What Changed and When

On 16 April 2026, the European Data Protection Board published Guidelines 1/2026 on the processing of personal data for scientific research. The guidelines clarify how GDPR obligations apply when organisations collect or reuse personal data for research purposes — including sports-science, injury-prevention, performance analysis, and health-related studies. For fitness businesses and personal trainers, the practical implications are immediate and concrete.

Why Fitness Businesses Are Directly in Scope

The EDPB's own illustrative example within the guidelines describes a large fitness-studio chain inviting members to consent to the pseudonymised use of their personal data for sports-medicine research. That example is not incidental — it signals that the EDPB regards gym operators, digital fitness platforms, and training providers as organisations that routinely handle data falling within the guidelines' scope.

Health data, body-composition measurements, injury records, medical conditions, and outputs from wearable devices all qualify as special-category data under GDPR Article 9. This category carries the highest level of protection under EU law, and the new guidelines reinforce that processing it for research requires more than a standard membership agreement or a general privacy notice.

The Specific Safeguards Now Required

Under GDPR Article 89(1), research processing must be accompanied by appropriate safeguards. The guidelines make clear that what counts as 'appropriate' depends on the nature, scale, context, purpose, and risks of the processing — there is no single checklist. Organisations must also establish a valid lawful basis under Article 6 before they reach the question of research-specific safeguards.

The fitness-studio example in the guidelines sets out several concrete requirements that operators should treat as a practical baseline:

• Research consent must be separate from membership. Participation in a research programme cannot be made a condition of joining or continuing as a member.

• Consent must be withdrawable at any time, without penalty or loss of service access.

• Scope must be defined. Consent should cover a specified research area, not open-ended or unspecified future uses of member data.

• Internal review is expected. The guidelines envisage that proposed research projects are reviewed by a committee with appropriate academic or scientific expertise before data collection begins.

Pseudonymisation or anonymisation should be applied wherever technically feasible. Access to research datasets should be restricted, and retention periods and withdrawal procedures must be documented.

Separating Service Delivery from Research Is Now a Structural Requirement

The core operational shift required by these guidelines is organisational, not just documentary. A gym that currently collects training metrics or wearable-device outputs under a single membership consent and then reuses that data for performance analytics, product development, or research partnerships is operating outside what the guidelines permit.

Service delivery and optional research participation must be structurally separated — in system architecture, in consent flows, and in how data is stored and accessed. A personal trainer who asks a client to sign a single form covering both programme delivery and the use of that client's data in a sports-science paper faces the same structural problem at a smaller scale.

The Broader Regulatory Context: European Health Data Space

The EDPB guidelines sit alongside a wider legislative development. The European Health Data Space Regulation establishes a legal framework for the secondary use of health data across EU member states. It expressly includes data derived from wearables and mobile health applications within its scope.

The regulation introduces authorisation requirements administered by national Health Data Access Bodies, alongside obligations covering data minimisation, pseudonymisation, anonymisation, and secure processing environments. For most personal-training services, the immediate impact is limited. However, fitness businesses that aggregate wearable or app-derived data for research, or that enter data-sharing arrangements with healthcare providers or research institutions, will need to account for this framework as it is implemented at national level.

What Training Schools and Employers Should Do Now

For training schools that include research methods or client data management in their curricula, the April 2026 guidelines provide a basis for updating learning outcomes to reflect current GDPR obligations in research contexts. Accreditation submissions that include data-handling competencies should reflect the Article 89(1) safeguard framework.

For fitness facilities and employers, the immediate priority is an audit of any process by which client data is collected under a membership or service consent and subsequently reused for analytics, research, or third-party purposes. Where such processes exist, legal review against the EDPB's published criteria — not just internal policy review — is warranted.

The guidelines are in force now. The EDPB's decision to use a fitness-chain scenario as its primary example leaves little ambiguity about which sector is expected to take notice.