GDPR for Gyms: A Practical Compliance Guide for Fitness Operators

Hands arranging data compliance workflow papers

If your gym collects membership applications, runs PAR-Q health screenings, or takes online bookings from people living in the EU or EEA, GDPR almost certainly applies to you — regardless of where your business is physically located. The single most urgent action: lock down how you store and access special-category health data, then confirm every core vendor (CRM, booking platform, payment processor) has a signed Data Processing Agreement (DPA) in place.

Who needs to act now:

Any gym processing personal data of EU or EEA residents, even if your facility is outside Europe
Gyms using biometric door access, body composition scanners, or wearable integrations
Studios collecting PAR-Q forms, medical screening notes, or injury history
Any operator running email marketing to EU members without a documented opt-in process

Non-compliance carries fines of up to €20 million or 4% of global annual turnover, whichever is greater. For an independent gym, even a mid-tier penalty from a supervisory authority can be existential. The good news: most compliance failures are documentation failures, not technical ones, and they are fixable.

Pro Tip: *Start with a one-page data map — list every system that touches member data (booking app, CRM, payment gateway, CCTV system) and note whether each vendor has a signed DPA.

Key Takeaways

GDPR applies to any gym processing EU resident data, and health data triggers the strictest rules — explicit consent, access controls, and documented retention are non-negotiable.

PointDetails

GDPR territorial scope

Applies to any gym processing EU/EEA resident data, regardless of where the gym is located.

Health data is special-category

PAR-Qs, biometrics, and medical notes require explicit, separate consent and stricter security under Article 9.

Document everything

RoPA, signed DPAs, DSAR logs, and training records are what regulators check first in an enforcement action.

Marketing consent must be separate

Opt-ins must be unticked, standalone, and the right to object must be visible at first contact.

CCTV and biometrics are high-risk

Run a DPIA before deploying biometrics; never install cameras in changing rooms; limit CCTV retention to 30 days.

Joinfitnessflow centralizes compliance

Role-based access, built-in consent capture, and audit logs reduce the manual compliance burden for gym operators.

GDPR and your gym: does it actually apply?
Special-category data in gyms: PAR-Qs, medical notes, and biometrics
Lawful bases you can use and GDPR rules for gym marketing
Member rights and how to handle data subject access requests
Data security, minimization, and retention policies for gyms
Working safely with vendors: booking systems, CRMs, and payment processors
CCTV, changing rooms, and biometric access: the highest-risk scenarios
Fitness apps, wearables, and integrations: permissions, syncing, and data sharing
Memberships for minors: parental consent and age verification
When to run a DPIA and how to keep your Records of Processing Activities
Data breach basics and notification obligations for gyms
A 30–90–180 day GDPR compliance plan for gyms
Practical templates and example wording gyms can copy
Handling data from trial memberships and cancellations
GDPR implications of loyalty programs and referral schemes
Managing GDPR compliance for online booking systems and gym apps
What gym operators get wrong about GDPR (and what actually matters)
Joinfitnessflow handles the operational side of GDPR compliance
Sources
FAQ

GDPR and your gym: does it actually apply?

The General Data Protection Regulation (Regulation (EU) 2016/679) is the EU’s primary data protection law. Its territorial scope is broader than most gym operators expect. GDPR applies whenever you process personal data of individuals residing in the EU, or when you offer goods or services to people in the EU — even if your gym is based in the US, UK, Australia, or anywhere else.

Activities that trigger applicability for gyms:

Accepting online membership sign-ups from EU residents
Running a branded app available to EU users
Sending marketing emails to EU-based contacts
Monitoring attendance or access patterns of EU members
Storing PAR-Q forms or medical notes for EU nationals

The regulation splits violations into two penalty tiers. The most serious breaches — processing health data without a lawful basis, for example — reach up to €20 million or 4% of global annual turnover. A boutique studio with €500,000 in annual revenue could face a fine of €20,000 for a tier-one violation. That is not a theoretical risk; regulators have pursued fitness businesses specifically.

Special-category data in gyms: PAR-Qs, medical notes, and biometrics

This is where gym operators face the most legal exposure. Under Article 9 of the GDPR, health data, biometric data, and data revealing physical or mental health conditions are “special-category” data, subject to stricter processing conditions than ordinary personal data like names or email addresses.

What counts as special-category data in a typical gym:

PAR-Q answers (cardiovascular history, joint conditions, pregnancy)
Trainer session notes referencing injuries or medical conditions
Biometric templates from fingerprint or palm-vein door scanners
Body composition metrics tied to health conditions
Wearable data revealing heart rate anomalies or chronic conditions

Processing any of these requires both a standard Article 6 lawful basis and a separate Article 9 condition. In most gym contexts, that Article 9 condition will be explicit consent — freely given, specific, informed, and recorded separately from the membership contract.

Gym workflowSpecial-category data involvedRequired change

PAR-Q at sign-up

Health screening answers

Store in access-controlled system; obtain explicit, separate consent

Personal trainer notes

Injury history, medical conditions

Restrict access to assigned trainer only; encrypt at rest

Biometric door entry

Fingerprint or palm template

Run DPIA first; offer non-biometric alternative; get explicit consent

Body composition tracking

Health metrics

Separate consent form; clear retention limit

Wearable integration

Heart rate, sleep, activity data

Map data flows; verify vendor DPA; consent before sync

Sample explicit consent wording for health data:

This wording is a pattern, not legal text. Have a local data protection lawyer review it before you deploy it.

Lawful bases you can use and GDPR rules for gym marketing

GDPR gives controllers six lawful bases for processing personal data. Gyms typically rely on three of them, and picking the wrong one for a given activity is one of the most common compliance mistakes.

Lawful basis mapping for common gym tasks:

Contract performance (Article 6(1)(b)): Processing a member’s name, contact details, and payment information to deliver the membership they signed up for. This covers scheduling, billing, and access control for existing members.
Legal obligation (Article 6(1)©): Retaining financial records for tax purposes; keeping accident records as required by health and safety law.
Legitimate interests (Article 6(1)(f)): Sending service updates to existing members, fraud prevention, CCTV for security. Requires a Legitimate Interests Assessment (LIA) to document the balance test.
Consent (Article 6(1)(a)): Marketing emails, newsletters, profiling for personalized offers, and — combined with Article 9 — all special-category health data processing.

Marketing do’s and don’ts:

✅ Present marketing opt-ins as a separate, unticked checkbox — never bundled into the membership terms
✅ State clearly at sign-up that members can object to marketing at any time
✅ Honor opt-outs within 10 business days and remove contacts from all marketing lists
❌ Do not rely on “legitimate interests” for direct marketing to non-members
❌ Do not pre-tick marketing consent boxes or make membership conditional on accepting marketing
❌ Do not bury the right to object in paragraph 14 of your terms and conditions

A Swedish supervisory authority reprimanded a fitness company group for exactly this: failing to make the right to object to direct marketing sufficiently clear at first contact and incorrectly relying on consent as the lawful basis for marketing processing. The enforcement action covered failures under Articles 12 and 21. If you run gym lead generation campaigns, your lead capture forms need a clearly visible, separate marketing opt-in — not a pre-checked box.

Lawful bases you can use and GDPR rules for gym marketing — overview diagram

Member rights and how to handle data subject access requests

Every member whose data you hold has enforceable rights under GDPR. You need a process for each one before a request lands in your inbox.

Member rights and response timeframes:

Right of access (DSAR): Member can request a copy of all personal data you hold. Respond within one calendar month; extend by two months for complex requests, notifying the member within the first month.
Right to rectification: Correct inaccurate data promptly — no defined deadline, but “without undue delay” is the standard.
Right to erasure (“right to be forgotten”): Delete data when there is no longer a lawful basis to hold it. Exceptions apply (legal obligation, public interest).
Right to object: Members can object to processing based on legitimate interests or for direct marketing. Marketing objections must be honored immediately with no exceptions.
Right to data portability: Provide data in a structured, machine-readable format (CSV, JSON) when processing is based on consent or contract and carried out by automated means.
Right to restrict processing: Pause processing while accuracy is contested or an objection is being assessed.

DSAR handling process for gyms:

Designate one person (owner or manager) to receive and log all data subject requests
Verify the requester’s identity before releasing any data — ask for a copy of membership ID or a verification email to the registered address
Pull records from every system: CRM, booking platform, payment processor, CCTV logs, paper PAR-Q files
Redact any third-party personal data (e.g., a trainer’s personal notes that mention other members)
Compile and send within the deadline; log the request, your response, and the date sent

Short DSAR response template:

Data security, minimization, and retention policies for gyms

Security under GDPR is not about perfection — it is about proportionality. The controls you implement should match the sensitivity of the data you hold. Given that gyms routinely process health data, the bar is higher than for a typical retail business.

Core security controls every gym should implement:

Role-based access: front desk staff should not have access to PAR-Q records; only assigned trainers and the owner should
Encryption at rest for any digital file containing health data (PAR-Qs, medical notes, biometric templates)
Encrypted transmission (HTTPS/TLS) for all member-facing portals and booking systems
Strong, unique passwords and multi-factor authentication for all staff accounts
Locked, access-controlled storage for paper PAR-Q forms — not a shared filing cabinet in the reception area
A formal process for revoking access when staff leave

Data minimization in practice: Stop collecting data you do not use. If your intake form asks for a member’s date of birth but you only need to verify they are over 18, collect a checkbox confirmation instead. If instructor session notes routinely include medical speculation, retrain staff to record only what is directly relevant to the training program.

Record typeRecommended retentionJustification

Membership records (active)

Duration of membership + 6 years

Contract and potential legal claims

PAR-Q / health screening forms

Duration of membership + 3 years

Safety liability; delete or anonymize after

Payment transaction records

7 years (varies by jurisdiction)

Tax and financial regulation

CCTV footage

30 days maximum (shorter where possible)

Security purpose; longer retention needs justification

Marketing contact lists

Until opt-out + 1 year

Consent-based; delete promptly after withdrawal

Accident / incident reports

Minimum 3 years; up to 7 for serious incidents

Health and safety legal obligation

Retention periods vary by country. These ranges reflect common practice; confirm the applicable legal obligations with a local advisor.

Working safely with vendors: booking systems, CRMs, and payment processors

Every third-party system that processes member data on your behalf is a “processor” under GDPR. You are the “controller.” That distinction matters because you remain legally responsible for what your processors do with member data — and a signed DPA is the mechanism that defines those obligations.

Systems that typically act as processors for gyms:

Membership management and CRM platforms
Online booking and scheduling tools
Payment gateways and direct debit providers
Biometric access control vendors
Email marketing platforms
Cloud storage and backup providers

Vendor checklist — what to confirm before signing:

✅ Signed DPA that references GDPR Article 28 obligations
✅ Clear statement of where data is stored (EU/EEA or adequacy-decision country)
✅ List of sub-processors and a commitment to notify you of changes
✅ Breach notification commitment of 72 hours or less
✅ Evidence of security certifications (ISO 27001, SOC 2, or equivalent)
✅ Process for honoring deletion requests when a member exercises erasure rights
✅ Confirmation that data is not used for the vendor’s own purposes (e.g., training AI models)

Practical DPA clause examples to request from vendors:

“Processor shall process personal data only on documented instructions from the controller.”
“Processor shall notify the controller without undue delay, and no later than 48 hours, after becoming aware of a personal data breach.”
“Processor shall delete or return all personal data to the controller upon termination of the service, at the controller’s choice.”

When evaluating gym management software, check whether the vendor publishes its DPA publicly and whether it covers sub-processors explicitly. A vendor that cannot produce a signed DPA is a compliance liability.

Pro Tip: Keep a vendor register — a simple spreadsheet listing each processor, the data they access, where it is stored, and the date your DPA was signed. Regulators ask for this during audits, and having it ready demonstrates accountability.

CCTV, changing rooms, and biometric access: the highest-risk scenarios

These three areas generate more enforcement attention in the fitness sector than almost anything else. Get them wrong and you are not just facing a fine — you are facing a reprimand that becomes public.

CCTV dos and don’ts:

✅ Place visible signage at every entrance stating that CCTV is in operation, the purpose, and who to contact for more information
✅ Limit retention to 30 days or less; document the justification if you go longer
✅ Restrict access to footage to named individuals (owner, security lead) only
❌ Never install cameras in changing rooms, toilets, or shower areas — this is an absolute prohibition and a criminal matter in most jurisdictions
❌ Do not use CCTV footage for purposes beyond security (e.g., monitoring staff performance) without a separate lawful basis

Sample entrance signage text:

Biometric access systems are the highest-risk technology a gym can deploy. Under Dutch DPA guidance on biometrics, consent for biometric processing may be considered coerced if the biometric option is the only way to access the facility. That means you must offer a non-biometric alternative — a key fob, PIN, or app-based QR code — and make it genuinely accessible, not buried in a form. Biometric door access also requires both a valid Article 6 lawful basis and a valid Article 9 condition, and you must run a DPIA before deploying the system.

Gym biometric door access and key fob alternative

Fitness apps, wearables, and integrations: permissions, syncing, and data sharing

Wearable integrations and third-party coaching apps are increasingly standard in modern gyms. They are also a data-flow minefield if you have not mapped what data moves where.

Common integration scenarios and their risks:

Wearable sync (Garmin, Apple Watch, Fitbit): Heart rate, sleep, and activity data flows from the device to your platform. This is likely health data under Article 9 if it reveals a health condition.
Third-party coaching apps: If a member’s performance data is shared with an external coaching platform, that platform becomes a processor or a separate controller — both require documentation.
Nutrition and meal plan tools: Dietary data can reveal religious beliefs or health conditions, both of which are special-category data.

Integration compliance checklist:

✅ Map every data flow: what data, from where, to where, and for how long
✅ Capture explicit consent before enabling any wearable or third-party app sync
✅ Verify the third-party vendor has a signed DPA or is operating as a separate controller with its own privacy notice
✅ Confirm the vendor’s deletion process: when a member disconnects, does their data actually get deleted?
✅ Review access controls: can your staff see raw wearable data, or only aggregated summaries?

Sample consent phrase for wearable linking:

Memberships for minors: parental consent and age verification

Processing data for members under 16 (the default GDPR threshold, though member states can lower it to 13) requires verifiable parental or guardian consent. “Verifiable” is the operative word — a checkbox ticked by the child does not count.

Practical steps for junior memberships:

Collect a signed parental consent form at enrollment, naming the parent or guardian and their relationship to the child
Record the date consent was given and the parent’s contact details
Verify age at sign-up — a copy of a birth certificate or student ID is reasonable
Store parental consent records for the duration of the junior membership plus your standard retention period
When a junior member turns 16 (or the applicable local age), re-obtain consent directly from them

Short parental consent template pattern:

For school partnership programs, treat the school as a separate data controller. Any data sharing between your gym and a school requires a data sharing agreement, and you should not rely on the school’s consent as a substitute for direct parental consent for your own processing.

When to run a DPIA and how to keep your Records of Processing Activities

GDPR requires organizations to demonstrate compliance through records of processing activities, data protection by design and default, and DPIAs where processing is likely to result in high risk to individuals’ rights and freedoms. For gyms, that threshold is reached more often than operators expect.

DPIA triggers for gyms:

Deploying biometric access control (fingerprint, palm, facial recognition)
Large-scale processing of health data (PAR-Qs, medical notes across hundreds or thousands of members)
Systematic monitoring of members (attendance tracking combined with behavioral profiling)
Combining datasets in ways members would not expect (linking wearable data with payment behavior)
Introducing a new loyalty or rewards program that involves profiling

RoPA fields every gym should maintain:

RoPA fieldExample entry for PAR-Q processing

Purpose of processing

Health screening to ensure safe training

Categories of data

Health data (PAR-Q answers, medical notes)

Categories of data subjects

Gym members

Lawful basis (Article 6)

Consent

Article 9 condition

Explicit consent

Retention period

Duration of membership + 3 years

Security measures

Encrypted storage; access restricted to assigned trainers

Processors

[CRM vendor name]; DPA signed [date]

DPIA checklist steps:

Describe the processing operation and its purpose
Assess necessity and proportionality — is there a less privacy-invasive way to achieve the same goal?
Identify risks to data subjects (unauthorized access, data breach, discrimination)
Document mitigation measures (encryption, access controls, consent process)
Consult your supervisory authority if residual risk remains high after mitigation

A Data Protection Officer is only mandatory where core activities involve large-scale processing of special categories of data or systematic monitoring. Many independent gyms will not meet this threshold, but appointing a responsible person internally — someone who owns the compliance function — is good practice regardless.

Data breach basics and notification obligations for gyms

A data breach is not just a hacker attack. A lost USB drive containing PAR-Q forms, an email sent to the wrong member list, or an unlocked filing cabinet accessed by an unauthorized person all qualify.

Immediate incident response steps:

Contain: Stop the breach from spreading — revoke access, take a system offline if needed, secure physical files
Assess: Determine what data was affected, how many people, and the likely harm (identity theft risk, health data exposure, financial data)
Notify internal stakeholders: Alert the owner, your designated compliance lead, and legal counsel within hours
Document: Record the nature of the breach, the data involved, the likely consequences, and the steps taken — this log is mandatory under GDPR Article 33(5)
Notify the supervisory authority: If the breach is likely to result in a risk to individuals’ rights and freedoms, notify within 72 hours of becoming aware of it
Notify affected members: If the breach is likely to result in a high risk to individuals, notify them directly without undue delay — no fixed deadline, but faster is always better

Most breaches involving health data will trigger supervisory authority notification. When in doubt, notify. Regulators treat voluntary, timely notification far more favorably than discovering you sat on a breach.

A 30–90–180 day GDPR compliance plan for gyms

ActionOwnerTimeline

Map all data flows and systems touching member data

Owner / Manager

30 days

Secure PAR-Q records (encrypt, restrict access)

Owner / IT lead

30 days

Confirm signed DPAs with all core vendors

Owner / Manager

30 days

Update privacy notice and separate marketing opt-ins

Owner

30 days

Run DPIA for biometrics or large-scale health data processing

Owner / Legal

90 days

Train all staff on data handling and breach response

Manager

90 days

Adopt and document retention schedules

Manager

90 days

Start logging RoPA entries for all processing activities

Owner / IT lead

90 days

Test incident response process with a tabletop exercise

Owner / Manager

180 days

Review biometric and CCTV setup against current guidance

Owner / IT lead

180 days

Consider ISO 27001 or formal compliance audit

Owner

180 days

30-day priorities in plain terms:

Lock down health data storage — encrypted, access-controlled, off the shared drive
Call your CRM, booking, and payment vendors and ask for their signed DPA
Rewrite your sign-up form so marketing consent is a separate, unticked checkbox
Publish a plain-language privacy notice on your website and at your front desk

Practical templates and example wording gyms can copy

These snippets are starting points. Adapt them to your specific processing activities and have a local data protection lawyer review before use.

Privacy notice snippet for new member onboarding:

Explicit consent for biometric enrollment:

DPA minimum checklist — what to request from every vendor:

✅ Written DPA referencing GDPR Article 28
✅ Data storage location (EU/EEA or adequacy country)
✅ Sub-processor list and change notification process
✅ 72-hour breach notification commitment
✅ Deletion/return of data on contract termination
✅ Security measures (encryption, access controls, certifications)

DPIA template outline:

Processing description and purpose
Necessity and proportionality assessment
Risk identification (to data subjects)
Risk mitigation measures
Residual risk assessment
Supervisory authority consultation (if high residual risk)
Sign-off and review date

The EDPB’s SME guide includes free, downloadable templates for RoPA and DPIA that are well-suited to independent gym operators.

Pro Tip: Keep a “compliance folder” — one shared drive location with your RoPA, all signed DPAs, your privacy notice version history, staff training records, and DSAR logs. If a regulator ever contacts you, this folder is your first line of defense.

Handling data from trial memberships and cancellations

Trial members are data subjects with full GDPR rights from the moment they hand over their name and email. The fact that they never converted to a paying member does not reduce your obligations.

During a trial, collect only what you need to deliver the trial experience. If a trial member does not convert, you can retain their contact details for a short follow-up window (typically 30–90 days) under legitimate interests, provided you make this clear at sign-up and honor any opt-out immediately. After that window, delete or anonymize the record.

Cancellations are trickier. You can retain a former member’s data for as long as a legal or contractual claim could arise — typically six years in common-law jurisdictions. But retain only what you need for that purpose: billing records and the membership agreement, not PAR-Q forms or marketing preferences. Health data should be deleted promptly after the membership ends unless there is a specific safety or legal reason to keep it.

GDPR implications of loyalty programs and referral schemes

Loyalty programs and referral schemes involve profiling — tracking behavior to award points, trigger offers, or identify advocates. Profiling is a specific processing activity under GDPR that requires a clear lawful basis and transparency.

For a points-based loyalty program, legitimate interests can work if the program is genuinely optional and members are clearly told their purchase behavior is being tracked. For automated personalized offers based on behavioral profiling, consent is the safer basis. Either way, disclose the profiling in your privacy notice and give members a way to opt out without losing their core membership.

Referral schemes add a wrinkle: when a member refers a friend, you receive the friend’s personal data (name, email) from a third party. That friend is a data subject. You must inform them that you received their data and from whom, typically within one month of first contact. Referral program mechanics should include a step where the referred contact receives a clear first-contact message explaining who you are, how you got their details, and how to opt out.

Managing GDPR compliance for online booking systems and gym apps

Your booking system and member app are likely your highest-volume data collection points. Every session booked, every class attended, and every push notification sent involves personal data processing.

For online booking, the lawful basis is typically contract performance — the member booked a class and you need their data to deliver it. The compliance risk is in what else you do with that data: using booking history for marketing profiling, sharing it with third-party analytics tools, or retaining it indefinitely.

For gym apps, your

creates data collection points that many operators overlook: device identifiers, location data (if enabled), push notification consent, and in-app purchase history. Each of these requires a lawful basis, and location data in particular needs explicit consent.

Booking and app compliance checklist:

✅ Privacy notice linked prominently in the app and on the booking page
✅ Cookie consent banner on the web booking portal (if using analytics or marketing cookies)
✅ Separate consent for push notifications — do not bundle with app download
✅ Confirm your booking platform vendor has a signed DPA
✅ Map what data the app sends to third-party analytics tools (Google Analytics, Firebase) and whether those flows are disclosed
✅ Provide members with an in-app way to request data deletion

What gym operators get wrong about GDPR (and what actually matters)

Most gym operators approach GDPR as a paperwork exercise — update the privacy policy, add a cookie banner, done. That instinct is understandable given the operational demands of running a facility, but it misses where regulators actually look.

The enforcement record in the fitness sector points to two recurring failures: marketing consent and health data handling. The Swedish IMY action against a fitness group was not about a data breach or a hacker. It was about a marketing opt-out that was not visible enough at first contact. That is a process failure, not a technical one, and it is entirely preventable.

The second thing operators underestimate is the value of documentation. A gym that has a slightly imperfect privacy notice but can produce a signed RoPA, vendor DPAs, staff training records, and a DSAR log is in a far stronger position with a regulator than one with a polished privacy page and nothing behind it. Demonstrable compliance — the ability to show your work — is what GDPR accountability actually means. The documentation is the compliance.

Seasonal hiring adds a real operational wrinkle. Summer staff and temporary trainers often get system access that never gets revoked. Build access revocation into your offboarding checklist the same way you would a key return. One former employee with active CRM access is a breach waiting to happen.

Privacy practices, done well, also build member trust. Members who know their health data is handled carefully are more likely to share it accurately — which makes your training programs better and your liability lower.

Joinfitnessflow handles the operational side of GDPR compliance

Keeping member records accurate, access-controlled, and auditable is significantly easier when everything lives in one system. Joinfitnessflow centralizes member data, consent capture, billing records, and role-based staff access in a single platform built for independent and mid-sized gyms.

Role-based permissions mean your front desk staff see what they need and nothing more — PAR-Q records stay visible only to trainers and owners. Built-in consent capture at sign-up separates marketing opt-ins from membership terms automatically. Audit logs track who accessed which records and when, which is exactly what a regulator wants to see during an investigation. For multi-location operators, cross-location reporting keeps compliance oversight consistent across every site.

Joinfitnessflow is not a substitute for a signed DPA or legal advice — verify any vendor’s security documentation before you rely on it. But as the operational layer where member data actually lives, it reduces the manual compliance burden considerably. See how it works or book a demo to walk through the compliance features with the team.

Sources

These are the primary legal texts and regulator resources used to build this guide. Primary law takes precedence over guidance; guidance documents interpret the law but are not binding in the same way.

Primary law:

Regulator guidance:

Enforcement example:

Sector commentary:

This guide is general information, not legal advice. GDPR obligations vary by jurisdiction and business circumstances. Confirm your specific compliance requirements with a qualified data protection lawyer or your national supervisory authority.

FAQ

Does GDPR apply to gyms outside the EU?

Yes. GDPR applies to any organization that processes personal data of individuals residing in the EU or offers services to EU residents, regardless of where the business is based.

What are the main GDPR requirements for a gym?

The core obligations are: a lawful basis for every processing activity, explicit consent for health data, a privacy notice, a Record of Processing Activities, signed DPAs with vendors, a breach notification process, and a way to honor member rights requests within one month.

What can’t a gym do under GDPR?

A gym cannot process health data without explicit consent, install CCTV in changing rooms, bundle marketing consent into the membership contract, or ignore a member’s request to delete their data without a documented legal reason to retain it.

What businesses are subject to GDPR?

Any business that processes personal data of EU or EEA residents is subject to GDPR, including gyms, studios, and fitness apps operating outside the EU if they serve EU members.

Is GDPR compliance mandatory in the US?

GDPR itself is EU law and is not directly enforced by US authorities. However, a US-based gym that accepts EU members or runs online services for EU residents must comply with GDPR or risk enforcement action by EU supervisory authorities, including fines.

GDPR for Gyms: A Practical Compliance Guide for Fitness Operators