No software makes a gym privacy compliant on its own. Under India's Digital Personal Data Protection Act, 2023, your gym is responsible for member data, and it stays responsible even for the processing a software vendor does for it. Good software helps you meet your duties, for example by limiting which staff can open member records. What the law asks of you, though, stays with the gym: a clear notice before you collect data, reasonable security, deletion when the purpose ends and a plan for breaches.
Most business duties under the DPDP Rules, 2025 start from May 2027. The sections below cover the duties, a checklist, your vendor contract and GDPR.
Who is responsible for member data under the DPDP Act, and from when?
Your gym is responsible, not the software vendor. In the Act's terms your gym is the Data Fiduciary, the business that decides why and how member data is processed (section 2(i)), and the vendor is a Data Processor, which processes member data on your gym's behalf.
Section 8(1) keeps a Data Fiduciary responsible for complying with the Act "in respect of any processing undertaken by it or on its behalf by a Data Processor", and it does so "irrespective of any agreement to the contrary". A clause in a vendor's terms can't shift the duty off your gym. Section 8(2) also says you may use a Data Processor "only under a valid contract".
Section 3 also covers personal data collected on paper and digitised later, such as an admission form the front desk types into your software.
When do the rules start?
| Official text | Key date | Source |
|---|---|---|
| Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) | Enacted on 11 August 2023 | MeitY PDF |
| DPDP Rules, 2025 (G.S.R. 846(E)) | Notified on 13 November 2025 | MeitY PDF |
Rules 3, 5 to 16, 22 and 23 apply eighteen months after publication. That group covers notice, security, breach intimation, retention, erasure, children and grievances, so the date to plan around is May 2027.
What are the penalties?
The Schedule to the Act sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to notify a breach, ₹200 crore for breaching the obligations about children and ₹50 crore for breaching any other provision. The Data Protection Board decides the actual amount.
What member data does a typical Indian gym hold?
A typical gym holds contact details, payments, attendance, biometric data and health notes across paper, software and staff phones.
| Data | Where it sits | What to watch |
|---|---|---|
| Name, phone, address, emergency contact | Admission form, software, WhatsApp | Old forms, numbers saved on staff phones |
| Payments and dues | Software, payment gateway, cash book | Who can see what each member owes |
| Attendance | Software, QR check-in, biometric device | It shows a member's routine, so limit exports |
| Fingerprints and face data | Biometric device at the entrance | Notice, consent and removal when a member leaves |
| Health notes, photos, measurements | Assessment forms, trainer phones | Ask only what trainers need |
| Under-18 members | Junior batches, teenage members | Parent or guardian consent (section 9) |
Fingerprints and face scans
Biometric data such as fingerprints and face scans is personal data like any other under the DPDP Act, which has no separate "sensitive" category. Until the Act's changes take effect, though, the IT Act's rules on sensitive personal data, which include biometric information, still matter. Check with your lawyer which rules apply to biometric data today.
Two habits help either way: remove a member's fingerprint or face record from the device when they leave for good, and offer QR check-in to anyone who prefers not to give one. See also why gyms switch to biometric attendance.
What does the DPDP Act ask a gym to do?
It asks for six things: a notice, security, erasure when the purpose ends, breach reporting, answers to members' requests and care with children's data.
Give a notice before asking for consent
Section 5 requires a notice before you ask for consent, saying what personal data you collect and why, how members can exercise their rights and how they can complain to the Data Protection Board. Rule 3 requires the notice to itemise the data, and withdrawing consent must be about as easy as giving it. If members consent with a tick, let them withdraw with a tick or a WhatsApp message.
Keep member data secure
Section 8(5) requires reasonable security safeguards to prevent a personal data breach. Rule 6 lists the minimum:
- securing data, for example by encryption, obfuscation or masking;
- controlling access;
- logs to detect unauthorised access;
- backups so processing can continue;
- keeping those logs and the personal data for one year;
- a security clause in your contract with the Data Processor.
For access control, check today that no trainer who left after Diwali still has a login.
Erase data when the purpose ends
Under section 8(7), you must erase personal data when a member withdraws consent, or once it's reasonable to assume the purpose is no longer being served, whichever is earlier, and make your Data Processor erase it too. Data another law requires you to keep is the exception. Because Rule 6 also asks for logs and personal data to be kept for one year, set retention periods with your lawyer.
Report breaches without delay
Once you become aware of a personal data breach, Rule 7(1) requires you to tell each affected member without delay, and Rule 7(2) requires you to tell the Data Protection Board without delay and send detailed information within 72 hours of becoming aware. Plan for ordinary incidents too, such as a lost front desk phone or a trainer who leaves with an exported member list.
Answer member requests
Members can ask for a summary of their personal data (section 11), correction and erasure (section 12) and grievance redressal (section 13), which they must use before going to the Board. They can also nominate someone to act for them on death or incapacity (section 14). Rule 14 caps your grievance response time at 90 days.
Take extra care with under-18 members
The Act treats anyone under eighteen as a child (section 2(f)). Under section 9, processing a child's data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising aimed at children are not allowed. For junior batches and teenage members, ask your lawyer what makes a parent's consent verifiable, and keep them out of targeted offers.
What should your gym do before May 2027?
Start with the data map and the notice, then work down the list.
- Map your member data using the table above, plus extras like a drawer of old forms.
- Rewrite the consent notice to meet section 5 and Rule 3 (sample below).
- Collect less. If nobody reads "occupation" or "marital status", stop asking.
- Give staff access by role. Decide what the front desk, trainers and managers each need to see, and remove logins on a staff member's last day. Managing gym staff roles and access covers giving each role its own login.
- Set erasure rules for inactive members' profiles, photos and biometric records, and review them every quarter.
- Write a one-page breach plan: who decides it's a breach, who tells members, and who sends the Board detailed information within 72 hours (Rule 7).
- Name a grievance contact on the notice and log every request.
Example: a short notice for your admission form
Illustrative wording only. Have a lawyer review yours.
[Gym name] collects your name, phone number, emergency contact, payments and check-ins, and your fingerprint or face data if you choose biometric check-in. We use these to run your membership and send reminders on WhatsApp. To get a summary of your data, correct or erase it, withdraw consent or raise a grievance, message [name] at [phone or email] or use [website or app link]. If we don't resolve your grievance, you can complain to the Data Protection Board at [Board link].
What should your contract with a gym software vendor say?
Ask for the five clauses below, and have them in the signed contract before any member data goes in.
| Clause | What it should say | Why |
|---|---|---|
| Parties | The vendor's registered legal entity, not just a brand name | You know who you signed with |
| Security | Safeguards, access control, logs and backups | Section 8(5) and Rule 6 |
| Breach notice | The vendor tells you promptly about any breach | Your Rule 7 clock starts when you become aware |
| Export | Members and memberships exportable at any time, in a usable format | Your fallback if the vendor closes |
| Return and erasure | Data returned and the vendor's copy erased, confirmed in writing | Section 8(7) |
What happens to your data if the vendor shuts down?
No provision of the DPDP Act or Rules deals specifically with a software company shutting down. Beyond the Parties, Export, and Return and erasure clauses above, keep your own records. First, keep a monthly export of members and memberships (with end dates and dues) where only the owner can open it; our guide to switching gym management software lists what to include.
Second, take online payments through your own payment gateway account, so the records don't depend on the vendor. If you're comparing software now, MyGymDesk is our recommended choice for Indian gyms: members pay through the gym's own Razorpay account, so each online payment is recorded in your own account.
Security questions to ask any vendor
Ask in writing and file the answers with the contract:
- Where are fingerprint and face templates stored, and deleted when a member leaves?
- Can we limit staff access by role and by branch?
- Do logs show who opened or exported member data?
- Can staff export the member list from their phones?
- How fast will you tell us about a breach?
Does GDPR apply to a gym in India?
GDPR generally doesn't apply to a gym in India serving local members. Under Article 3(2), GDPR applies to a business outside the EU only when it offers goods or services to people in the EU, or monitors their behaviour there. The European Commission says a non-EU company that doesn't specifically target people in the EU is not subject to GDPR. A gym selling online coaching or Zoom PT to clients in the EU should take advice.
This is general information, not legal advice. Confirm how the law applies to your gym with a lawyer.
FAQs
Is gym management software GDPR and privacy compliant?
Gym management software can't be compliant on a gym's behalf, because under India's DPDP Act the gym is the Data Fiduciary and answers for processing its vendor does (section 8(1)). Software can help, for example with staff access by role. GDPR generally applies to an Indian gym only if it offers services to, or monitors, people in the EU; confirm your position with a lawyer.
What happens to my data if a gym software company shuts down?
When a gym software company shuts down, a gym's protection comes from its contract and its own records, because no DPDP provision deals specifically with a vendor closing. A gym should keep monthly exports of members and memberships, take payments through its own gateway account, know the vendor's registered legal entity, and have a written return and deletion clause.
What security should gym software have for member data?
Gym software should help a gym meet the minimum security measures in Rule 6 of the DPDP Rules, 2025: securing data through encryption, obfuscation or masking, controlling access, keeping logs to detect unauthorised access, and backups. From May 2027, Rule 6 also requires a security clause in the gym's contract with its software vendor.
How MyGymDesk helps
MyGymDesk gives each staff member their own login with role-based permissions, limited to their branch, so the front desk, trainers and managers work inside the access you set. It is made by MyGymDesk Technologies Private Limited, Hyderabad, with email, ticket and phone support on every plan. Take the free trial, 7 days in India with no credit card required, or book a demo to see role-based staff logins for your branches.
