GDPR and client records for salons: what you actually need to do

What you are allowed to keep

Anything you need to deliver the service safely and run the business: contact details, appointment history, patch-test dates, allergies, colour formulas, consent to treatments. Health-related notes need a clear reason (client safety) and should be kept only as long as they are useful.

Tell clients what you keep and why

A short privacy notice on your booking page does this: what you collect, why, how long you keep it, and how to ask for a copy or deletion. Plain language is fine.

Consent and patch tests

Consent forms and patch-test records should be dated and linked to the client. A digital intake form that the client completes before the appointment does this automatically and is easier to find than a folder of paper.

How long to keep records

There is no single number in the law. A common approach for salons is to keep treatment records for as long as the client is active plus a few years for insurance purposes, then delete. Write your rule down and apply it.

Marketing messages

Reminders about a booked appointment are fine. Promotional texts and emails need the client's agreement, and every message needs an easy way to opt out.

Security basics

• Password-protected software rather than a shared notebook or a phone contacts list.
• Staff see only what they need.
• Backups you do not have to think about.
• Export and delete a client's data on request.

Do I need to register with the ICO?

Most UK businesses that process personal data pay a small annual data protection fee to the ICO. Check the ICO's self-assessment tool for your situation.

Frequently asked questions