Gym data protection checklist for UK owners

A gym holds more personal data than most small businesses: names, addresses, bank details, photos, access records, and often health information from joining forms. That makes data protection something you need to get right, not a box to tick. Here's a practical checklist. It isn't legal advice, but it covers what I see gyms miss.

Know what you hold

• List where member data lives: your booking system, payment provider, door access, CCTV, spreadsheets, email and paper forms.
• Health questionnaires (PAR Q and similar) count as sensitive data and need extra care.
• Photos for membership cards and CCTV footage are personal data too.

Register and tell people

• Most gyms need to pay the ICO data protection fee each year. Check you're registered and it's current.
• Have a privacy notice members can actually find, saying what you collect, why, and how long you keep it.

Lock down access

• Everyone logs in with their own account, never a shared one.
• Turn on MFA for email, your member system and anything holding payment data.
• When a trainer or front desk team member leaves, remove their access the same day.
• Laptops, tablets and phones that touch member data should be encrypted and set to lock.

Keep only what you need

• Decide how long you keep ex member records and CCTV, write it down, and delete on schedule.
• Don't keep old joining forms in a drawer or old exports on a laptop forever.

Be ready if it goes wrong

• A serious breach has to be reported to the ICO within 72 hours of you becoming aware of it, so know who does what before it happens.
• Keep backups, and test that you can actually restore from them.
• Check your contracts with suppliers who handle member data, such as your booking, payment and access providers.

Coach's tip: start with the first list. Most gyms are surprised how many places member data is sitting, and you can't protect what you don't know about.