Data protection
at your gym

1. The entrance: better without fingerprints or faces

• It’s specially protected data. Fingerprints or faces that identify a person are prohibited by default (GDPR, art. 9).
• What the Agency requires. Outside the workplace, consent has to be freely given, and the gym has to offer another way in to anyone who doesn’t want it, with no consequences; and it must also show there is no lower-risk alternative (AEPD guide on biometrics, 2023). If there’s an equally good alternative, biometrics are unnecessary.
• The fines. €27,000 to a gym in Santander for requiring fingerprints with no alternative and cancelling the membership of the member who refused (PS/00413/2022), and €160,000, reduced to €96,000, to a chain for using face recognition as the only way in, with an order to stop using it (PS/00289/2024).

2. Cameras

• One month at most. In Spain, footage is deleted within a month, unless it shows an attack on people, property or premises; then it is handed to the authorities within 72 hours (Spanish Data Protection Act (LOPDGDD), art. 22).
• The sign. In a clearly visible place, saying that recording is taking place, who is responsible and how to exercise your rights. The Agency has a template (AEPD video surveillance guide, 2025).
• Never in changing rooms or toilets. At pools and spas, only the common areas (video surveillance guide, 3.9). If an outside company views the footage, you need a contract with it.

3. Health data and minors

• Health, with explicit consent. Injuries, illnesses or a health questionnaire are a special category: you need the member’s explicit consent for a specific purpose (GDPR, art. 9.2.a) and to ask only for what’s necessary (art. 5.1.c).
• Under 14, with their parents. In Spain, from 14 they consent themselves; below that age, their parents or guardians do (LOPDGDD, art. 7).

4. Photos and videos on social media

Filming a class and posting it with recognizable members requires their consent. The Agency fined a gym chain €36,000, which became €21,600 after it paid and admitted the facts, for filming classes and sharing the images without valid consent (PS/00021/2025). Ask for permission in writing, or film without faces.

5. Promotions by WhatsApp or email

In Spain, without prior permission they are prohibited. The exception is your members, with services of yours similar to the ones they already have; even then, you have to offer them a simple, free way to opt out when you collect their details and in every message (Spanish Information Society Services Act (LSSI), art. 21).

6. The paperwork

• A contract with your providers. Whoever stores data for you —your gym management software, the camera company— needs a data processing agreement (GDPR, art. 28). Ask them for it.
• The record of processing activities. With fewer than 250 employees it isn’t mandatory, unless the processing is not occasional or includes health or biometric data (art. 30.5). At a gym, it will normally be needed.
• If there’s a breach —stolen data, a lost computer—, you notify the Agency within 72 hours at most from when you find out, unless it’s unlikely to result in a risk (art. 33).

Frequently asked questions