Gym Access Control and Member Data: Face Scans, NRIC and PDPA

What member data a gym holds, and why it matters

A typical gym or studio collects contact details, date of birth, emergency contacts, health declarations, payment details, visit logs, CCTV footage and often a face or fingerprint for the door. Much of this sits with vendors: the gym management app, the door system, the payment provider and the CCTV supplier.

Under the PDPA your gym stays responsible for that data even when a vendor holds it. The more sensitive the data, the more care PDPC expects, and biometric data and ID numbers are at the top of the list because they cannot be changed if leaked.

Face and fingerprint entry: what PDPC expects

PDPC's Guide on the Responsible Use of Biometric Data in Security Applications (May 2022) covers access control systems directly. Its main points for a gym:

• Consider alternatives first. Before deploying biometric access control, be clear on the problem and consider non-biometric options like keycards, or Singpass, or using the phone's built-in biometrics.
• Get consent. PDPC recommends seeking explicit consent when enrolling users. For staff, the employment exception may apply.
• Store templates, not photos. Process the face or fingerprint into a biometric template as soon as practicable and discard the original sample.
• Protect the templates. Encrypt them where practicable, protect the system against tampering, and use secure connections if it runs in the cloud.
• Guard against spoofing. Consider liveness detection against photos, videos or masks, set a reasonably high matching threshold, and place sensors where staff or cameras can see them.
• Delete when no longer needed. PDPC's example: when someone leaves, revoking their access is insufficient; the samples and templates should be permanently deleted.

NRIC numbers: why gyms should stop collecting them

PDPC's Advisory Guidelines on NRIC and other national identification numbers say organisations are generally not allowed to collect, use or disclose NRIC numbers or copies of the NRIC, unless required by law or needed to establish or verify identity to a high degree of fidelity. A gym membership rarely meets that bar.

• Use a mobile number, email or your own member number to identify members.
• If you need a short identifier at the counter, the guidelines treat up to the last three digits and checksum letter of an NRIC as not collecting the full number, but it is still personal data to protect.
• Do not scan or photocopy NRIC cards at sign-up, and do not keep old copies from years ago.
• Never use NRIC numbers, full or partial, as a member's password or to verify who they are for account changes.

Our guide to NRIC collection rules under the PDPA covers the exceptions and the 2025 advisory on not using NRIC numbers to authenticate people.

QR codes, app passes and keycards as alternatives

Many gyms combine options: a rotating QR code in the app as the default, with face entry offered as an opt-in convenience. If pass-sharing is the real problem, CCTV at the entrance plus rotating codes often solves it without collecting templates from every member.

CCTV in 24-hour and unmanned gyms

Unmanned gyms usually rely on CCTV for safety and to deter misuse. The PDPA allows this with the right notices and limits. PDPC's Advisory Guidelines on the PDPA for Selected Topics say notices should give people sufficient awareness that CCTV is in use, without revealing every camera's location.

Our CCTV and PDPA guide covers notices, access requests and retention in more detail.

Vendor contracts and breach notification

Your access control vendor, gym management app and CCTV installer usually process member data on your behalf, which makes them data intermediaries. PDPC's biometric guide says the organisation remains responsible for compliance and suggests contract terms on safeguarding and retention, with standard procedures for who can extract data.

1. 1

   Find out where the data sits

   Ask each vendor where templates, photos, logs and footage are stored, in which country, and who at the vendor can access them.

2. 2

   Put obligations in the contract

   Security measures, encryption of templates, retention periods, deletion on request and at contract end, and breach notification to you without delay.

3. 3

   Control admin access

   Each staff member gets their own login with two-factor where available; remove access the day someone leaves.

4. 4

   Plan the exit

   Agree how member data is returned or deleted if you change vendor or close, with written confirmation.

If member data is exposed, the PDPA's breach rules apply. You have up to 30 days to assess a suspected breach. If it is notifiable, because it is likely to cause significant harm or affects 500 or more people, you must notify PDPC within 3 calendar days of deciding so. Our data breach notification guide walks through the steps.

Do it yourself or get help?

A small gym can do most of this itself: switch to member IDs instead of NRIC, offer a QR or keycard alternative, write a short biometric consent notice, set CCTV retention and check vendor contracts. This guide is general information, not legal advice; for unusual setups, take advice. If you are also reviewing your membership terms, our gym website and membership guide covers prepayment and cancellation.

Our PDPA Compliance Pack (S$690) prepares your privacy policy, personal data inventory, staff data protection policy and breach response plan. A Security Health Check (S$290) reviews your domain, website, email and Microsoft 365 or Google Workspace settings, including admin roles and MFA, with a ranked fix list.