Gym GDPR compliance: a practical checklist for gyms and studios

Write down every place member data lives: the gym software, spreadsheets, the email inbox, WhatsApp chats, paper forms in a drawer, the card terminal, the CCTV recorder and the backups. For each one, note what it holds, why, who can see it and how long it is kept. This list is the starting point for everything else, and most of your record of processing.

Every use of personal data needs a legal basis under Article 6. For a gym, running the membership usually rests on the contract, keeping invoices on a legal obligation, and CCTV for security on legitimate interest. Newsletters and photos on social media usually need consent.

Consent is not a catch-all. It is only valid if members can refuse it without losing their membership, so it belongs to the optional extras, not to the data you need to run the gym.

Medical certificates, health questionnaires such as PAR-Q forms and notes on injuries are data concerning health, a special category under Article 9. Processing them needs a legal basis and one of the conditions in Article 9(2), often explicit consent or a requirement in national law, so check the rules in your country.

Collect only what you need and limit who can see it. Often the type of certificate and its expiry date are enough, not a full medical history. In cronowiz Studio a certificate is recorded exactly like that, as its type and expiry date, with no file attached.

Article 13 requires you to tell people, when you collect their data:

• who you are and how to contact you
• what you collect, why, and on which legal basis
• who receives the data, such as software vendors and payment providers, and whether it leaves the EU
• how long you keep it
• their rights, and their right to complain to the supervisory authority

Article 30 asks for a written record of what you process, why, for whom and for how long. Organisations with fewer than 250 employees are exempt only if the processing is occasional and does not include special categories of data. A gym that keeps a member list all year, let alone medical certificates, is not occasional, so in practice it needs the record. Many national authorities publish a free template.

Any company that handles member data on your behalf is a processor under Article 28 and needs a written data processing agreement: cloud gym software, online booking, email and SMS tools, payroll, IT support, cloud storage for backups. Ask where their servers are: transfers outside the EU need the safeguards of Chapter V, such as an adequacy decision or standard contractual clauses.

With software that keeps data on your own computer, the gym software drops off that list. With cronowiz Studio member data stays in a file on the gym’s PC and never reaches us; the licence server only receives an anonymous fingerprint of the computer.

Article 32 asks for security appropriate to the risk. For a gym that means, at the least:

• a separate user account with a password on every computer, and a screen lock at the front desk
• operating system updates switched on
• disk encryption on laptops and on the front-desk PC: BitLocker on Windows, LUKS on Linux
• encrypted backups, kept off the computer, and a restore you have actually tested
• staff who know not to share passwords or forward member lists

Data cannot be kept for ever “just in case”. Decide how long you keep data on former members, certificates, CCTV footage and payment records, where tax law usually sets the minimum, then actually delete or anonymise what has expired.

In cronowiz Studio you can archive a member who stops coming, which keeps the history for the reports, or delete them, which removes the person with their certificates, memberships, bookings and appointments for good. Your retention policy decides which one applies, and when.

Members can ask to see their data, correct it, have it erased, object to marketing or take it elsewhere (Articles 15 to 22). You have one month to answer, extendable by two more for complex requests, and you cannot normally charge for it. Decide who handles requests, check the person’s identity, and know where to look: this is where the map from point 1 pays off.

Cameras for security usually rest on legitimate interest, but they come with rules. Put signs at the entrance, before people are filmed. Keep footage for as short a time as the purpose allows: European guidance says a few days in most cases. Restrict who can view it. And never film changing rooms, showers or toilets. National rules on filming staff may add further limits.

Photos and videos of members for the website or social media need their consent, and it must be as easy to withdraw as to give. Newsletters and promotional messages fall under national e-privacy rules too: consent is the safe default. Keep a note of who agreed to what, and when.

A stolen laptop, a lost USB stick with the backup, an email sent to all members with the addresses in plain view: these are personal data breaches. Document every one. If it is likely to put people at risk, report it to the supervisory authority within 72 hours of finding out (Article 33), and if the risk is high, tell the members concerned too (Article 34).

Encryption changes the picture: if a lost disk or backup is properly encrypted, the loss is often unlikely to put anyone at risk. That is the strongest argument for point 7. The Studio backup can be protected with a passphrase; see backup and new computer in the manual.

Fingerprint or facial recognition at the door is biometric data used to identify people, another special category under Article 9. Supervisory authorities expect a strong justification and an alternative for anyone who refuses. A QR card or a PIN avoids the question altogether, and it is how the offline check-in system in cronowiz Studio works.