In which areas of the gym can CCTV cameras be installed?

Only in areas where the security or access control purpose objectively justifies the installation and where there is no reinforced reasonable expectation of privacy on the part of the member or worker. Areas usually permitted: entrance and access control turnstile, reception and counter area, doors and evacuation corridors, car parks and outdoor premises, and, in justified cases, the general weights or cardio room where the security purpose supports it and the centre has analysed proportionality. Areas strictly prohibited under art. 89.1 LOPDGDD: changing rooms, showers, toilets, massage or physiotherapy rooms, medical or nutritional consultation rooms and any other space intended for staff rest or the member's intimate use. Installation requires visible signage, documented legal basis and description of the processing in the records of activities.

How long can the gym retain the images from the cameras?

The general maximum period set in art. 22.3 LOPDGDD is one month from the capture of the images, except where they must be retained to evidence the commission of acts threatening the integrity of persons, property or facilities, in which case they shall be retained exclusively for delivery to the competent authority (Law Enforcement, Courts) within a maximum period of 72 hours from knowledge. In practice, the centre should have a system that automatically overwrites images after the period, with the sole exception of images linked to a specific incident, which must be extracted, securely held and delivered to the competent authority. It is not lawful to retain the historical archive of recordings beyond one month except in the case described.

Can the gym use the camera images to monitor staff?

Monitoring labour activity through cameras has a specific regime set out in art. 89 LOPDGDD and the applicable employment and constitutional case law. Where cameras installed for security reasons also capture workers in common areas (reception, floor), the centre must have previously informed the staff of the possibility of using the images to verify compliance with employment obligations, ideally through a delivered and signed document and through information to the workers' legal representatives where they exist. It is not lawful to install covert cameras to monitor staff, or cameras in staff rest areas, staff changing rooms or toilets. The use of images as evidence in a disciplinary procedure requires having complied with the prior information and proportionality requirements. Installation specifically aimed at labour control requires prior individualised analysis.

CCTV in gyms: permitted areas, prohibited areas and GDPR

Q: What signage must the gym display if it has CCTV?

The centre must display visible signs in access areas to the CCTV-monitored zones, with the minimum information required by art. 22.4 LOPDGDD and art. 13 GDPR in a layered format. First layer (physical sign): identity of the controller, purpose (security and access control), summarised legal basis (legitimate interest or compliance with legal obligations as applicable), information on rights and reference to where the complete information can be consulted (second layer, typically the centre's website or a document available at reception). Second layer (complete information): in addition to the above, retention periods of the images, recipients (security firm, law enforcement where applicable), international transfers where the cloud system involves them, contact details of the DPO if appointed and detailed procedure for exercising rights.

CCTV cameras are a reasonable tool for a gym or sports centre: they protect access to the premises, deter incidents on the floor, help manage incidents and, in some cases, cover the centre's liability against claims. But the camera is not free: each installed camera is a processing of personal data subject to the GDPR and art. 22 LOPDGDD, with strict rules on where it can be installed, what information must be given to the member and how long the images can be retained.

This guide explains the permitted areas and the strictly prohibited areas in a gym, the mandatory signage, the retention periods and the usual friction points with staff and members, in accordance with the GDPR (Regulation (EU) 2016/679) and the LOPDGDD (Spain's Organic Law 3/2018).

Legal basis for CCTV in the gym

The installation of cameras in a gym is usually based on the controller's legitimate interest (art. 6(1)(f) GDPR) in protecting persons, property and facilities, articulated through art. 22 LOPDGDD (processing for CCTV purposes). This legal basis is not automatic: it requires a prior proportionality analysis (the camera must be suitable, necessary and proportionate to the security purpose, with no equivalent less intrusive measure available) and must be documented in the centre's legitimate interest balancing assessment.

The controller is always the sports centre. The security firm or installer, where involved, is a processor (art. 28 GDPR) and requires a signed contract with the minimum content. The cloud storage company for the images, if any, is also a processor.

Permitted areas in the gym

The following locations are usually compatible with the regulations, with the legal basis of art. 22 LOPDGDD and the corresponding signage:

Main entrance and access control turnstile: protects access to the premises and deters unauthorised entries. It is the standard area.
Reception and counter area: protects reception staff and the area where sign-ups and payments are handled. Cameras may capture the customer service area but should not focus exclusively on the receptionist's workstation without additional justification.
Common corridors and emergency exits: protection of persons in case of evacuation and identification of incidents.
Car parks and outdoor premises: within the centre's own perimeter. Recording the public highway is restricted (only the strip strictly necessary to monitor access, in accordance with AEPD criterion).
General weights or cardio room: may be admissible where the security purpose supports it (large areas without permanent supervision by technical staff, objective risk of incidents with equipment). The proportionality analysis must be documented: are there frequent incidents? Does technical staff cover the area? Can the purpose be achieved with fewer cameras or a narrower angle?
Equipment storage and technical zones: for protection of property and, where applicable, control of unauthorised access.

Strictly prohibited areas

Art. 89.1 LOPDGDD sets strict limits that do not admit exception even with the consent of the data subjects or reinforced signage. In a gym this translates into:

Member and staff changing rooms: no type of camera, in any layout, under any justification.
Showers: absolute prohibition.
Toilets: absolute prohibition, including the interior of cubicles and common areas of the toilet.
Massage, physiotherapy or body treatment rooms: no type of camera.
Medical, nutritional or any professional consultation rooms: absolute prohibition.
Staff rest rooms or areas: art. 89.1 LOPDGDD expressly prohibits CCTV in places intended for workers' rest or leisure.
Any area where there is a reasonable and reinforced expectation of privacy: fitting rooms in internal shops, changing booths, lactation rooms if any.

Area	Permitted?	Conditions
Entrance and turnstile	Yes	Visible signage, documented legal basis
Reception	Yes	No exclusive focus on the receptionist's workstation
Weights / cardio room	Case by case	Documented proportionality analysis
Own car park	Yes	No recording of public highway beyond the strictly necessary strip
Changing rooms and showers	No (art. 89.1 LOPDGDD)	Absolute prohibition
Toilets	No (art. 89.1 LOPDGDD)	Absolute prohibition
Massage or physio rooms	No (art. 89.1 LOPDGDD)	Absolute prohibition
Staff rest areas	No (art. 89.1 LOPDGDD)	Absolute prohibition

Signage: the most visible compliance

Art. 22.4 LOPDGDD requires the centre to display, in a sufficiently visible place, a sign in the access area of the CCTV-monitored zones with the minimum information of art. 13 GDPR, provided in layered format:

First layer (physical sign): identity of the controller (the centre), purpose (security and access control), summarised legal basis (legitimate interest or, in some cases, legal obligation), information on rights and reference to where the complete information may be consulted (centre's website or document at reception).
Second layer (complete information): in addition to the above, retention periods (one month except incident), recipients (Law Enforcement where applicable), international transfers where the cloud system involves them, DPO contact details if appointed and detailed procedure for exercising rights.

AEPD provides an official sign template that complies with the first layer. It is advisable to use it or adapt it while keeping the minimum elements.

Retention periods: one month as a general rule

Art. 22.3 LOPDGDD sets a general maximum period of one month from the capture of the images, except where they must be retained to evidence the commission of acts threatening the integrity of persons, property or facilities, in which case:

Images linked to the incident are extracted and securely held.
They are made available to the competent authority (Law Enforcement, Courts) within a maximum period of 72 hours from knowledge of the existence of the recording.

The rest of the historical archive must be automatically overwritten. Retaining recordings beyond one month "just in case" is not lawful. AEPD has sanctioned numerous controllers for this reason.

"CCTV is the area of the gym where most mistakes are made silently. Cameras inside the changing room that nobody dares to report. Signs missing for months. Cloud systems that retain a full year of history. When the inspection arrives, the centre learns that it has been in breach in plain sight for two years."

Mario P. Talamillo · Managing Partner, Certix®

CCTV and centre staff

Where cameras installed for security reasons also capture workers in common areas (reception, floor), art. 89 LOPDGDD applies:

The centre must have previously informed the staff of the existence of the cameras and of the possibility of using the images to verify compliance with employment obligations.
Information must be delivered in writing and, where workers' legal representatives exist, also to them.
It is prohibited to install covert cameras to monitor staff, cameras in rest areas, changing rooms or staff toilets.
The use of images as evidence in a disciplinary procedure requires having complied with the prior information and proportionality requirements. Constitutional case law has annulled evidence obtained without adequate prior information.
Installation specifically aimed at labour control (not general security) requires individualised analysis and, where appropriate, reinforced balancing.

Cloud systems and providers

Increasingly, CCTV systems store images on the manufacturer's cloud servers (Hikvision, Dahua, Reolink, Verkada, Eufy, third-party solutions). This introduces two considerations:

Art. 28 GDPR contract with the system and storage provider, with signed DPA.
International transfers: if servers are outside the EEA (frequent with Asian or US providers), verify adherence to the Data Privacy Framework where applicable and, failing that, standard contractual clauses. Document this in the records of processing activities.

Gym CCTV checklist

Floor plan of the centre with the exact location of each camera and its capture angle.
Documented proportionality analysis for each camera (suitability, necessity, balancing against alternatives).
Verification that no camera focuses on changing rooms, showers, toilets, massage rooms, medical consultation rooms or staff rest areas.
Visible signage at access to CCTV-monitored areas, with first-layer information.
Complete information (second layer) accessible on the website and at reception.
Prior written information to staff and, where applicable, to legal representatives.
System configuration for automatic overwriting after 30 days.
Documented procedure to extract images in case of incident and deliver them to the authority.
Art. 28 GDPR contract with the installer and with the cloud system provider.
Verification of international transfers of the cloud provider.
Specific entry in the records of processing activities for CCTV processing.

Frequently asked questions

In which areas of the gym can cameras be installed?

Only in areas justified by the security purpose and without a reinforced expectation of privacy: entrance, reception, corridors, own car park and, case by case, general room. Prohibited under art. 89.1 LOPDGDD: changing rooms, showers, toilets, massage or physio rooms, medical consultation rooms and staff rest areas.

What signage must the gym display if it has CCTV?

Visible signs at access points with the information of art. 22.4 LOPDGDD in layers: first layer with controller, purpose, summarised legal basis, rights and reference to the second layer; complete second layer accessible on the website or at reception with periods, recipients, DPO and rights procedure.

How long can the gym retain the images?

One month maximum from capture (art. 22.3 LOPDGDD), except images linked to an incident, which must be extracted and made available to the competent authority within 72 hours. The system must overwrite automatically. It is not lawful to retain the historical archive beyond one month.

Can the gym use the images to monitor staff?

Applying art. 89 LOPDGDD, with prior written information to staff and, where applicable, to legal representatives. Covert cameras and cameras in changing rooms, toilets or staff rest areas are prohibited. Disciplinary use requires prior compliance with information and proportionality requirements.

This content is merely informative and educational; it does not constitute specialised legal advice in any case. The application of the regulation to each specific case requires individualised analysis. Spanish regional sector regulations may extend or modify periods and requirements.

Want to review your gym's CCTV before the inspection arrives?

At Certix we assign you an expert in sports sector compliance. Review of cameras, signage, periods and contracts.

Talk to an expert