Client records and GDPR in salons

Why client records matter

A good client record is more than a name and phone number. It helps you remember the colour formula from the last visit, the toner that suited a client, the patch test date, the beard shape a barber client prefers, or the massage pressure someone does not want. In a busy salon, it stops important details living only in one team member's head.

Client records also carry legal and trust responsibilities. In the UK, personal data is covered by UK GDPR and the Data Protection Act 2018. The regulator is the Information Commissioner's Office, usually called the ICO. This article is general information for salon owners, not legal advice, but it should help you make better day-to-day decisions.

The simple rule is this: keep what you genuinely need, explain why you keep it, protect it properly, and remove it when you no longer have a reason to hold it.

What data to keep

Start with practical information that supports the appointment and the client relationship. For most salons, this includes contact details, appointment history, service notes, product preferences, payment history and communication preferences. A hair salon may need colour formulas and patch test notes. A beauty or aesthetics business may need treatment notes, consultation answers and consent history. A barber may need preferred clipper grades or skin sensitivity notes.

Avoid collecting details just because a form has space for them. If you do not use a date of birth, do not ask for it, unless it is needed for age-restricted services, insurance or treatment suitability. If an emergency contact is not relevant to your work, leave it out. The less unnecessary data you hold, the easier it is to protect.

Useful client record fields may include:

• Name, phone number and email address
• Appointment history, no-shows and cancellations
• Service notes, formulas, preferences and aftercare given
• Patch test dates, consultation answers and consent forms
• Communication preferences, such as email or WhatsApp

Health details need extra care

Allergies, medical conditions, medication, pregnancy, skin conditions and similar notes are not ordinary admin details. Under UK GDPR, health information is special category data. That means you need a clear lawful basis for using it and an additional condition for special category data. In many salon settings, explicit consent is often the most practical route, especially for recording health details that help you decide whether a treatment is suitable.

Explicit consent must be clear and specific. A vague line such as, 'I agree to everything', is not enough. The client should understand what you are recording, why you are recording it, who can see it, and that they can withdraw consent. For example, you might ask a colour client to confirm that you can record allergy and patch test information so your team can safely provide colouring services.

Do not hide sensitive information in casual notes where anyone can miss it or misuse it. Make allergies and safety alerts visible to the people who need them, but not to everyone by default. In Agendessa, allergies and alerts can be shown in red in the calendar, which is useful because the warning appears at the point where the team member needs to act.

Consent forms and photos

Consent forms work best when they are part of the client journey, not a forgotten folder behind reception. Before a treatment, the client should have time to read the form, ask questions and sign only when they understand it. A tablet can make this simpler, especially for consultation forms, patch test confirmations and treatment consent. Agendessa supports forms and consents signed on a tablet, with the signed record kept with the client file.

Photos need careful handling. Before and after images are often useful for colour corrections, skin progress, brow mapping, nail art, tattoo work or aesthetics treatments. They can help you compare results over time and protect both the client and the business if there is a later question about what was done.

Photos are personal data, and sometimes they may reveal health details or other sensitive information. Get consent before taking them. Be especially clear if you want to use a photo for marketing, social media, your website or training. Consent to store a treatment photo in the client record is not the same as consent to post it on Instagram.

• Ask before taking the photo
• Record why the photo is being kept
• Get separate consent for marketing use
• Avoid showing the face if it is not needed
• Delete marketing photos if consent is withdrawn, where possible

Access by role

Not everyone in the salon needs to see everything. A receptionist may need contact details and booking notes. A stylist may need colour history, allergy alerts and patch test records. A manager may need payment history and reports. A junior team member may not need access to sensitive consultation forms at all.

Role-based access is a practical way to reduce risk. It also reassures clients that their details are not open to the whole team without reason. If you use salon software, check whether you can set permissions for owner, manager, reception and specialist roles. In Agendessa, roles include owner, manager, reception and specialist, and a specialist can be limited to see only their own agenda.

Access control is not only a software setting. It is also a habit. Do not leave client records open on the reception screen while another client is paying. Do not discuss a client's medical notes where others can hear. If you print forms, lock them away. If a team member leaves, remove their access promptly.

Retention and deletion

UK GDPR does not give every salon one fixed number of years for every record. Instead, you should decide on a retention period that fits the reason you keep the data. Appointment notes may be needed for service history. Financial records may need to be kept for tax and accounting. Consent forms and treatment records may be needed for insurance or if a complaint arises. The key is to have a clear policy and follow it.

Think in categories. You might keep basic client contact details while the client is active, then review them after a period with no visits. You might keep payment and invoice records for the period required for business accounts. You might keep treatment consent records for longer where your insurer requires it. Speak to your accountant, insurer or legal adviser if you are unsure.

Deletion should be real. If a client asks to be removed from marketing, do it promptly. If there is no good reason to keep an old consultation form, delete it securely. If you use spreadsheets, shared drives, printed forms and a booking system, remember that client data may exist in several places.

• Write down how long you keep each type of record
• Review lapsed clients on a regular schedule
• Separate marketing opt-outs from full deletion requests
• Check backups, exports and paper copies
• Do not keep data just in case

Client rights and daily habits

Clients have rights over their personal data. These include the right to be informed, the right of access, the right to correct inaccurate data, the right to erasure in some situations, the right to restrict processing, the right to object to some uses, and rights around data portability. In plain English, a client can ask what you hold about them, ask you to correct it, and sometimes ask you to delete it.

You should have a privacy notice that is easy to understand. It should explain what data you collect, why you collect it, how long you keep it, who you share it with, and how clients can contact you about their data. Put it on your website if you have one, and make it available in the salon. If you send marketing by email or WhatsApp, make sure clients know what they are signing up to and can opt out.

Good GDPR practice is built from small habits. Check the client's phone number before sending a reminder. Do not write harsh personal comments in notes. Use neutral, factual language, such as 'prefers quiet appointment' rather than a judgement about the client. Keep passwords private. Train new team members before giving them access to records. If something goes wrong, such as a message sent to the wrong person, record what happened and consider whether you need to report it to the ICO.

Frequently asked questions

← All articles