Gym Member Data Privacy in India: DPDP Act Guide for Owners
What the DPDP Act 2023 and DPDP Rules 2025 mean for gym member data privacy in India: consent, security, member rights and the May 2027 deadline.
Your gym is a "data fiduciary" under India's Digital Personal Data Protection Act, 2023 the moment you keep member details in digital form: a phone, Excel, software or WhatsApp. That means you need a clear notice and consent (or another lawful basis), reasonable security, a way for members to access, correct or erase their data, and a plan for reporting breaches. Most of these duties apply from May 2027 under the DPDP Rules, 2025, so there is time, but not much.
This guide explains the rules for a typical Indian gym as of October 2026. It is not legal advice. Please confirm your setup with a lawyer, especially your consent forms.
What member data does a gym actually hold?
More than most owners realise. Walk through your front desk and you will likely find:
- name, phone number, email, address, date of birth
- emergency contact (that is someone else's data too)
- ID proof photocopies or photos
- health questionnaires, injuries, medical conditions
- body measurements, weight, progress photos taken by trainers
- payment records, UPI IDs, plan history
- attendance logs, and possibly face or fingerprint data
- CCTV footage
Some of this is more sensitive than the rest. The 2011 SPDI Rules, which apply until the DPDP Act fully takes over, list health conditions, medical records, biometric information and financial details as "sensitive personal data", which needs written consent before collection. So your PAR-Q or health form deserves the most care.
Does the DPDP Act apply to a paper register?
Not while it stays on paper. Section 3 applies the Act to personal data collected in digital form, or collected on paper and "digitised subsequently". The moment you type the register into Excel, photograph it, or save numbers to a WhatsApp broadcast list, it is in scope. In practice almost every gym is. (If you are still weighing paper against software, see paper register vs Excel vs gym software.)
When do the rules kick in?
The DPDP Rules were notified in November 2025 and phase in over 18 months. Per the commencement summary from Shardul Amarchand Mangaldas:
| Phase | Date | What starts |
|---|---|---|
| 1 | November 2025 | Data Protection Board set up; definitions |
| 2 | November 2026 | Consent Manager registration |
| 3 | May 2027 | Notice, consent, security, breach reporting, member rights, penalties; Section 43A of the IT Act is removed |
MeitY proposed in January 2026 to shorten the runway to 12 months. As of an August 2026 legal update, that had not been notified and May 2027 remained the date. Keep an eye on it.
Until then, the SPDI Rules under Section 43A of the IT Act still apply, and they cover sole proprietorships and firms too.
What are your main obligations?
1. Have a lawful reason for each use
Under Section 4, you can process personal data either with consent or for a "legitimate use". The legitimate use most relevant to gyms is in Section 7(a): data the member gave you voluntarily for a specified purpose, where they have not objected. The Act's own example is a shop sending a payment receipt to the number a customer shared.
So a renewal reminder about a membership they bought is closer to that line. A Diwali offer to everyone who ever walked in is a separate purpose. Take clear consent for promotions and keep proof.
2. Give a proper notice
Consent must come with a notice (Section 5 and Rule 3) that stands on its own, uses plain language, lists the data item by item, states each purpose, and explains how to withdraw consent, use their rights and complain to the Board. Members must be able to read it in English or a language in the Eighth Schedule of the Constitution.
3. Ask only for what you need
Consent is valid only for data "necessary for such specified purpose" (Section 6(1)). Do you really need a full Aadhaar photocopy to sell a monthly plan? Many gyms can manage with a name, phone number and emergency contact. The less you hold, the less you have to protect.
4. Keep it secure
Rule 6 sets a minimum: encryption or masking, access control, logs that let you spot misuse, backups, and security terms in contracts with any vendor who processes data for you. It also says to retain those logs for one year.
5. Report breaches
From May 2027, if data leaks you must tell each affected member without delay, and tell the Data Protection Board, with a detailed report within 72 hours (Rule 7). A lost front-desk phone with member contacts on it could count.
6. Delete when the purpose ends
Section 8(7) requires erasure when consent is withdrawn or the purpose is no longer served, unless another law needs you to keep it. Separately, Rule 8(3) requires keeping data and processing logs for at least one year. Your accounts and GST records have their own retention rules, so work out a written retention schedule with your CA.
7. Publish a contact person
Rule 9 asks you to publish on your website or app the contact of someone who can answer members' questions about their data. For most gyms, that is the owner or manager.
What rights do members have?
| Right | Where it comes from | What you do |
|---|---|---|
| Access a summary of their data | Section 11 | Share what you hold and who you shared it with |
| Correct, update or erase | Section 12 | Fix or delete, unless law needs you to keep it |
| Grievance redressal | Section 13 | Respond within 90 days at most (Rule 14) |
| Nominate someone | Section 14 | Accept requests from the nominee |
| Withdraw consent | Section 6(4) | Make it as easy as giving it |
Members have duties too, such as not giving false information or filing frivolous complaints (Section 15).
Teenage members need extra care
A "child" under the Act is anyone under 18. You need verifiable consent from a parent or guardian before processing their data, and you must not track or behaviourally monitor children or target ads at them (Section 9). The Rules' exemptions cover categories like clinics and schools, not gyms. If you run a teens' batch, get parent consent in writing, keep their data minimal and ask your lawyer about attendance tracking and leaderboards.
What are the penalties?
The Schedule to the Act sets maximums. As summarised by PIB: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to report a breach or breaching obligations on children's data, and up to ₹50 crore for other breaches. These are ceilings, not fixed fines, and the Board decides the actual amount in each case. Still, the cheapest fix is always the one you make before a member complains.
Common gym habits worth fixing now
Honestly, for a small gym the everyday risks are less about hackers and more about habits.
- Everyone shares one login. Give each staff member their own access with only the permissions they need. Our guide to gym staff management covers roles.
- Member lists live on personal phones. When a trainer leaves, so does your contact list.
- Big WhatsApp groups. Adding members to a group can expose their numbers to everyone in it. Broadcasts or one-to-one messages are safer. See WhatsApp for gyms.
- ID photocopies in an open drawer. If you must keep them, lock them up or stop collecting them.
- Progress photos on a trainer's gallery. Keep them in a system the gym controls, with the member's consent.
- No deletion routine. Ex-members stay forever in every spreadsheet.
If you use face or fingerprint check-in, read our guide on face recognition attendance and consent before May 2027.
The short version
- List every place member data lives: forms, phones, Excel, software, WhatsApp, drawers.
- Cut what you do not need.
- Write one plain-language notice, in the languages your members read, and take consent for promotions separately.
- Give staff individual logins and lock down phones and files.
- Put security and deletion terms in writing with your software vendor.
- Publish a contact for data questions and answer requests within 90 days.
- Set a retention schedule with your CA and delete on schedule.
- Write a one-page breach plan with the 72-hour deadline in it.
- Get parent consent for under-18 members.
- Have a lawyer review your forms, and recheck the DPDP timeline before May 2027.
Frequently asked questions
Does the DPDP Act apply to a small gym?
Yes, if you hold member data in digital form. The Act does not set a size or turnover threshold. Section 17(3) lets the government exempt some classes of data fiduciaries from certain duties by notification, but that relief is partial and only applies if notified for your class.
When do gyms have to comply with the DPDP Act?
The core duties on notice, consent, security, breach reporting and member rights apply 18 months after the DPDP Rules were notified in November 2025, which is May 2027. A proposal to shorten this was discussed in early 2026 but had not been notified as of August 2026.
Can I send offers to members on WhatsApp without consent?
The Act lets you use data a member gave you voluntarily for the purpose they gave it, like sending a payment receipt. Promotional messages are a different purpose, so take clear consent for them and make opting out easy.
How long can a gym keep data of members who have left?
Only as long as the purpose needs it or another law requires it. The DPDP Rules also ask you to keep processing logs for at least one year. Tax and accounts records may need to be kept longer, so agree a retention schedule with your CA.
What is the penalty for a data breach under the DPDP Act?
Failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to notify a breach up to ₹200 crore. These are maximums; the Board decides the actual amount case by case.