The Bright Line at the Changing Room Door: Auditing Cameras in UK Leisure Centres in 2026
Photo by Photo by Mingming Ouyang on Unsplash on Unsplash
A leisure centre is an unusual kind of public building. The same visitor who presents a membership card at reception will, twenty minutes later, be partially dressed in a changing village, barefoot at the poolside, or sitting in a sauna. Surveillance in these spaces is not inherently improper — theft from lockers, safeguarding incidents and, increasingly, drowning detection all provide legitimate reasons for a camera to exist — but the margin for error is narrow, and the consequences of a misplaced lens are considerable. The purpose of this audit is to separate the defensible from the indefensible, and to give members a practical route to challenge what they see.
Where the law actually draws the line
There is no single statute headed "leisure centre cameras". Instead, several instruments overlap. The UK GDPR and the Data Protection Act 2018 govern the processing of identifiable images, requiring a lawful basis, a documented purpose, minimisation and a defined retention period. The Human Rights Act 1998 gives effect to Article 8, which protects private life — and courts have consistently recognised that a reasonable expectation of privacy is at its strongest where people undress.
The criminal law reinforces that expectation. Section 67 of the Sexual Offences Act 2003 created the offence of voyeurism, and the Voyeurism (Offences) Act 2019 extended it to so-called upskirting. Recording a person in a place where they would expect privacy, for sexual gratification, is a criminal matter, not merely a regulatory one. Operators should read those provisions as the outer wall of a structure whose inner rooms are governed by data protection.
For local authority-run sites, the Protection of Freedoms Act 2012 adds a further layer of governance around surveillance camera systems, requiring codes of practice and, in England and Wales, regard to the Surveillance Camera Commissioner's principles — now folded into the ICO's oversight after the commissioner's functions were consolidated. The practical effect is that a council-run pool should be able to produce a written justification for every camera it operates, and a private chain should be able to do something equivalent under its own accountability obligations.
The bright line, then, is not difficult to state: no camera may capture images of a person in a state of undress. In practice, the disputes arise not at the door of the changing room but in the zones that surround it.
The grey zones: poolside, sauna and the changing village
Poolside cameras attract the most confusion because two different technologies have converged. Drowning-detection systems, such as those deployed in a number of UK pools, use submerged and overhead cameras to alert lifeguards to a stationary body. These are safety instruments, and their value is considerable. But if the footage is recorded and retained — even briefly — it becomes personal data, and the same rules apply. Members are entitled to know whether a system is monitoring only, or whether it keeps a record, and for how long.
Saunas and steam rooms should be treated as changing-room equivalents. A camera covering the door from outside is one thing; a lens that sees into the room is another entirely, and no amount of signage will cure it.
Changing villages — the open-plan layouts with cubicles that many operators adopted in place of single-sex communal changing — are the most common source of complaint. A camera mounted to cover the corridor may, from its angle, capture the gap beneath cubicle doors or the reflection in a mirror. Operators should test sightlines at installation and after any refit, and should be prepared to move a unit by a metre rather than argue about whether the intrusion is material.
On the gym floor, the emerging issue is the camera used for form analysis and movement coaching. These are not security devices, and they should not be described as such. Where a gym offers such a service, it needs a lawful basis, a data protection impact assessment if the processing is systematic, and a clear opt-in rather than a line buried in the membership terms.
What good practice looks like for operators
Signage should be placed before the point of capture, not after it. It should name the operator, state the purpose, give a contact for the data protection officer and point to the retention period. Cameras that cover circulation areas should not be angled towards changing facilities, and access to footage should be restricted to named staff with an auditable log. Retention should be short — fourteen to thirty days is common for security purposes — and enforced by automatic deletion rather than by good intentions. Where footage is exported for an incident, it should be held separately under a documented case reference, not left on a shared drive.
Staff monitoring deserves its own paragraph. Cameras that watch lifeguards, cleaners or instructors constitute workplace monitoring, and the ICO expects proportionality, transparency and, where monitoring is continuous, a meaningful assessment of its impact on the workforce.
A member's practical audit checklist
- Note where cameras are mounted and what they appear to cover. Photograph signage, not people.
- Check whether the changing area is covered by any lens, including via mirrors, reflections or gaps under cubicle doors.
- Confirm whether a poolside system is monitoring-only or recording, and whether the operator will say so in writing.
- Ask reception for the privacy notice and the retention period. A well-run site will have both to hand.
- If something looks wrong, raise it in writing with the operator's data protection contact the same day, so the footage still exists.
Making a subject access request without being fobbed off
A subject access request does not require a form, a fee or a stated reason. Write to the operator's data protection officer — not the front desk — describing the date, time and location, and asking for a copy of any footage in which you appear plus confirmation of the retention period. Keep a copy of the request.
The controller must respond without undue delay and within one month, extendable by two further months where the request is complex. If you are told that footage has been overwritten, ask when the deletion schedule ran and for the retention policy that governed it. If you are told the system does not record, ask for that in writing. Persistent obstruction can be escalated to the Information Commissioner's Office, which does not award compensation but does investigate and can issue enforcement notices.
Where the concern is not a data protection matter but a suspected criminal act — a lens in a cubicle, a hidden device — the police should be involved directly, and the site's safeguarding lead informed. Those cases move faster than any regulatory complaint.
Leisure centres are rightly watched. Theft, accidents and safeguarding failures are real, and cameras help. But the bargain is conditional: the lens stops at the door, the purpose is stated, and the footage does not outlive the reason it was collected. Members who understand that are harder to fob off, and operators who anticipate the question tend to run tighter systems.
