Leisure operators need to see the door, the floor and the till. Members do not expect to be filmed in a shower. UK GDPR is not a reason to switch every camera off. It is a reason to put cameras where they have a purpose, and to use something else where they do not.
This is the split we design for gyms, spas and clubs: identification and evidence in public and back-of-house areas; privacy-first counting in changing rooms and treatment spaces. We covered the unmanned-reception problem in how 24-hour gyms stay secure. This piece is about staying lawful while you do it.
What the ICO actually cares about
CCTV is personal data if people can be identified. You need a lawful basis, a purpose you can explain, and a retention period that is not “keep it forever in case”. Signs at the entrance are not a full policy, but operating with no signs and no policy is worse.
Cameras inside toilets, showers and changing cubicles are the red line for almost every leisure site. Corridors to those rooms, reception, the gym floor, car parks and stock rooms are a different argument — safety, theft and incident response are real purposes if you write them down and stick to them.
Spa and wellness is not the same as the gym floor
Treatment rooms, thermal suites and changing villages are where trust dies if you get this wrong. Arrivals, retail, plant and fire routes still need coverage. Our spa and wellness work starts with that map, not with a camera count.
If you need occupancy or queue data in a changing room, do not solve it with a dome. Precision sensors and laser mapping can give counts and heat maps without a identifiable picture. That is what smart gym monitoring is for. Use CCTV where you need a face or a number plate. Use privacy-first kit where you need a number of people.
Who can watch, and for how long
A site manager with the app on their phone is convenient. It is also a GDPR incident waiting to happen if every supervisor can rewind the changing-room corridor from the sofa. Restrict live view and playback by role. Log access. Keep footage for a defined period unless an incident is marked and held.
Remote control room operators should see the same rules: only the cameras they need, for the event they are handling. Analytics that flag a door-held-open or an after-hours figure in reception are easier to justify than someone casually browsing the spa.
A practical checklist for leisure operators
- Do you have a written purpose for every camera, or only a floor plan?
- Are changing rooms, toilets and treatment rooms camera-free?
- Is occupancy in those rooms handled with privacy-first sensors?
- Are signs at public entries accurate about who is recording and why?
- Who can play back footage, and is that access logged?
- How long do you keep ordinary recordings, and who can freeze an incident?
If you cannot answer those, adding another camera will not make you safer. It may make you less compliant. A survey of leisure sites usually starts with the rooms you must not film, then works outwards.
Talk to Dacha SSI
We design leisure security that members do not trip over and that you can defend in an ICO conversation. Call 0333 344 5526 or use the contact form.
