DPDP Act 2023: what every Indian fitness operator must do

The Digital Personal Data Protection Act (DPDP Act) 2023 is the biggest privacy law change India has ever passed. If you collect a member's name, phone number, photograph, or biometric — and every gym does — you are a "Data Fiduciary" under the Act.

Here is the lawyer-reviewed checklist of what your gym needs in place. AskFitness ships most of this by default, but you still need to do the operational pieces.

1. Notice at the point of collection

Every membership form, app sign-up, and biometric enrolment must show a notice in plain language: what data you are collecting, why, who you share it with, how to withdraw consent, how to file a grievance. The notice must be available in the member's preferred language (Hindi at minimum).

2. Explicit, granular consent

Bundled consent ("by signing up you agree to everything") is not valid. You need separate consents for: marketing communications, sharing with third-party trainers, biometric storage, photographs in social media. Each with its own opt-in checkbox and timestamp.

3. Purpose limitation

You can only use member data for the specific purpose you collected it for. If you collected an attendance photograph for check-in, you cannot then use it in a Diwali marketing email without separate consent.

4. Security & breach response

• Encryption at rest and in transit
• Access logs for who viewed what data when
• A documented breach response plan
• Notification to the Data Protection Board within 72 hours of a breach

5. Grievance officer

Every Data Fiduciary needs a named, contactable Grievance Officer who can respond to data subject requests (access, correction, erasure, withdrawal of consent) within 90 days. This person's email must be on your privacy notice.

6. Data minimisation & retention

Don't collect what you don't need. Don't keep what you no longer need. Members who left two years ago should not have their personal data on your servers — unless you have a legal obligation to retain it.

Penalties

Up to ₹250 Cr per breach for a Significant Data Fiduciary. Up to ₹50 Cr for general non-compliance. The Board has been active since late 2024 — they have already opened proceedings against several Indian fitness apps.

Compliance is not a checkbox you do once. It's a posture. The platform helps with 80% of it; the operational pieces are on you.