GDPR for Beauty Salons: A Practical Data Protection Checklist

Yes. The GDPR applies to any business that processes personal data of people in the EU, regardless of size, and the UK GDPR applies in the same way in the United Kingdom. A solo nail technician with a client list on her phone is processing personal data just as much as a clinic with ten practitioners.

Some obligations scale with risk and size, but core principles such as transparency, security and purpose limitation apply to everyone. In the UK, most businesses that process personal data must also pay a data protection fee to the ICO unless an exemption applies; check the ICO's guidance for your situation.

Each type of data needs a purpose and a legal basis. For most salon data, the basis is the contract with the client: you need their name and contact details to book and carry out a treatment. Some processing relies on legal obligations, such as keeping invoices for tax purposes, and some requires consent.

Information about medication, allergies, skin diseases, pregnancy or medical conditions is health data, which belongs to the special categories of personal data under Article 9 of the GDPR. Processing it is only allowed under specific conditions, such as explicit consent, and it requires a higher level of protection.

In practice: collect only what you need for the treatment decision, explain why you ask, restrict access to the practitioners who need it, and never leave forms visible at reception or stored as photos on personal phones. Digital forms stored in encrypted software with role-based access are usually safer than paper files in an open cabinet.

Photos in which a client can be identified are personal data, and photos showing skin conditions or treatment results can also reveal health information. Taking photos for the client record and using them in marketing are two different purposes and should be treated separately.

Before posting a photo on Instagram, your website or in an advert, get the client's explicit, specific and freely given consent, ideally in writing or as part of a digital form. Explain where the photo will appear and that they can withdraw consent at any time. If they withdraw, remove the photo from channels you control.

When booking or client records software stores data on your behalf, the provider is a processor under Article 28 GDPR, and you need a data processing agreement (DPA) with them. Reputable providers make this available as standard.

Also ask where data is hosted, whether it is encrypted in transit and at rest, how backups work, which sub-processors are used and how access is controlled. Hosting within the EU simplifies matters for EU salons, as it avoids many international transfer questions. Treatflow, for example, hosts data on EU servers in Frankfurt and the studio remains the owner of its client data.

The GDPR does not set fixed retention periods. It requires you to keep personal data no longer than necessary for the purpose. Other laws do set periods, for example tax rules for invoices, and many studios also keep treatment records for a period linked to limitation periods for liability claims or to their insurer's guidance.

Write down your retention periods for each type of data, mention them in your privacy notice and apply them. Inactive marketing contacts, for example, should not be kept forever. A yearly clean-up date in the calendar is a simple way to stay on track.

Clients can ask to see the data you hold about them, correct it, have it deleted in certain circumstances, receive it in a portable format and object to marketing. You generally have one month to respond. Deletion can be limited where you must keep data for legal reasons, such as invoices, but you should then restrict its use.

Prepare a short internal process: who receives requests, how identity is verified, where the data is found and how the response is documented. Software that lets you export and delete client data easily makes this much simpler.

A data breach can be as simple as a lost phone with client photos, a misdirected email containing a consultation form or a hacked email account. If a breach is likely to result in a risk to individuals, you must report it to your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. High-risk breaches must also be communicated to the affected clients.

Keep an internal record of every breach, even minor ones you do not need to report, including what happened, the effects and what you did about it.

Use this checklist as a starting point and review it once a year or whenever you introduce new software, services or marketing channels.