Do Gyms Need A CCTV Privacy Policy?

Yes - if your gym or studio uses CCTV, you should have a CCTV privacy policy and clear notices telling people cameras are in use.

The more nuanced answer is that your exact obligations depend on where your business is located, who you're recording, what the cameras capture and whether your business is covered by the Privacy Act 1988. A camera at reception is very different from a camera near a changeroom, and monitoring members is different from monitoring staff.

CCTV can be genuinely useful in a fitness business. It can help with safety incidents, theft, after-hours access, equipment damage and disputes about what happened on the gym floor. But because gyms are personal spaces, you need to handle cameras carefully.

Here's how to think about CCTV privacy in a practical way, so you can protect your business without making members or staff feel watched in the wrong places.

Do Gyms Need A CCTV Privacy Policy?

Yes, you should have a CCTV privacy policy if you use security cameras in your gym or studio, even if you're not sure whether the federal privacy laws apply to you.

Under the Privacy Act 1988, CCTV footage can be personal information if a person is reasonably identifiable from the footage. If your gym is covered by the Privacy Act, you need to comply with the Australian Privacy Principles, often called the APPs.

Your gym or studio may be covered by the Privacy Act if, for example:

• your annual turnover is more than $3 million
• you provide health services and hold health information
• you trade in personal information
• you're related to a business that's covered by the Privacy Act
• you're otherwise required to comply because of your structure, contracts or sector rules

Many fitness businesses collect sensitive health information through pre-exercise screening forms, injury waivers, pregnancy or medical condition questions, personal training notes or allied health services. If you collect health information, don't assume the small business exemption automatically protects you.

Even if the Privacy Act doesn't apply, you still need to think about:

• state and territory surveillance laws
• workplace surveillance rules if staff are captured
• your obligations under work health and safety laws
• what you've promised members in your membership terms and privacy policy
• the Australian Consumer Law, especially if your privacy statements are misleading

A good CCTV privacy policy doesn't need to be long. It needs to clearly explain what you record, why you record it, who can access it, how long you keep it under your data retention policy and how someone can ask questions about it.

Where Can You Put Security Cameras In A Gym?

You can usually place cameras in public or operational areas of your gym, but you shouldn't place them in private areas like changerooms, toilets or shower areas.

For most gyms and studios, lower-risk camera locations include:

• entry and exit points
• reception and front desk areas
• equipment areas and weights zones
• group training rooms, where members have been told cameras are operating
• car parks and external entrances, if your business controls those areas
• storage rooms, stock rooms and staff-only operational areas, with proper staff notice

Higher-risk or no-go areas include:

• changerooms
• toilets
• showers
• treatment rooms where people may undress or discuss sensitive health information
• areas used for breastfeeding, first aid or private consultations

Several Australian surveillance laws deal with recording private activities. For example, state and territory surveillance devices legislation can restrict optical surveillance where a person would reasonably expect privacy. In practice, a camera in a changeroom is extremely difficult to justify and can create serious legal and reputational risk.

Example: A Pilates Studio In Melbourne

Say Emma runs a reformer Pilates studio in Melbourne. She wants cameras at reception, the front door and the main studio room because there have been a few after-hours access issues and one member recently tripped over equipment.

That setup may be reasonable if Emma gives clear notice, limits access to the footage and doesn't use cameras in private areas. But if she installs a camera facing the changeroom entrance in a way that captures people changing, that's a very different risk profile.

Emma should also check Victorian surveillance laws, her lease, her staff arrangements and her privacy policy before the cameras go live.

What Notice Do You Need To Give Members And Visitors?

You need to give clear notice before or at the time people are recorded, so members and visitors understand CCTV is operating before they enter camera-covered areas.

If the Privacy Act applies to your business, the APPs require you to take reasonable steps to notify people about the collection of their personal information. For CCTV, this usually means a mix of signage, your privacy policy and your membership terms.

Your signage should be easy to see and understand. It should usually tell people:

• CCTV cameras are operating
• the main reason for recording, such as safety and security
• who operates the system, such as your gym or studio business name
• where they can find your privacy policy or ask questions

You don't need a long legal paragraph on every sign. The sign should do the job of alerting people before they walk into the recorded area.

Your broader privacy policy can then explain the details, such as:

• the types of personal information you collect through CCTV
• why you collect and use CCTV footage
• whether footage may be shared with police, insurers, landlords, franchise systems or security providers
• how footage is stored and protected, including your information security policy
• how long footage is kept
• how people can request access or make a privacy complaint

If you run a 24/7 gym, access-controlled studio or unstaffed training space, notice becomes even more important because people may enter without speaking to a staff member. Your signs, onboarding emails, membership agreement and app or booking flow should all be consistent.

Can You Use CCTV To Monitor Staff?

Yes, you may be able to use CCTV to monitor staff, but you need to comply with workplace surveillance laws, privacy obligations and your own employment documents.

This is where gym CCTV can become more complicated. A camera installed for member safety may also capture your receptionist, personal trainers, cleaners or contractors working their shifts.

Workplace surveillance rules vary across Australia. In New South Wales, the Workplace Surveillance Act 2005 has specific rules for camera surveillance. Generally, you need to give employees at least 14 days' written notice before surveillance starts, unless they agree to a shorter period. The notice needs to cover details such as the kind of surveillance, when it will start, whether it's continuous or intermittent, and whether it's ongoing or for a fixed period.

NSW also has rules requiring cameras used for workplace surveillance to be clearly visible and signs to be visible at each entrance to the workplace. Surveillance in places like toilets, changerooms or shower facilities is prohibited.

The Australian Capital Territory also has specific workplace privacy legislation, the Workplace Privacy Act 2011, with notice requirements for surveillance. Other states and territories may not have the same dedicated workplace surveillance legislation, but surveillance devices laws, privacy laws, employment contracts, awards, enterprise agreements and workplace policies can still matter.

If your staff work across different states, don't assume one policy works everywhere. The safest approach is to build your CCTV policy around the strictest obligations that apply to your sites, then add state-specific wording where needed.

Using Footage For Performance Or Misconduct

You should be careful about using CCTV footage for performance management or misconduct if staff were only told the cameras were for security or safety.

For example, if your policy says CCTV is used for member safety and theft prevention, but you start using footage to track how often a trainer checks their phone, staff may argue they weren't properly told about that purpose.

If you want the option to use CCTV footage for workplace investigations, your staff surveillance notice and workplace policies should say so clearly.

What Should Your CCTV Privacy Policy Include?

Your CCTV privacy policy should explain, in plain English, how your gym or studio collects, uses, stores and shares CCTV footage.

A practical CCTV policy for a gym or studio should usually cover:

• Purpose: why you use CCTV, such as safety, security, incident management, access control, theft prevention and protecting equipment
• Camera locations: the general areas where cameras operate, without revealing security-sensitive details
• No private area recording: a clear statement that cameras aren't used in changerooms, toilets or showers
• Audio: whether cameras record audio, and if not, a clear statement that audio isn't recorded
• Access: who can view footage, such as authorised managers, security providers or IT administrators
• Disclosure: when footage may be shared with police, insurers, landlords, franchise head office, regulators or legal advisers
• Retention: how long footage is kept before it's deleted or overwritten
• Security: how footage is protected from unauthorised access, downloading or sharing
• Member rights: how someone can request access to footage or make a privacy complaint
• Staff monitoring: how CCTV applies to employees, contractors and other workers

Your policy should match what actually happens in your business. If you say footage is only accessible by the studio owner, but your offshore IT provider can also access the system, the policy needs to reflect that.

Templates can be a helpful starting point, but CCTV policies often need tailoring for the physical layout of your gym, the type of cameras you use, your staffing model and your state or territory.

Can Your Gym Record Audio As Well As Video?

You should be very cautious about recording audio in your gym, and in many cases it's better to turn audio recording off.

Audio recording is treated differently from video in many Australian surveillance laws. Listening device laws can restrict recording private conversations without consent, and the rules vary between states and territories.

In a fitness setting, audio can capture sensitive conversations. Members might discuss injuries, health conditions, payment issues or personal matters at reception. Staff might discuss rosters, complaints or workplace concerns. Recording those conversations can create risks that aren't necessary for ordinary security.

If your cameras have built-in microphones, check the settings before installation. Many businesses don't realise audio is switched on by default.

If you genuinely need audio for a specific reason, get tailored advice first and make sure your notices, privacy policy, staff documents and sensitive information privacy settings deal with it clearly. Don't rely on a small sticker near the door to cover detailed audio recording.

How Long Can You Keep CCTV Footage?

You should keep CCTV footage only for as long as you reasonably need it, unless you need to preserve it for an incident, complaint, insurance claim or legal requirement.

There's no single retention period that fits every gym in Australia. Many CCTV systems overwrite footage automatically after a set period, such as a few days or weeks. The right period for your business depends on your reasons for recording, the risk level of your premises and how quickly incidents are usually reported.

If the Privacy Act applies, the APPs require you to take reasonable steps to destroy or de-identify personal information when you no longer need it, unless an exception applies.

A sensible retention process might look like this:

1. Set a standard overwrite period for ordinary footage.
2. Restrict who can download or export footage.
3. Save incident footage separately only when there's a real reason to keep it.
4. Record why the footage was saved, who accessed it and when it should be reviewed.
5. Delete saved footage once the incident, complaint or claim is resolved, unless you still need it.

You should also think about cyber security. CCTV systems can be hacked if passwords are weak, remote access is poorly managed or vendors don't patch software. Footage of people exercising can be sensitive and embarrassing if it's leaked, so your cybersecurity privacy practices should treat it as confidential business information.

Common Mistakes To Avoid

Small mistakes with CCTV can create bigger issues than expected, especially in a customer-facing fitness space.

Watch out for these common problems:

• Putting cameras too close to private areas: even if the camera isn't inside a changeroom, its angle may still capture private activity.
• Forgetting staff notice: staff may need written notice before workplace surveillance starts, depending on your state or territory.
• Using footage for a new purpose: if you collected footage for safety, be careful before using it for unrelated staff performance monitoring or marketing.
• Recording audio without checking the law: audio creates extra consent and surveillance risks.
• Letting too many people access footage: access should be limited to people who genuinely need it.
• Keeping footage forever: long retention periods increase privacy and data breach risk.
• Not updating your privacy policy: if you add cameras, change vendors or introduce 24/7 access, your documents should be updated too.
• Posting footage online: CCTV shouldn't be used for social media content, member call-outs or staff jokes.

A simple rule helps: if a member or staff member would be surprised by how you're using the footage, your notice and policy probably aren't clear enough.

Key Takeaways

• CCTV footage can be personal information, so gyms and studios should use clear signage, a privacy policy and consistent member terms.
• Cameras are usually easier to justify in reception, entry points and training areas than in private spaces. Avoid changerooms, toilets and showers.
• Staff monitoring is a separate issue. NSW and the ACT have specific workplace surveillance rules, and other states and territories still have surveillance and employment law risks.
• Audio recording is much riskier than silent video. Check your camera settings and avoid recording conversations unless you've had tailored advice.
• Your CCTV privacy policy should explain your purposes, camera areas, access controls, disclosures, retention period and complaint process.
• Keep footage secure, limit access and delete it when you no longer need it.

If you'd like help with your CCTV privacy policy, staff surveillance notices, gym privacy policy or member terms, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.