Yes, cameras in a gym are legal, but only with a specific written purpose, a lawful basis, signs before the monitored area, a short retention period, and never in changing rooms, showers or toilets. A camera is not mandatory. In a gym rented by the hour the booking record already tells you who had the room at any moment, and EU guidance names fitness facilities among places where people expect not to be watched. The sensible default: one camera on the entrance, none over the training floor, audio off, footage deleted automatically after a few days. This is general information, not legal advice.
Do you need a camera at all?
Start from the problem you want to solve.
What the booking record gives you: who booked the slot, when they paid and when their code was valid. A damaged bench at 19:05 belongs to the 18:00–19:00 booking or the 19:00–20:00 one, both named customers with phone numbers.
What a camera adds: evidence of what happened rather than who was there, a check on how many people came in on one booking, and some deterrence. Your insurer may ask whether you have one; see insurance and liability.
What it costs beyond hardware: a written purpose, signs, a retention routine, a way to answer access requests, and customers feeling watched while training. Regulators expect you to consider less intrusive options first; for an hourly gym those are the booking record and clear house rules.
Most private gym owners settle on a single camera on the entrance. It answers “how many people came in” and “was the door propped open” without filming anyone’s workout.
The rules in brief
The EU reference is the European Data Protection Board’s Guidelines 3/2019 on video devices. National authorities apply the GDPR within that frame and may add rules. What matters for a small gym:
- A specific purpose per camera, in writing. “For your safety” is not specific enough. Usable: “protecting the premises and equipment against damage and theft, and evidence of damage, at the entrance door”.
- A lawful basis. For a business, normally legitimate interest, which needs a balancing test: your interest in protecting property against the customer’s interest in not being filmed.
- Fitness facilities. The guidelines name them among places where people can expect not to be monitored. That is why a camera over the training floor is hard to justify and one at the door is easier.
- Less intrusive means first. If you can reach the purpose another way, the camera fails the necessity test.
- Impact assessment. Large-scale monitoring of a publicly accessible area needs a data protection impact assessment. A single door camera usually doesn’t, but check your authority’s list and write down your reasoning.
Where to put it, and where never to
Never: changing rooms, showers, toilets.
Default: the entrance, framed to show who comes in and leaves and nothing else, not the street, a neighbour’s door or the changing corner.
The training floor: only with a purpose that really needs it and a balancing test that explains why. Most single-room gyms don’t put one there.
Keep the camera separate from the booking system. Sparekey handles bookings, payments and door codes; footage stays on your camera’s recorder.
Signs and information for customers
Use two layers. First, a sign at eye level before the monitored area: why you film, who you are, how long footage is kept, that customers have rights, and where to find full information (a web address or QR code). Second, that full information, reachable without entering the filmed area, for example on your website.
The booking terms are the natural place for the second layer, since every customer accepts them before getting a code. Put the same short text on the house rules poster.
How long to keep footage
Damage is usually noticed within a day or two, so delete footage after a few days, ideally automatically. Beyond 72 hours you need more justification, and some countries set their own limits. Set the recorder to overwrite after a few days, write that period into your purpose document and on the sign, and export a clip only when something has happened.
Switch audio off
EU guidance lists audio among functions that must be off when not necessary, and in a gym it isn’t. Many cameras record sound by default. Turn it off before going live and check again after updates.
Who sees the footage, and access requests
Decide who can open the recorder and the app (usually only you), protect it with its own password, and write it down with the purpose, the area covered and the retention period. That page is your CCTV policy.
Anyone filmed can ask for footage of themselves. You normally have one month to respond and may ask for the date and time. Other people in the footage may need to be blurred. When something happens at the door, what can go wrong without staff says what to export. How Sparekey handles booking data is in security and GDPR.
FAQ
Is it legal to have cameras in a gym?
Yes, with a specific written purpose per camera, a lawful basis, signs, a short retention period, audio off, and no cameras in changing rooms, showers or toilets.
Do I need a camera in an unstaffed gym?
The GDPR doesn’t require one; check your insurer. With one booking at a time, the booking record already identifies who had each slot.
How long can I keep CCTV footage?
A few days in most cases, with automatic deletion. Beyond 72 hours needs more justification.
Can I record audio?
No. Switch it off before the camera goes live.
Do I need to tell customers before they book?
Yes. State the camera, its purpose, who you are and the retention period in your booking terms, and put a sign before the monitored area.