# CCTV in a Gym: Where Cameras Can Go, Notices and Footage Rules > CCTV in a gym: cameras on the floor and entrance are fine, never in changing rooms or toilets (BNS s.77). DPDP notice, signs, retention and police requests. - URL: https://www.mygymgate.com/blog/gym-cctv-rules/ - Category: Operations - Published: 2026-10-26 - Publisher: MyGymGate (https://www.mygymgate.com) **CCTV in a gym is legal and normal on the workout floor, at the entrance, at reception and in the parking area, but never inside changing rooms, showers or toilets.** Filming a woman undressing or using a lavatory is voyeurism under [section 77 of the Bharatiya Nyaya Sanhita](https://prsindia.org/files/bills_acts/bills_parliament/2023/The%20Bharatiya%20Nyaya%20Sanhita,%202023.pdf), with one to three years in prison for a first conviction. Beyond placement, treat footage as member data: put up a notice, say why you record, limit who can view it, delete it on a fixed cycle, and hand it to police only on a written request. Most owners install cameras after a theft or a dispute. That's fine, but a few minutes of planning now saves you from the two real risks: a camera in the wrong place, and footage in the wrong hands. Rules here are as of October 2026; for anything specific to your premises, check with a lawyer. ## Where can cameras go, and where can't they? | Area | Camera? | Notes | |---|---|---| | Entrance and exit | Yes | Best single camera you'll install: faces of everyone entering | | Reception and cash counter | Yes | Covers payments, cash handovers and disputes at the desk | | Workout floor | Yes | Wide angles for safety and theft; no zooming on individuals | | Corridor outside changing rooms | Yes, carefully | Point it along the corridor, not into the doorway when the door opens | | Locker area | Only if fully separate from changing | If people change there, it counts as a changing area | | Changing rooms, showers, toilets | Never | Men's and women's both | | Group class studio | Yes, with a notice | Some members will ask; tell them before the class | | PT or assessment room | Think twice | Body measurements and form checks are personal | | Staff rest room | No | Staff have a reasonable expectation of privacy there | The corridor camera is the one people get wrong. If it catches the inside of the women's changing room every time the door swings open, you've built the problem you were trying to avoid. Test the angle with the door open before you fix the bracket. ## What does the law say about changing rooms and toilets? Section 77 of the BNS makes it an offence to watch or capture the image of a woman "engaging in a private act" where she would usually expect not to be observed, or to share such an image. The explanation says a private act includes being in a place that would reasonably be expected to provide privacy where the person is undressed or in underwear, or using a lavatory. A first conviction carries one to three years and a fine; a repeat conviction, three to seven years. The BNS came into force on [1 July 2024](https://www.newsonair.gov.in/three-new-criminal-laws-come-into-force), and section 77 is the [successor to section 354C of the Indian Penal Code](https://drishtijudiciary.com/current-affairs/no-voyeurism-for-non-private-act-filming). Men are protected too. [Section 66E of the Information Technology Act](https://prsindia.org/files/bills_acts/bills_parliament/2021/IT%20Act,%202000.pdf) punishes anyone who captures, publishes or transmits an image of a private area of **any person** without consent, in circumstances that violate their privacy, with up to three years in prison, a fine of up to ₹2 lakh, or both. There's no "security" exception in either section. A notice on the wall doesn't make a changing-room camera lawful. The rule is simple: no lens anywhere people undress. Our guide to [gym locker room management](/blog/gym-locker-room-management/) covers the rest of the changing-room set-up, including phone-photography signs. ## Does the DPDP Act apply to CCTV footage? Yes. The [Digital Personal Data Protection Act, 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) applies to personal data in digital form, and a DVR full of identifiable faces is exactly that. The [DPDP Rules, 2025](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) were published on 13 November 2025, and most of the duties (notice, security, member rights) start 18 months later, in **May 2027**. Our [member data privacy guide](/blog/gym-member-data-privacy-india/) has the full timeline. What it means for cameras: - **Purpose.** Decide and write down why you record: safety of members and staff, preventing theft, and resolving disputes. Use footage only for that. - **Notice.** Rule 3 says a notice must give an itemised description of the data and the specific purpose, in clear language, plus how to withdraw consent, exercise rights and complain to the Data Protection Board. Put a CCTV line in your joining form's privacy notice, not just on a wall sign. - **Staff.** Section 7(i) allows processing "for the purposes of employment" and to safeguard the employer from loss or liability. Still mention cameras in the appointment letter so nobody is surprised. - **Security.** Rule 6 asks for access controls and logs that show who accessed the data. For a gym, that means a password on the DVR and the phone app, and a short register of who viewed what and why. The Act doesn't mention CCTV by name, so whether members' footage rests on consent or on a "legitimate use" isn't spelled out. The safe course is to treat it as consent-based: notice in the joining form, a tick box, and signs at the door. Confirm with a lawyer for your set-up. ## What should the CCTV sign say? India has no prescribed wording for a private gym. The UK regulator's [CCTV guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/how-can-we-comply-with-the-data-protection-principles-when-using-surveillance-systems/) is a sensible model: place signs before people enter the camera's view, and say who runs the system, why, and how to contact them. Something like: > CCTV in operation on the gym floor, entrance and reception for the safety of members and staff and to prevent theft. There are no cameras in changing rooms, showers or toilets. Footage is kept for 30 days. Questions: manager, [phone/email]. Put one at the entrance, one on the floor, and one in the class studio. The line about changing rooms does a lot of work: it answers the question many women members won't ask out loud. ## How long should you keep the footage? There's no single national retention period for gym CCTV, so set one and stick to it. - **State safety laws.** Some states set one for busy premises. Karnataka's [Public Safety (Measures) Enforcement Act, 2017](https://www.casemine.com/act/in/5ed4fb12894ef23297d8bd7a) applies to places likely to see 100 people at a time or 500 a day, and requires footage to be stored for 30 days and produced when the jurisdictional police inspector asks. A busy gym can cross 500 visits a day, so check with your local station. - **DPDP Act.** [Section 8(7)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) says erase personal data once the purpose is no longer served, unless a law requires you to keep it. - **DPDP Rules.** Rule 8(3) also requires keeping personal data, traffic data and logs of processing for at least one year, for purposes listed in the Rules' Seventh Schedule. How that applies to a DVR that overwrites itself every few weeks isn't settled. Confirm with a lawyer before May 2027. In practice, many owners set the DVR to a fixed cycle such as 30 days, which also matches the Karnataka rule. Pick the period on purpose, not by whatever the hard disk happens to hold; the ICO guidance makes the same point. When there's an incident, export that clip and keep it separately until the matter is closed. ## Who should be allowed to view the footage? Fewer people than you think. A good default: - **Owner and one manager** can view recordings. Trainers and front-desk staff see the live screen at the desk only if they need it for safety. - **No browsing.** Footage is pulled for a reason: a theft, an injury, a complaint. Note the date, time, who viewed it and why. - **No forwarding.** No clips in staff WhatsApp groups, no screenshots on Instagram, no "look who's cheating on their diet" jokes. This is the fastest way to lose a member's trust and, from 2027, a likely breach of your own stated purpose. - **Remote app.** If the DVR app is on your phone, use a strong password and two-step login, and remove ex-staff the day they leave. This matters for the [POSH Act](/blog/posh-act-gym/) as well. Footage from the floor can help an Internal Committee inquiry, and a gym where only two people can view it can say so with confidence. ## What do you do when the police ask for footage? Under [section 94 of the Bharatiya Nagarik Suraksha Sanhita](https://prsindia.org/files/bills_acts/bills_parliament/2023/The%20Bharatiya%20Nagarik%20Suraksha%20Sanhita,%202023.pdf), a court or the officer in charge of a police station can, by written order (physical or electronic), require you to produce a document or device likely to contain digital evidence. The DPDP Act's [section 17(1)(c)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) exempts processing for preventing, detecting or investigating offences from most of its duties. 1. Ask for the request in writing, with the officer's name, station and the date range. 2. Export only that window, not the whole disk. 3. Keep a copy and note what you handed over, to whom and when. 4. If the footage may go to court, the police may ask for a certificate under section 63 of the Bharatiya Sakshya Adhiniyam (the old section 65B certificate). [LiveLaw explains](https://www.livelaw.in/articles/bharatiya-sakshya-adhiniyam-transformed-digital-evidence-552681) what it now involves. ## When a member asks to see the footage Usually it's about a missing phone or a disputed injury. The member is entitled to ask, and once the rights in the DPDP Act start in May 2027, section 11 gives them the right to a summary of the personal data you hold about them. The difficulty is that most clips show other members too. A fair approach: preserve the clip straight away, offer to review it together at the desk, and if it's a theft, suggest a police complaint so the footage goes to them under a written request. Don't hand an unedited copy to one member that shows twenty others. If you use QR check-in, the visit log narrows the search: MyGymGate's attendance log shows who checked in and when, so you can jump straight to the right ten minutes of footage. ## Quick checklist - [ ] No camera inside changing rooms, showers or toilets; corridor camera angle tested with the door open - [ ] Audio recording switched off - [ ] Signs at the entrance, floor and studio, including "no cameras in changing rooms" - [ ] CCTV line in the joining form's privacy notice and staff appointment letters - [ ] Fixed retention cycle set on the DVR (and checked against your state's rules) - [ ] Viewing limited to owner and one manager, with a simple viewing register - [ ] Strong passwords and two-step login on the DVR app; ex-staff removed - [ ] Written request required before footage goes to police - [ ] Incident clips exported and stored until the matter closes ## Useful links - [Bharatiya Nyaya Sanhita, 2023](https://prsindia.org/files/bills_acts/bills_parliament/2023/The%20Bharatiya%20Nyaya%20Sanhita,%202023.pdf) (section 77, voyeurism) - [Information Technology Act, 2000](https://prsindia.org/files/bills_acts/bills_parliament/2021/IT%20Act,%202000.pdf) (section 66E) - [Digital Personal Data Protection Act, 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) and [DPDP Rules, 2025](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) - [Bharatiya Nagarik Suraksha Sanhita, 2023](https://prsindia.org/files/bills_acts/bills_parliament/2023/The%20Bharatiya%20Nagarik%20Suraksha%20Sanhita,%202023.pdf) (section 94) - [Karnataka Public Safety (Measures) Enforcement Act, 2017](https://www.casemine.com/act/in/5ed4fb12894ef23297d8bd7a) - [ICO guidance on video surveillance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/how-can-we-comply-with-the-data-protection-principles-when-using-surveillance-systems/) (UK good practice) ## Frequently asked questions ### Is CCTV compulsory for a gym in India? There's no national rule that every gym must have CCTV. Some states have public safety laws that do require it for busy establishments; Karnataka's 2017 Act, for example, covers places likely to see 100 people at a time or 500 a day and requires footage to be stored for 30 days. Ask your local police station whether your gym is covered. ### Can a gym owner share CCTV clips on WhatsApp? Avoid it. A clip of members is personal data, and forwarding it to staff groups or posting it to shame someone goes well beyond the security purpose you told members about. Share footage only with the police on a written request, or with the member concerned where it doesn't expose others. ### Can gym CCTV record audio? Leave audio off. Members talk to trainers about injuries, health and money, and recording conversations is far more intrusive than video. The UK data regulator's CCTV guidance says audio recording should be switched off by default, and there's no good security reason to need it on a gym floor. ### Does a gym have to give a member a copy of CCTV footage? Not necessarily a copy. Once the DPDP Act's rights take effect in May 2027, a member can ask for a summary of the personal data you hold about them. Footage usually shows other members too, so offer a supervised viewing at the desk or preserve the clip for the police rather than handing over an unedited copy.