We run a sports club – what data protection work do we need to put in order?

Start from this list and mark what you have:

The bases in the table are the usual case, not a rule. If, for example, your trainers are health care professionals providing rehabilitation, that is a different case and worth discussing separately.

Yes. Article 4(15) GDPR defines data concerning health as personal data "related to the physical or mental health of a natural person". Injuries, chronic conditions or pregnancy are exactly that. Article 9(1) prohibits processing such data unless one of the exceptions in Article 9(2) applies. For a sports club that is not a health care provider, one is left in practice: the person's explicit consent (Article 9(2)(a)). Paragraph 99 of EDPB Guidelines 05/2020: where none of the exceptions in points (b) to (j) fits, obtaining explicit consent is the only possible lawful exception for processing such data.

How to set up the questionnaire:

1. Ask only what the trainer will actually use (Article 5(1)(c) GDPR). A question such as "do you have any injuries the trainer should take into account?" often replaces a list of ten conditions.
2. Keep consent separate from the membership contract. Article 7(4): when assessing whether consent is freely given, "utmost account shall be taken" of whether the contract is made conditional on consent to processing that is not necessary for it. If membership is impossible without the questionnaire, the consent may not be free.
3. Record the consent as an express statement. Article 7(1) requires you to be able to demonstrate that consent was given, and health data need explicit consent: under paragraph 93 of EDPB Guidelines 05/2020 the data subject must give an express statement of consent. The box should say, for example, "I consent to the club processing the health data in this form to adapt my training", not "I understand my data will be processed" (compare the example in paragraph 96 of the guidelines). Keep the date and the questionnaire version.
4. Let people withdraw. Article 7(3): "It shall be as easy to withdraw as to give consent." When consent is withdrawn, delete the questionnaire.
5. Limit access. Only the trainer working with that member sees the questionnaire, not the whole front desk.

A fingerprint template is biometric data: Article 4(14) GDPR names "dactyloscopic data" among them. Where the template is used to identify the person, the prohibition in Article 9(1) applies, so again explicit consent is needed.

Consent is valid only if the member has a real choice. Paragraph 86 of EDPB Guidelines 3/2019 says the controller must offer an alternative solution that does not involve biometric processing, without imposing restrictions or additional costs on the data subject. For a club this means:

• a card, wristband or QR code is available to everyone, at no extra charge and without a longer queue;
• the member chooses the fingerprint, by a separate consent, not in the contract;
• when membership ends or consent is withdrawn, delete the template from the device and from the supplier's system;
• ask the supplier where templates are stored, whether they can be turned back into a fingerprint image and whether they are encrypted;
• sign a data processing agreement with the supplier (Article 28(3) GDPR) – this applies to the entry-system supplier and to the CCTV maintenance company, if it sees the recordings.

Item 4 of the VDAI list covers processing of biometric data intended to uniquely identify a natural person for the purpose of monitoring or controlling data subjects. In our reading, entry control is such a control purpose, so carry out a data protection impact assessment before switching the system on (Article 35(1) GDPR).

If children train at the club. The health questionnaire and consent for a child are usually completed by a parent. Better not to use fingerprint entry for children: item 4 of the VDAI list requires an impact assessment also where personal data of vulnerable data subjects are processed, and we treat children as such data subjects. If your sport or competitions carry a specific requirement to present a health certificate, the basis may be different, and that is worth discussing separately.

Cameras at the entrance, the front desk and the equipment store are usually based on a legitimate interest in protecting property and people (Article 6(1)(f) GDPR). Inside the gym, take more care. Paragraph 38 of EDPB Guidelines 3/2019 says people can expect not to be monitored in areas used for treatment, rehabilitation and leisure and in places where they stay and communicate, and gives fitness facilities as an example; there the person's interests will often override the controller's legitimate interests.

So before installing a camera in the gym, write down what specific problem justifies it – theft, damaged equipment, accidents – and whether it could be solved another way, for example with lockers or a trainer on duty.

Set up the sign for members, the retention period and access as described in Can we film our premises and grounds? (in Lithuanian).

Changing rooms, showers and the sauna: no. Paragraph 37 of EDPB Guidelines 3/2019: monitoring is not to be expected in sanitary or sauna facilities, because monitoring such areas is an intense intrusion into the rights of the data subject.

Where cameras cover a gym where trainers and administrators work, three more duties apply:

• inform staff by signature or another way that proves they were informed, giving all the information in Article 13(1) and (2) GDPR (Article 5(4) of the Law on Legal Protection of Personal Data, ADTAĮ);
• with on average 20 or more employees and a works council – inform and consult it before adopting the monitoring rules (Article 206(1)(5) of the Labour Code, DK);
• carry out an impact assessment: item 10 of the VDAI list covers video data processed at the workplace and in the controller's premises or areas where its employees work.

If the club wants to film training sessions to analyse technique, the example under paragraph 44 of EDPB Guidelines 3/2019 warns: where the club itself decides to film the whole team, consent will often not be valid, because athletes may feel pressured. Film only the athlete who asked for it.

Almost always, yes. Article 30(5) GDPR exempts enterprises employing fewer than 250 persons, but not where the processing is not occasional or includes special categories of data. A club processes member data every day, and health questionnaires and fingerprints are special category data.

In the record, for each process in the table, enter: the purpose, the basis, the data categories, who sees it (trainer, front desk, entry system supplier), the retention period and whether an impact assessment was done.

Today, go through your health questionnaire and strike out the questions the trainer does not use. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities and which of your processes carry risk. An impact assessment for fingerprint entry or cameras can be ordered as a one-off procedure – €95 excl. VAT per process; video surveillance documents – €195 excl. VAT. We prepare record templates by sector, including for sports clubs.

Can we make the health questionnaire mandatory?
Better not. Processing health data rests on explicit consent, and consent must be free (Article 7(4) GDPR), so the safest course is a voluntary, short questionnaire. A member's confirmation that they train at their own risk does not remove the club's liability for injury (Article 6.252(1) of the Civil Code, CK).

Do we need consent for entry with a membership card?
No. A card with a membership number is not biometric data; visit records are usually based on performance of the contract (Article 6(1)(b) GDPR).

Is camera footage of the gym health data?
Usually not. EDPB Guidelines 3/2019 state that footage showing, for example, a person using a wheelchair is not in itself special category data. But if you used recordings to assess members' health, Article 9 GDPR would apply.

How long should we keep a fingerprint template?
Only while the member uses that way of entry. When membership ends or consent is withdrawn, delete the template.

• Can we film our premises and grounds? (in Lithuanian)
• A data protection impact assessment step by step
• Consent to process data: how to ask for it and prove it
• An employee privacy notice: how to prepare it
• A dental clinic and the GDPR

The law and the risk: Consent under the GDPR: when you need it and when it is invalid – dat.lt

• Biometric data and data concerning health – Article 4(14) and 4(15) GDPR.
• Prohibition on special category data and explicit consent – Article 9(1) and 9(2)(a) GDPR.
• Data minimisation – Article 5(1)(c) GDPR.
• Consent, contract and legitimate interest – Article 6(1)(a), 6(1)(b) and 6(1)(f) GDPR.
• Proof of consent, withdrawal, freely given – Article 7(1), 7(3) and 7(4) GDPR; explicit consent in practice – EDPB Guidelines 05/2020, paragraphs 93, 96 and 99.
• Data processing agreement with the supplier – Article 28(3) GDPR.
• Informing the works council about monitoring rules – Article 206(1)(5) of the Labour Code (DK).
• Liability for injury cannot be limited – Article 6.252(1) of the Civil Code (CK).
• Information for staff – Article 13(1) and 13(2) GDPR; informing by signature when monitoring the workplace – Article 5(4) of the Law on Legal Protection of Personal Data (ADTAĮ).
• The record exemption and its limits – Article 30(5) GDPR.
• Impact assessment before processing starts – Article 35(1) GDPR; content – Article 35(7).
• When an assessment is mandatory in Lithuania – VDAI Director's order No 1T-35 (1.12.E) of 14 March 2019, list items 4 and 10 (children as vulnerable data subjects – our reading).
• Monitoring in leisure and sanitary areas, consent to film a team, an alternative to biometrics – EDPB Guidelines 3/2019, paragraphs 37, 38, 44 and 86.

Legal texts checked on 2026-09-25: GDPR – official consolidated English text (OJ L 119, 4.5.2016) with corrigenda; ADTAĮ – e-tar.lt edition in force from 2026-06-30; DK – from 2026-06-07; CK – from 2026-07-31; EDPB Guidelines 3/2019 and 05/2020; VDAI order No 1T-35 – current version (Lithuanian only; its wording here is our translation). This text is general information and is not individual legal advice.