GDPR for personal trainers in the UK: a plain English guide to client health data

Does UK GDPR apply to personal trainers?

Yes, if you hold information about clients. The ICO defines a controller as the person or body that "determines the purposes and means of the processing of personal data", and controllers must be able to demonstrate compliance (ICO). The UK GDPR has seven principles, including data minimisation, storage limitation, security and accountability (ICO).

Working inside a gym? The ICO's fee FAQs, written for dental associates working inside a practice, ask questions that also help PTs: are you responsible for the security of the records, and do you have your own client list that would follow you if you left? If yes, you are likely to be a controller. An employee is covered by their employer's fee (ICO).

Is a PAR-Q health data?

Yes. The UK GDPR defines health data as personal data about a person's physical or mental health that reveals information about their health status, and the ICO says it covers past, current or future health and "any related data which reveals anything about the state of someone's health" (ICO). So a completed PAR-Q, a note about a bad knee or a list of medication all count. The ICO says a broken leg is health data just as a mental health condition is. A simple rule follows from data minimisation: only ask what you need to train someone safely.

Do personal trainers need to pay the ICO data protection fee?

The ICO says organisations, including sole traders, that use personal information must pay a data protection fee unless they are exempt (ICO). Only controllers pay (ICO). Fees since 17 February 2025:

Exemptions include processing personal information only without an automated system such as a computer, but exempt or not, you still need to comply with your other data protection obligations (ICO). In its fee guidance for physical wellbeing services, such as massage and slimming salons, the ICO says that if you record a client's medical history and treatments you would need to pay. PTs are not named, so treat this as a guide (ICO). The ICO's fee self assessment tells you whether you need to pay and how much.

Your lawful basis, plus a condition for health data

Pick a lawful basis

The ICO lists seven lawful bases in Article 6 of the UK GDPR: consent, contract, legal obligation, vital interests, public task, recognised legitimate interest and legitimate interests (ICO). Contract covers processing necessary for a contract you have with the person, such as booking and invoicing sessions a client has bought. No single basis is better than another. Decide yours before you start, write it down and include it in your privacy notice.

Add a condition for health data

For special category data you must identify both a lawful basis and a separate condition under Article 9. There are ten conditions. Five of them also need a condition from Schedule 1 of the Data Protection Act 2018, and some need a short written policy (ICO). There is no single right answer for every PT. The options people most often look at for a fitness business are below (ICO).

Explicit consent. The client agrees in a clear statement, spoken or written, for a stated purpose. The ICO says it must be freely given, specific, opt in, unambiguous and able to be withdrawn at any time. If a client withdraws it, you must stop using the data for that purpose. Where health data is objectively necessary to provide the service, explicit consent may still be available even as a condition of service. You must still be able to show the consent was freely given.

Vital interests. This covers life or death situations where the person cannot give consent, such as telling paramedics about an allergy when a client is unconscious.

Legal claims. This covers data you need to make or defend a legal claim, such as an injury claim.

Health or social care. The ICO says this needs the work to be done by, or under the responsibility of, a health or social work professional, or someone else who owes a legal duty of confidentiality. Get advice before you rely on it.

Write down which condition you rely on and why before you start. If you are unsure which one fits your business, get advice from a data protection professional. The ICO notes this guidance is under review after the Data (Use and Access) Act 2025.

Tell clients what you do with their data

You must give clients "privacy information" at the time you collect their data, including why you use it, your lawful basis, how long you keep it, who you share it with and how people can complain to you and to the ICO. It must be concise and in clear, plain language, and you must review it regularly (ICO). For most PTs that means a short privacy notice handed over with the PAR-Q or linked from your booking page.

Keep client data secure

The security principle asks for "appropriate technical and organisational measures", including encryption where appropriate and backups (ICO). The NCSC recommends passkeys for important accounts where available (NCSC), a PIN, password or fingerprint on every device you use for work (NCSC) and regular backups (NCSC).

How long should you keep client records?

The UK GDPR sets no fixed time limits; it depends on why you hold the data, and you must regularly review it and delete or anonymise what you no longer need (ICO). Your business records are different: GOV.UK says self employed people must keep records for at least 5 years after the 31 January submission deadline of the relevant tax year. If you trade through a limited company, GOV.UK says company records must be kept for 6 years from the end of the last company financial year they relate to. These tax rules cover financial records such as invoices. They do not mean you must keep PAR-Q answers for that long. Your insurer may have its own rules on records, so check your policy (GOV.UK).

Client requests, complaints and breaches

Access requests. A client can ask for a copy of their data verbally or in writing. You must respond without undue delay and within one month of receiving the request. You can extend this by up to two more months if the request is complex or the person has made a number of requests, but you must tell them, with your reasons, within the first month. If you genuinely need more detail to find the information, you can ask for it, and the clock stops until they reply. You only need to make reasonable and proportionate searches, and in most cases you cannot charge a fee (ICO).

Complaints. Since 19 June 2026, a rule added to the Data Protection Act 2018 by the Data (Use and Access) Act 2025 means you must give people a way to complain to you about how you use their personal information. A complaint form people can fill in online or on paper is one example. You must acknowledge each complaint within 30 days of receiving it. The 30 days is for the acknowledgement only. You must then look into the complaint, keep the person updated and tell them the outcome, all without undue delay. The ICO says there are no exemptions (ICO, ICO on the DUAA).

Breaches. If a personal data breach is likely to result in a risk to people's rights and freedoms, you must report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If you report later, you must give reasons for the delay. If a breach is unlikely to result in a risk, you do not have to report it, but you should be able to explain why. If it is likely to result in a high risk to the people affected, you must tell them too, without undue delay. Keep a record of every breach, whether you report it or not. If an app you use has a breach, it must tell you without undue delay (ICO).

Do you need a DPIA?

A data protection impact assessment is required where processing is likely to result in a high risk to people. The ICO's small business advice says that if you plan to process sensitive data such as medical data, it is likely you will need a DPIA first. If you are in any doubt, the ICO recommends doing one. For a small business it can be short, and the ICO has a free template. If you decide you do not need one, write down why (ICO, ICO).

Using software to store client data

An app that stores client data for you is usually your processor: it "processes personal data on behalf of the controller". An app can also be a controller for some data, such as your own login details or what it uses to keep its service secure. Its privacy policy should say which is which (ICO). Article 28 says the contract must include set terms, such as processing only on your documented instructions and contracts with any sub processors (ICO).

A quick checklist

1. Run the ICO fee self assessment.
2. List the client data you hold; drop what you do not need.
3. Note your lawful basis and health data condition.
4. Write a privacy notice with retention periods and a complaints contact.
5. Secure accounts and devices, and back up.
6. Check each app has a data processing agreement.
7. Know how to handle access requests, complaints and breaches.
8. Decide whether you need a DPIA, and write down why.

Read our guide to registering with HMRC as a sole trader PT and personal trainer insurance in the UK for the other admin.

How FitDesk helps

FitDesk is personal trainer software made for UK personal trainers: client management, bookings with repeat weekly bookings, workouts, progress tracking, messaging, session packages and invoices with a card payment link, so client records sit in one account rather than in notebooks and phone notes.

On data protection, you are the controller of the client data you collect, including health information, and FitDesk acts as your processor for it, as set out in its published Data Processing Agreement, which reflects UK GDPR Article 28 and lists its sub processors. FitDesk is a controller for account details, such as a client's login and email address, and for its own purposes, such as keeping the service secure, as its privacy policy explains. It also publishes a summary of its own DPIA, which you can read when you write yours. Your DPIA still needs to cover how your own business uses client data. Its privacy policy says data is sent over encrypted connections (TLS), with encryption at rest provided by its hosting and storage providers. FitDesk does not decide your lawful basis or write your privacy notice for you. It does not keep a record of a client's health consent for you, so if you rely on explicit consent, keep your own record of the wording and the date. FitDesk notifications show only the sender's first name, not the message text.

No monthly fee. 0.7% on Stripe card payments through FitDesk, minimum 1p per card payment. Stripe's own fees still apply. Cash has no FitDesk fee. FitDesk is a Pickle Labs company (Pickle Labs Collective Ltd). Create your FitDesk account

Sources

All checked 8 October 2026.

• ICO, What are controllers and processors?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/
• ICO, The principles: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/
• ICO, What is special category data?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/
• ICO, Special category data (lawful basis guide): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/special-category-data/
• ICO, What are the conditions for processing?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/
• ICO, A guide to lawful basis: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/
• ICO, Data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/
• ICO, Guide to the data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/
• ICO, Changes to the data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/changes-to-the-data-protection-fee/
• ICO, Exemptions: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/
• ICO, Legal definitions (fees): https://ico.org.uk/for-organisations/data-protection-fee/legal-definitions-fees/
• ICO, Fee FAQs: https://ico.org.uk/for-organisations/data-protection-fee/faqs-data-protection-fee-payment-and-online-registration/
• ICO, Paying a data protection fee, other service activities: https://ico.org.uk/for-organisations/data-protection-fee/paying-a-data-protection-fee-what-do-you-need-to-know/other-service-activities/
• ICO, Fee self assessment: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee-self-assessment/
• ICO, The right to be informed: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/
• ICO, A guide to data security: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/
• ICO, Storage limitation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/
• ICO, A guide to subject access: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/
• ICO, How to deal with data protection complaints: https://ico.org.uk/for-organisations/how-to-deal-with-data-protection-complaints/
• ICO, The Data (Use and Access) Act 2025: what does it mean for organisations?: https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/
• ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
• ICO, Data protection advice on common topics (small organisations): https://ico.org.uk/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-advice-on-common-topics/
• ICO, When do we need to do a DPIA?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/
• ICO, What needs to be included in the contract?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/
• GOV.UK, Business records if you're self employed: how long to keep your records: https://www.gov.uk/self-employed-records/how-long-to-keep-your-records
• GOV.UK, Running a limited company: company and accounting records: https://www.gov.uk/running-a-limited-company/company-and-accounting-records
• legislation.gov.uk, Data Protection Act 2018, section 164A (complaints to controllers): https://www.legislation.gov.uk/ukpga/2018/12/section/164A
• legislation.gov.uk, Data (Use and Access) Act 2025, section 76 (time limits for responding to requests): https://www.legislation.gov.uk/ukpga/2025/18/section/76
• legislation.gov.uk, UK GDPR Article 13 (information to give people): https://www.legislation.gov.uk/eur/2016/679/article/13
• legislation.gov.uk, UK GDPR Articles 33 and 34 (personal data breaches): https://www.legislation.gov.uk/eur/2016/679/article/33
• NCSC, Small organisations guide to cyber security (accounts, devices, backups): https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security

Please note: this guide is general information, not legal advice. It cannot cover every situation. For advice on your own business, speak to a data protection professional or the ICO.