Gym member data: what Ugandan gyms must protect by law
Sign-up forms, phone numbers, health notes and check-in records are personal data under Uganda's Data Protection and Privacy Act. What a gym owner must do.
A gym collects more personal information than most small businesses. Every new member fills in a form with a name, a phone number, often a next of kin, and frequently a note about injuries or medical conditions. Many gyms photograph members for a card and log every visit at the front desk. All of that is personal data, and in Uganda it is governed by the Data Protection and Privacy Act, 2019. This post sets out what the Act asks of a gym owner, in plain terms, with the section numbers so you can check the wording yourself.
The Act applies to you, whatever your size
Section 1 of the Act says it applies to any "person, institution or public body" collecting, processing, holding or using personal data within Uganda. There is no small-business exemption. A single-room gym with a paper register is covered in the same way as a chain.
Section 3 sets the principles. Anyone who collects personal data must be accountable to the data subject for it, must collect and process it "fairly and lawfully", and must hold it only for the purpose it was collected for. In practice that means the phone number taken for a membership should be used for that membership, not sold to a supplements seller.
Consent comes first
Section 7(1) is the heart of the law: "a person shall not collect or process personal data without the prior consent of the data subject." Section 7(2) lists exceptions, including where the processing is needed to perform a contract the member is party to. A membership agreement is such a contract, so you can hold the details needed to run it. Anything beyond that, such as marketing messages or sharing details with a partner business, needs the member's clear agreement.
The Act defines consent as a "freely given, specific, informed and unambiguous indication" of the member's wishes. A pre-ticked box on a form does not meet that test. A short, plainly worded line on the sign-up form that the member actively ticks does.
Health notes are special personal data
Section 9(1) prohibits collecting or processing data about a person's "health status or medical records" except in the circumstances listed in section 9(3). One of those is where "the information is given freely and with the consent of the data subject". Gyms often ask about injuries and conditions for good safety reasons. Keep doing so, but make it clearly optional, explain why you ask, and restrict who in the gym can see the answers. A trainer may need to know about a back injury; the person selling protein shakes does not.
Keep it only as long as you need it
Section 18(1) says a collector "shall not retain the personal data for a period longer than is necessary to achieve the purpose for which the data is collected". When a member leaves and the account is closed, there should be a point at which their health notes and photographs are deleted. Decide that period, write it down, and follow it.
Lock it down
Section 20(1) requires "appropriate, reasonable, technical and organisational measures" to prevent loss, damage, unauthorised destruction and unlawful access. For a gym the practical steps are familiar: no shared logins at the front desk, a password on the laptop, staff accounts that are removed when a person leaves, and member records kept in a system rather than in a WhatsApp group.
Messaging members
If you text members about renewals or classes, the Uganda Communications (Text and Multimedia Messaging) Regulations, 2019 also apply. Regulation 5 prohibits using an automated system to send an unsolicited SMS to a subscriber. Regulation 11(2) allows messages where the contact details were obtained in a prior commercial transaction, provided you made clear at the time that the number might be used for marketing and offered the right to object. Regulation 12 requires a "functional, obvious, clear and efficient" opt-out based on the word "STOP", at no cost to the customer. Renewal reminders about a membership the person already holds sit comfortably within the contract; promotional blasts need the consent and the opt-out.
A simple compliance checklist for a gym
- Add a short consent statement to the sign-up form, with a separate tick for marketing messages.
- Make the health and injury section optional and explain why you ask.
- Give each staff member their own login and remove it when they leave.
- Set a retention period for closed accounts and delete on schedule.
- Include "Reply STOP to opt out" on promotional texts and act on every request.
- Keep the Act's section numbers to hand when a member asks what you hold about them.
None of this needs a lawyer on retainer. It needs a tidy system, a clear form and the habit of asking before you use a member's details for anything new.
Sources
Run the whole business from one login.
Point of sale, stock, CRM, accounting free in every plan, payroll and Kit AI. Start on the web today and add the till, the phone app and the desktop app as you grow.
No card needed · 14-day trial