For gyms, fitness studios, yoga centres and sports academies
DPDP compliance for gyms and fitness studios
Gyms collect more than a name and phone number: body measurements, health declarations, fingerprints at the door and transformation photos. ConsentKit gives members a clear choice for each, and keeps trainers’ access to data under control.
- Transformation photos
- Need consent
- Biometric entry
- Offer an alternative
- Full compliance
- 13 May 2027
Iron House Fitness asks for your consent
Choose how we may use your details. You can change this anytime.
Where the DPDP Act touches a membership
From the trial class to the lapsed-member call, pick a stage to see what you hold and what needs a choice.
What changes for your gym on 13 May 2027
The Act applies to every gym, studio and academy that holds member data digitally. These are the common gaps.
A clear notice at sign-upSections 5 and 6
Members should know what you collect and why, whether they join at the desk, on your site or through an app.
Sign-up notices for your website, app and a QR code at reception.
Photos and progress posts need consentSection 6
Using a member’s photo, name or results in marketing is a separate purpose.
A per-member photo consent your social team checks before posting.
Biometric entry needs careSection 8(5) and Rule 6
Fingerprint and face data need strong protection. Offering a card or app alternative keeps consent free.
Consent for biometric entry with a non-biometric option recorded.
Members under 18 need a parentSection 9
Junior programmes and sports academies need a parent’s verified consent.
Age check and parent verification at sign-up.
Members can ask for their dataSections 11 to 14
Members can request access, correction and erasure.
A simple request form and a queue with due dates.
Trainers and franchises are your responsibilitySection 8
Freelance trainers and franchise partners handling member data act on your behalf.
Role-based access and a register of who holds member data.
A plan for a busy gym
January is your biggest sign-up month. Get notices live before the New Year rush.
List your systems
Gym software, entry system, WhatsApp numbers, trainer apps and CCTV.
Notices before January
Put sign-up notices and photo consent live before the New Year rush.
Access and biometrics
Tighten trainer access and offer a non-biometric entry option.
Clean up
Delete lapsed-member data you don’t need and publish a contact.
For every kind of fitness business
Templates for your format.
Independent gyms
Set up in an afternoon.
Gym chains and franchises
Central policy with branch-level admins.
Yoga and pilates studios
Health declarations and class bookings.
CrossFit and boutique studios
Challenges, leaderboards and photos.
Sports academies
Mostly minors, parent consent built in.
Online fitness coaching
App and wearable data.
DPDP compliance for gyms near you
Local guidance and onboarding in these cities, with support from our team in Kolkata.
Related sectors
Questions gym owners are asking
For the full picture, read our DPDP Act guide or compliance checklist.
Does the DPDP Act apply to small gyms?
Yes. There is no size threshold. If you hold member data in software, on phones or in WhatsApp, you are a data fiduciary.
Can we post members’ transformation photos?
Only with each member’s consent for that use, and you must take them down if the member withdraws.
Can we use fingerprint entry?
Yes, with consent and strong security. Offering a card or app alternative avoids making biometrics a condition of membership.
Can trainers keep clients’ numbers?
Trainers act for the gym. Give them access through your system and remove it when they leave.
How long can we keep ex-members’ data?
Only as long as the purpose needs it, plus what accounting and tax law requires for invoices.
Get your gym ready before the January rush
The readiness check takes about ten minutes and gives you a practical gap report for your gym or studio.