Fresh Cyber Figures Put Fitness Client Data in the Spotlight

The timing matters because cyber insurance for small and medium-sized businesses is also being examined by federal parliament. Industry representatives recently told the House Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations that take-up among smaller businesses remains low, despite softer pricing and simpler buying processes in parts of the market. The committee is due to report by 31 March 2027, so further policy discussion is likely before any concrete recommendations emerge.

For trainers, the practical implication is that cyber exposure should be reviewed alongside more familiar risks such as client injury, property damage and advice-related claims. A hacked booking account, a compromised email address or an exposed spreadsheet of client health information may not look like a traditional gym-floor incident, but it can still cause downtime, reputational damage and costs linked to notifications, recovery support or specialist advice.

That does not mean every personal trainer needs the same cyber insurance arrangement. A sole trader using established third-party apps may have a different exposure from a studio that stores client records locally, runs online programmes, employs staff or accepts recurring card payments. Policy wording also matters: some cyber policies focus on incident response and data recovery, while others may include business interruption, liability, extortion or funds transfer fraud sections, subject to limits and exclusions.

The update is also a reminder that cyber cover does not replace public liability and professional indemnity. Those covers address different kinds of loss, and gaps can appear when business activities change faster than insurance arrangements. Trainers expanding into online coaching, nutrition guidance, app-based programmes or staff-managed administration may need to check whether existing policies still reflect how the business actually operates.

The safest reading of the latest figures is not that a cyber incident is inevitable, but that small operators should not assume they are too minor to be targeted. Basic controls, staff awareness, secure passwords, multi-factor authentication, clear data handling practices and careful review of insurance terms can all help turn a vague digital concern into a managed business risk.