Health clubs and leisure centres have evolved into some of the most data-intensive operations around, managing everything from direct debit mandates and CCTV footage to highly sensitive medical screening records (PAR-Qs).
But as new legislation takes effect, many operators are exposing hidden vulnerabilities in how they manage customer records.
In a featured article for HCM Magazine (Issue 6, 2026), Privacy Helper Managing Director Andy Chesterman warns that the commercial stakes for the fitness and wellness sector have dramatically escalated following the Data (Use and Access) Act receiving Royal Assent.
The £17.5m Reality Check: Under the updated regulations, penalties relating to the Privacy and Electronic Communications Regulations have skyrocketed. Fines can now reach up to £17.5 million, or 4% of global turnover, for serious breaches.
Complaints Don’t Always “Look” Like Complaints
One of the biggest practical hurdles for gyms and health clubs is recognising a data issue when it arises. As Andy points out, a member won’t always use formal terminology like “data protection complaint.” Instead, they are far more likely to ask front-desk staff or send a social media message asking:
“Why am I still receiving marketing emails after cancelling my membership?”
“Who has access to my medical screening form?”
“Why are my details still on file after I left?”
The New Burden of Proof
Since June 19th, the Information Commissioner’s Office (ICO) expects health clubs to handle data protection complaints internally first. If a query is escalated to the regulator, the ICO will demand to see hard evidence of how the complaint was investigated and handled.
To protect themselves from immense financial and reputational risk, operators must move away from “general reassurance” and ensure they can report on exactly what happened, who checked it and what decisions were made.
Read the Full Feature
Is your fitness or health club operation ready to withstand an ICO escalation?
View the full article here – Issue 6 of HCM Magazine – Page 82.
