Short answer: A yoga or fitness studio in the EU or EEA has to comply with GDPR whatever its size. In practice that means a lawful basis for each type of data, a plain-language privacy policy, a data processing agreement with your booking software and other suppliers (Art. 28), a short record of processing (Art. 30), retention periods you have set and written down, and a plan to report serious breaches to your supervisory authority within 72 hours (Art. 33). Health information about injuries or pregnancy is special category data (Art. 9) and generally needs explicit consent.
Not legal advice. This is a practical guide for studio owners. If a specific question really matters for your business, talk to a data protection lawyer or read the guidance from your national supervisory authority.
"Am I even allowed to write down that she has a slipped disc?"
That is the kind of question GDPR raises in a studio. Not the grand principles, but everyday things: the health question at signup, the newsletter, the photo from Saturday's workshop, and the class list your cover teacher needs tonight.
Most studio owners know the rules exist, but few could say exactly what they require. This guide is the calm middle ground: what a typical studio has to do, what your booking software takes care of, and what you have to decide yourself. If your studio is in the UK, Switzerland or the US but has members in the EU, read our guide to GDPR for studios outside the EU instead.
Does GDPR apply to a small studio?
Yes. There is no lower limit: a solo yoga teacher with 30 students in a booking system processes personal data just like a chain with five gyms. The difference is how much paperwork it takes.
You are the controller: you decide what data is collected and why. Your booking software is the processor: it handles data on your behalf. The software takes care of the technical side (security, backups, access control); you take care of the editorial side: what you ask for, how long you keep it, and who gets access.
What personal data does a studio typically hold?
| Data | Examples | Typical lawful basis |
|---|---|---|
| Contact details | Name, email, phone, date of birth if needed | Contract (Art. 6(1)(b)) |
| Bookings and attendance | Bookings, cancellations, no-shows, waiting lists | Contract |
| Memberships and payments | Class packs, memberships, purchases, invoices | Contract; legal obligation for bookkeeping (Art. 6(1)(c)) |
| Health information | Injuries, surgery, pregnancy, medical conditions | Explicit consent (Art. 9(2)(a)) |
| Marketing | Newsletter signups | Consent (Art. 6(1)(a)) |
| Photos and video | Class photos where people can be recognised | Consent |
| Technical data | IP addresses, login times, logs | Legitimate interests, e.g. security (Art. 6(1)(f)) |
Full card numbers should never sit with you; that is your payment provider's job. And apply data minimisation: if you ask for a date of birth, it should be because you use it (age-based pricing, children's classes), and you use it only for that.
Lawful bases in practice: you don't need consent for everything
A common misunderstanding is that everything needs consent. But consent can be withdrawn at any time, and you cannot stop recording someone's booking because they changed their mind about a tick box. So consent is the wrong basis for anything you cannot do without.
- Contract: what you need to deliver what was bought: profile, bookings, membership and payments.
- Legal obligation: what the law requires you to keep, such as accounting records.
- Legitimate interests: for example security logs and attendance statistics for planning your timetable. Requires a balancing test you can explain.
- Consent: things a member can refuse without losing their place: newsletter, photos and health information.
Write the basis into your record of processing and explain it in your privacy policy: what you collect, why, who you share it with and how long you keep it.
Health data: injuries, pregnancy and Article 9
Health information is special category data. Article 9 starts from a ban on processing it unless an exception applies. For a studio, the practical route is explicit consent: an active, separate yes, not a line buried in your terms and conditions.
- Ask only for what the instructor uses. A reformer Pilates studio may need to know about recent surgery; a drop-in vinyasa class does not need a medical history. One optional field such as "Is there anything your instructor should know?" is often enough.
- Make the field optional and briefly explain why you ask.
- Limit access to the instructors who actually teach that person.
- Keep it out of email, text messages and WhatsApp. Once health details are in a group chat, you cannot delete them.
- Delete it when it is no longer relevant. A back injury from three years ago does not belong in the profile.
Two nuances. When a member mentions a sore shoulder to the instructor before class, nothing has been recorded; GDPR applies once someone writes it into a system or filing system. On the other hand, the attendance list of a prenatal yoga class can reveal a pregnancy, so treat it with the same care as a health form.
Data processing agreements: booking software and other suppliers (Art. 28)
When a supplier processes personal data on your behalf, you need a data processing agreement (DPA). Most software suppliers include it in their terms or provide it on request. Your job is to know who holds your members' data and to check that the agreement exists.
| Supplier | What to do |
|---|---|
| Booking software | Get the DPA and the list of sub-processors |
| Newsletter and SMS tools | DPA; check where the data is stored |
| Accounting software | DPA (usually in the terms) |
| Email and cloud storage | Accept the provider's data processing terms if member data lives there |
| Payment provider | Often a controller in its own right for parts of the processing (e.g. fraud and anti-money-laundering checks); read their terms |
Among other things, the agreement must ensure that the supplier only acts on your instructions, keeps the data secure, uses sub-processors only with your approval, helps you with breaches and member requests, and deletes or returns the data when you leave. Class Booking offers a data processing agreement to every customer; ask and we send you a signed copy.
The record of processing (Art. 30): one page that describes your data
The record is an internal document: what you process, why, about whom, who receives it, whether data leaves the EU, how long you keep it and how you protect it. The exemption for organisations with fewer than 250 employees only applies when processing is occasional and involves no special category data. A member database used every day is not occasional, so assume the requirement applies to you. Most supervisory authorities publish templates.
| Purpose | Data | Recipients | Retention (example) |
|---|---|---|---|
| Bookings and memberships | Contact details, bookings, purchases | Booking software, payment provider | 24 months after last activity |
| Safe teaching | Health information (with consent) | The member's own instructors | Once no longer relevant |
| Newsletter | Email, time of consent | Newsletter tool | Until unsubscribed |
How long can you keep data? Set it and document it
GDPR says you must not keep personal data longer than necessary, but it sets no fixed periods for a member database. You decide a period for each type of data, write down why, and stick to it. Accounting records are the exception: keep them as long as your country's bookkeeping rules require, and ask your accountant if you are unsure.
"They might come back" is not a reason. "Many members take a year or two off, so we delete profiles 24 months after their last booking" is a reason you can defend. The number is an example, not a legal requirement. Put a fixed date in the calendar, say every January, to clean up.
Members' rights: access, erasure and data portability
You must respond without undue delay and within one month. For complex requests you can extend by up to two further months, but you have to tell the member within the first month. As a rule it is free of charge.
- Access (Art. 15): a copy of the data you hold on the person: profile, bookings, purchases, messages and notes.
- Erasure (Art. 17): not absolute. You may keep invoices your bookkeeping rules require, but not data kept for convenience or marketing.
- Data portability (Art. 20): the data the member gave you, in a structured, machine-readable format such as CSV or JSON.
- Objection to direct marketing (Art. 21): absolute. If a member says stop, you stop.
Send the response only to the email address on the member's profile, so you never hand data to someone pretending to be them.
Newsletters and consent
Marketing by email and text message is governed by each country's ePrivacy rules as well as GDPR. The main rule is prior consent. Most countries allow a narrow exception for existing customers, often called soft opt-in: if you got the email address in connection with a sale, you may market your own similar services, provided the customer could say no when the address was collected and can opt out in every message. The details vary by country, so check your national rules.
GDPR adds two requirements: you must be able to prove consent (when, how and with what wording), and withdrawing it must be as easy as giving it. So no pre-ticked boxes, and a one-click unsubscribe link in every mailing. Booking confirmations, receipts and cancellations are service messages; "We miss you, here's 20% off" is marketing, even when it is sent from your booking system.
Photos and video on social media
A photo in which people can be recognised is personal data, and an Instagram post publishes it. The safe route is separate, freely given consent that says where the photos will be used and can be withdrawn. If it is withdrawn, take the photo down where you can.
- Take extra care with classes where the photo itself says something about health: prenatal yoga, rehab classes, classes for specific conditions.
- Children's classes: ask the parents, and never show names next to photos of children.
- In practice: announce it before you shoot, photograph from behind, and let anyone who prefers not to appear step out of frame.
Data breaches: the 72-hour rule
Typical breaches in a studio are mundane: an email to all members with addresses in CC instead of BCC, a lost phone without a passcode holding class lists, a hacked email account, or a spreadsheet with health information shared through an open link.
Under Article 33 you must report the breach to your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to your members. The 72 hours are calendar hours; a weekend does not stop the clock. Every breach must be documented internally, including those you do not report, and if the risk is high you must also inform the members affected (Art. 34). If the breach happens at your supplier, they must notify you without undue delay.
| Where your studio is | Supervisory authority |
|---|---|
| Ireland | Data Protection Commission (DPC) |
| Germany | The data protection authority of your federal state |
| France | CNIL |
| Spain | AEPD |
| Netherlands | Autoriteit Persoonsgegevens |
| Sweden | IMY |
| Norway (EEA) | Datatilsynet |
| United Kingdom | ICO (under UK GDPR) |
Write a half-page breach plan: who assesses, who reports, and a template message to members. Then the decisions are made calmly, not in the middle of the incident.
Checklist: GDPR for your studio in 10 steps
- Map your data: what you collect, why and where it lives.
- Give every purpose a lawful basis: contract, legal obligation, legitimate interests or consent.
- Cut back your health questions and get explicit consent for the rest.
- Collect the DPAs for booking, newsletter, SMS, accounting and cloud tools.
- Write a privacy policy in plain language and link to it from your booking flow.
- Fill in your record of processing (Art. 30) on one page.
- Set retention periods per data type, write down why, and clean up once a year.
- Give instructors their own login in the booking system instead of emailed spreadsheets, and turn on two-factor authentication for email and social accounts.
- Collect newsletter and photo consent as separate, active choices and keep the proof.
- Write a breach plan and a fixed routine for access, erasure and portability requests.
Switching systems is a good moment to clean up your data. Our guide to migrating without losing data covers what to export, map and check.
Where Class Booking helps
Class Booking is your processor, so the editorial decisions remain yours. But the technical scaffolding is built in:
- Data hosted on servers in the EU.
- Full data export (JSON or CSV), so your data is never locked in.
- Members can delete their own account, and you can delete a member permanently while accounting records are kept.
- Instructors see only the participants in their own classes by default.
- An audit log of administrative actions, and two-factor authentication on our own admin access to the platform.
- A public list of sub-processors in our privacy policy, showing where each one is located.
Frequently asked questions
Does GDPR apply to a small yoga studio?
Yes, GDPR applies regardless of size. For a small studio the paperwork is manageable: a privacy policy, a one-page record of processing, data processing agreements, written retention periods and a breach plan.
Can I ask clients about injuries and pregnancy?
Yes, but it is health data under Article 9. Ask only for what the instructor needs, make the field optional, get explicit consent, limit access, and delete the information once it is no longer relevant.
Do I need a DPA with my booking software?
Yes. Your booking software processes your members' data on your behalf, which makes it a processor under Article 28. Check that the agreement exists and that you can see the list of sub-processors.
How quickly must I answer a subject access request?
Without undue delay and within one month. For complex requests the deadline can be extended by up to two months, as long as you tell the member within the first month.
When do I have to report a data breach?
Without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the people affected. Document every breach internally, reported or not.
Booking software that takes GDPR seriously
EU data hosting, a DPA for every customer, full data export and class-level access for instructors. From €10 / £8 a month, no contract.
Try free for 14 days →