Hair salon client records and India's DPDP Act: what applies, and when

Name, +91 mobile number, appointment history, the colour formula from her last global colour, the note that her scalp reacted to a particular developer: your client file is full of personal data. India now has a dedicated law for it, the Digital Personal Data Protection Act, 2023 (DPDP Act), and it applies to a hair salon in Indiranagar with eight chairs just as it applies to a two-chair studio in Pune that keeps its client list in an app.

Before you panic or pay anyone for "urgent DPDP compliance", one fact matters more than all the others: most of the Act's obligations are not in force yet. The DPDP Rules, 2025 were notified in mid-November 2025 with a deliberately phased timetable, and the core duties on businesses, consent notices, security safeguards, breach reporting, client rights, start eighteen months after publication, in mid-May 2027. Quite a lot of compliance marketing skips that detail. This guide does not: every obligation below is dated, and good practice is labelled as good practice, not law.

This guide is published by ViteUneCoupe, whose free plan gives a hair salon online booking and a client database with full appointment history. The rules below apply whatever tool you use, and the important points link to primary sources: the Act and Rules on MeitY's site and the Press Information Bureau, not somebody's compliance sales page. One honest note before we start: this is general information checked in October 2026, not legal advice and not a compliance guarantee. For anything with real stakes, talk to a lawyer practising in India.

Does the DPDP Act apply to your salon?

Yes, once your client records are digital. Under section 3 of the DPDP Act, the Act applies to the processing of digital personal data within India, whether the data was collected in digital form or collected on paper and digitised afterwards (checked in October 2026). A client list in a booking app, an Excel sheet, Google Contacts or a WhatsApp chat is squarely covered. There is no turnover threshold and no small business carve-out in the Act itself: a sole proprietor with 300 client records is covered the same way as a chain.

In the Act's vocabulary, the salon is the Data Fiduciary: the person who decides why and how client data is processed. Your booking software is a Data Processor, working on your behalf. Your clients are Data Principals. The responsibility for the file sits with the fiduciary, meaning you, whatever software sits underneath.

Three clarifications that surprise many salon owners:

• A purely paper notebook is outside the Act. The DPDP Act covers digital personal data only: paper records that are never digitised are not covered, which is different from the data protection laws of many other countries. The moment you type that notebook into an app or photograph pages "as backup", the digitised copy is covered. Practically, treat the notebook with the same care anyway: it holds the same phone numbers.
• There is no registration and no fee. A Data Fiduciary does not register anywhere or pay anything to hold a client file. The obligations are about behaviour, not paperwork you buy.
• You will almost certainly not need a Data Protection Officer. A DPO is mandatory only for Significant Data Fiduciaries, a class the Central Government designates based on volume and sensitivity of data, risk, and similar factors. A neighbourhood hair salon is nowhere near that. What every fiduciary will need, once the Rules bite, is simpler: a published contact point for data questions, which can be you.

The dates: what is in force now, and what starts later

This is the part most articles get wrong, so here it is precisely. Parliament enacted the DPDP Act in August 2023, but it only takes effect as notified. The DPDP Rules, 2025 were published in the Gazette dated 13 November 2025, and rule 1 itself staggers commencement in three phases (checked on the gazette text in October 2026). The PIB backgrounder on the Rules confirms the deliberate eighteen-month runway for businesses.

Two honest footnotes to the table. First, until the third phase arrives, India's older privacy framework under the Information Technology Act, 2000 technically remains the governing regime, as DLA Piper's India data protection summary notes (checked in October 2026); it has had little practical bite for small offline businesses. Second, the Act lets the government exempt certain classes of Data Fiduciaries, including startups, from some obligations, but no such exemption had been notified when we checked in October 2026. Do not plan around an exemption that does not exist yet.

What personal data does a hair salon actually hold?

Take an honest inventory. A typical Indian salon's client file holds:

• Contact details: name, +91 mobile number, sometimes email.
• Appointment history: dates, services, which stylist, amounts paid.
• Technical notes: colour formula, developer volume, processing time, hair and scalp condition.
• Free-text notes: "prefers the corner chair", "always 20 minutes late", and whatever else gets typed in.
• Sometimes photos: before-and-after shots kept on a record or posted to Instagram.

One useful peculiarity of the DPDP Act: it has no separate "sensitive data" category. A colour formula, a note about a scalp reaction and a phone number are all simply personal data, under one set of rules. That keeps things mentally simple, but notes about reactions still deserve extra care for a non-legal reason: they exist to keep the client safe on her next colour service. Keep them factual and minimal (product, reaction, date, no speculation), and never write anything in a record you could not comfortably show to the person it describes, because an access right is coming in 2027.

And one number to leave out entirely: any government ID. Booking a haircut or running a loyalty programme never needs an Aadhaar or PAN number, and the Act's data minimisation principle points the same way, as the PIB backgrounder lists minimisation among the law's seven core principles. A mobile number does the same job with none of the risk. The less you hold, the less you have to protect.

What the Act will ask of you from May 2027

Here is the substance of phase 3, translated into salon practice. None of this is enforceable against you today; all of it is sensible.

• Notice and consent. Processing will rest on consent, with a clear, plain-language notice of what you collect and why, or on the Act's "certain legitimate uses". The most relevant legitimate use for a salon is section 7(a): data the client voluntarily gave you for a specified purpose, like her number to manage her booking, can be used for exactly that purpose without a separate consent ritual. Marketing is a different purpose: a promotional broadcast will need its own yes. Keep service messages and promo messages separate from day one; our guide to appointment reminders for Indian hair salons covers that line, and the SMS registration regime, in detail.
• Security safeguards. Reasonable measures proportionate to the risk: one login per stylist instead of a shared password, locked screens on the reception tablet, backups, access on a need basis, and same-day removal of access when someone leaves. The highest penalty in the Act attaches to failing this one.
• Breach intimation. Under rule 7, on becoming aware of a personal data breach a fiduciary must inform each affected individual without delay, in plain language, and inform the Data Protection Board without delay, with a detailed report within 72 hours. Notably there is no minimum size: the rule as written covers any breach. If your client file lives in software, your provider's security posture becomes your problem, which is a fair question to put to any vendor.
• Client rights. Access, correction, updating and erasure, plus a published grievance contact. The Rules give fiduciaries up to 90 days to respond to a request. For a well-kept salon record, the honest answer to "what do you hold about me?" should be "of course, here it is" the same afternoon.
• Children's data. Processing a child's data will require verifiable parental consent. Salons cut children's hair every day: the practical habit is to keep the record under the parent's name and number, with the child's cut as a service note.
• Retention. Do not keep data beyond what the stated purpose needs. The Act sets no fixed period for ordinary businesses like salons: choose a cut-off for lapsed clients, write it down, apply it once or twice a year. Keep invoices as long as tax law requires; the DPDP Act never forces you to delete what other law obliges you to keep.

What is worth doing now, before any of it is law

Between now and May 2027, everything below is preparation and good practice, not a legal obligation. It also happens to be free, and it makes the 2027 deadline a non-event:

1. Collect only what you use. Name, number, service history, formulas. Drop any field you never act on.
2. Tighten access. Separate logins, a proper password on the owner account, no client exports floating around WhatsApp groups.
3. Write three sentences of notice. "We keep your contact details, service history and colour notes to manage your appointments and keep colour services safe. Ask us at any time to see, correct or delete them." Put it on your booking page. That is a sample to adapt, not an official template, and from May 2027 the formal notice requirements will be stricter, but the habit starts now.
4. Delete on request, today. A client who asks to be removed gets removed. In 2027 it becomes her right; in 2026 it is simply the decent answer, and it costs you a record you were not using.
5. Separate marketing consent from bookings. Keep a simple record of who said yes to offers. Retroactively guessing in 2027 will be painful.
6. Know where your data actually is. Which app, which spreadsheet, whose phone. If a departing stylist could walk out with the client list, fix that before any law asks you to. Who holds the client relationship is also the core of the direct bookings versus marketplaces question.

Choosing software: the salon stays the Data Fiduciary

Whatever tool holds the file, the legal responsibility stays with the salon. That makes a few questions worth asking any provider, ViteUneCoupe included, before signing or at renewal:

1. What do your terms commit to on data protection? A serious provider's terms promise security, confidentiality and processing your clients' data only on your instructions. A vendor that has never heard the question is telling you something.
2. Can you export the full file, and delete a single record? You must be able to retrieve complete client data if you change tools, and to delete a record when a client asks or your retention policy says so. A provider that locks your file in undermines duties that will be yours, not theirs. When switching, export first and verify the export opens; our guide to switching salon booking software walks through the order of operations.
3. Who owns the client relationship? Some marketplaces sit between the salon and its clients. ViteUneCoupe's position is the opposite: the client database is included in the free plan, the file belongs to the salon, it is exportable, and there is 0% commission and no marketplace in between.
4. What are the honest limits? For ViteUneCoupe in India, stated plainly: reminder, confirmation and thank-you messages on the Standard plan (from 29 € excluding tax per month, no commitment) are email only, there is no SMS or WhatsApp sending in any plan; the Standard subscription is a euro charge, with the exchange-rate movement that brings to an Indian card; and the booking page's price badge is currently a € rather than a ₹, which is why Indian salons put the rupee rate card in the free-text service descriptions. Weigh those against what you get free; our comparison of booking software for Indian hair salons does exactly that.

Penalties, in perspective

The numbers in the Act's penalty schedule are built to frighten large platforms, not salons: up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for failing to notify a breach or for violating children's data obligations, and up to ₹50 crore for other violations, per the PIB summary of the Act's penalties. Those are maximums; the Board must weigh the nature, gravity and duration of a breach when deciding anything. For a small salon acting in good faith, the realistic cost of sloppy data habits is not a nine-figure fine, it is the message you would have to send to 800 clients explaining that their file leaked. Run the habits above and both risks shrink together.

Frequently asked questions

Is the DPDP Act already in force for my salon?

The framework is, your obligations are not. Since mid-November 2025 the Act's definitions and the Data Protection Board exist, and Consent Manager registration opens from mid-November 2026, but the duties that touch a salon, consent notices, security safeguards, breach reporting and client rights, commence eighteen months after the Rules' publication, in mid-May 2027. Checked on the gazette text of the DPDP Rules, 2025 in October 2026.

Is my paper appointment notebook covered by the DPDP Act?

Not as long as it stays on paper. The Act applies to digital personal data: data collected digitally, or collected on paper and digitised later. Type the notebook into an app, a spreadsheet or your phone contacts and the digital copy is covered. Good sense says to protect the notebook the same way regardless, since it holds the same client phone numbers.

Do I need to register my salon or appoint a Data Protection Officer?

No registration exists for Data Fiduciaries, and a DPO is mandatory only for Significant Data Fiduciaries, a government-designated class aimed at large-scale processors. A hair salon will need something much simpler once the Rules apply in May 2027: a published contact point for data questions, which can be the owner.

Can I keep using WhatsApp to confirm appointments?

Messaging a client about the appointment she herself booked fits the Act's "certain legitimate uses": she gave you her number for that purpose. The caution is marketing: once the core rules apply in May 2027, promotional broadcasts will need their own consent, so keep a record of who opted in, and keep service messages free of promo lines starting now.

Does a client have the right to see or delete her record?

From mid-May 2027, yes: access, correction and erasure are rights under the Act, with up to 90 days to respond under the Rules. Until then it is not an enforceable right, but deleting the record of someone who asks is good practice, costs nothing, and is the habit the law will expect anyway.

Is there an exemption for small businesses like salons?

Not at the moment. The Act lets the Central Government exempt notified classes of Data Fiduciaries, including startups, from some obligations, but no such notification had been issued when we checked in October 2026. Plan for the May 2027 obligations as written, and treat any future exemption as a bonus.