operationally critical, legally sensitive, and externally auditable. Yet across the federations examined, the predominant tools handling these flows are Microsoft Excel, Google Sheets, WhatsApp, personal email accounts, and a varying number of partially-integrated bespoke applications inherited from past technology projects, most of which are no longer actively maintained.
How federations arrive here
The structural condition described in this study is not the result of malpractice. It is the result of an organizational trajectory that, examined sequentially, makes each step understandable, but whose cumulative outcome is what we now observe.
National sports federations in the Iberian Peninsula were, until the 1990s, organizations of modest operational scale. Their administrative core was small, their data flows were paper-based, and their geographic distribution was managed through occasional in-person regional meetings. The digitization of their operations began in the early 2000s and proceeded along a path determined by the specific tools available at the time and the specific person who happened to be technically responsible.
Three patterns of digitization can be identified across the sample.
The bespoke application pattern. The federation commissioned a custom application from a regional software vendor, typically in the period 2005 to 2012, to manage athlete registry and competition. The application was built on the technology stack available at the time. It is now in maintenance mode at best, abandoned at worst. The vendor relationship has eroded. The application runs, but no one fully understands its internals, and its modification is treated as high-risk.
The platform migration pattern. The federation adopted a SaaS platform marketed specifically to sports organizations at some point in the 2010s. The platform handles a subset of operations, typically licensing and competition, but does not cover the full operational scope. Its cost has risen over time, its export capabilities are limited, and the federation now manages a parallel layer of spreadsheets to handle what the platform does not.
The spreadsheet-native pattern. The federation never made a substantial technology investment. Its operations were built progressively on Excel and Google Sheets, with files distributed across personal drives, regional delegation accounts, and informal email chains. The federation operates because individual administrators hold the operational knowledge of where each piece of data lives.
What this costs in operational terms
An infrastructure of this kind generates a quantifiable cost in three distinct dimensions. The cost is rarely visible in the federation's annual budget because it is absorbed into the time, attention, and continuity risk of the administrative team.
The cost of reconciliation
When operational data lives in multiple parallel sources, the federation periodically has to reconcile them. Reconciliation happens before major competitions, before grant reporting deadlines, before national team announcements, and before audit periods. In the federations examined, this reconciliation work consumes a significant portion of the administrative team's total operational capacity in any given year. This is not productive work. It is the work of making the federation appear to have integrated data when it does not.
The cost of continuity risk
When operational knowledge lives in the heads of individual administrators rather than in documented systems, the federation is structurally exposed to personnel transitions. The departure of a single administrator who has held a critical area for several years can leave the organization unable to perform basic operations for weeks or months.
This is not a theoretical exposure. It is a recurring operational event. Most federations in this sector have a story, generally not told publicly, about the period when a key administrator left and the organization had to partially reconstruct its operational records from scratch.
The cost of regulatory exposure
Sports federations handle data that falls squarely under GDPR scope: personal identifiers, medical clearance records, and in some cases biometric and health data through anti-doping programs. The GDPR obligations on this data are not lighter because the federation is institutional. In some respects they are heavier, because the federation cannot rely on individual consent in the way a commercial entity can: federation membership is functionally compulsory for competitive activity in the sport.
Among the federations examined, several do not have documented data retention policies aligned with GDPR requirements. None of those without a centralized registry system can produce, on demand, a complete audit trail of who accessed any given athlete's record over a defined period. The data lives in distributed spreadsheets and email accounts where such logging does not exist.
The grant flow problem
Most national sports federations on the Iberian Peninsula receive substantial public funding. In Spain, the Consejo Superior de Deportes channels annual grants to federations based on criteria including athlete numbers, competition outcomes, gender balance, regional reach, and program quality.
The reporting requirements attached to these grants have intensified over the last decade. Federations are now required to demonstrate, with documentation, not only that funds were spent on approved categories, but that the underlying activities took place, that the participants were genuinely federated, and that the data supporting the federation's grant calculation matches the data the federation maintains internally.
This last requirement is the difficult one. When the federation maintains its athlete registry on a set of spreadsheets updated by different administrators across different regional delegations over multiple years, the question of whether the registry on grant submission day matches the registry six months later becomes structurally unanswerable. The grant authorities are increasingly aware of this, and are becoming more willing to request documentation that many federations cannot cleanly provide.
The awareness gap
The administrators who manage day-to-day operations in these federations are, in general, fully aware of the infrastructure condition they work under. Awareness is not the problem. What is consistently absent is the institutional mandate and the budget allocation to act on it.
The pattern is recognizable: the people closest to the operational reality understand the risk clearly and have raised it, often repeatedly. The people who control the budget and set strategic priorities operate at a distance from that operational reality and face incentives that do not reward invisible infrastructure investment. The gap between those two positions is where the infrastructure debt accumulates.
Why the decision rarely happens
The structural inertia of this sector is produced by a specific configuration of incentives that affects nearly every federation in the same way.
Sports federation leadership is elected. Federation presidents serve typical terms of four years, often renewable. Their political position depends on visible accomplishments: competition success, infrastructure projects with physical visibility, sponsorship deals, media presence. Infrastructure investment is invisible to the constituency that elects them. A successful digital infrastructure project, three years after completion, looks like nothing happened. A successful new sports facility has a plaque.
The administrative team that lives daily with the consequences of inadequate infrastructure does not control the budget allocation. They can raise the issue, and they generally do, repeatedly. But the decision to allocate budget to infrastructure rebuilding sits with leadership that has no political incentive to take it.
This is the structural reason why the sector has remained where it is for two decades, despite continuous awareness of the gap. It is not a knowledge problem. It is an incentive problem.
What is changing now
Two external pressures are now converging on this sector.
The first is regulatory. The intensification of GDPR enforcement, the data integrity requirements attached to public grants, and the increasing willingness of regional authorities to issue formal notices are collectively making the status quo more expensive to maintain.
The second is generational. The administrators who have held federations together through personal knowledge and improvised tools are reaching retirement. The federations they leave behind cannot be operated by their successors in the same way, because the operational knowledge is not transferable. The institutional discontinuity that has been hypothetical for two decades is becoming concrete on a defined timeline.
Combined, these two pressures suggest that the next five years will see a meaningful number of Iberian sports federations face a forced infrastructure decision. The question is not whether the decision will be made. It is whether it will be made under planned conditions or under crisis conditions.
What this study is, and what it is not
This study is a documentation of a sector-wide condition. The Spies Files does not provide consulting, advisory, or implementation in the sectors it covers. The intended reader is whoever, inside or adjacent to one of these federations, needs to make the case for structural change to a leadership that has not yet seen the gap framed in these terms.
The next study examines a third sector showing the same structural drift: reference clinical practice in private healthcare.