Hair salon client records and GDPR in Ireland: the practical guide

Name, mobile number, appointment history, the colour formula on the back of a record card, the note that she reacted to a patch test in 2023: your client file is full of personal data. GDPR therefore applies to your hair salon, whether you run six chairs on a Cork high street or cut hair alone in Leitrim with a client list that lives in a notebook.

The good news is that the real obligations are smaller and more practical than most of the advice circulating online suggests. In Ireland there is no registration, no licence and no annual fee to pay to anyone. What the law actually asks of a small salon is a short written record of what you hold and why, a clear sentence or two telling clients what you do with their details, sensible security, and tidy habits around marketing and deletion.

This guide is published by ViteUneCoupe, a free online booking system for hair salons with no commission, whose free plan includes a client database with full appointment history. The rules below apply whatever tool you use, paper notebook included, and every important point links to the primary source: the Data Protection Commission (DPC), the Revenue Commissioners or the GDPR text itself, not somebody's marketing blog. One honest note before we start: this is general information, not legal advice. For anything with real stakes, talk to a solicitor or ask the DPC directly.

Does GDPR apply to your salon?

Yes, as soon as you keep information about identifiable people. A first name attached to a mobile number is enough. The framework is the EU General Data Protection Regulation together with the Irish Data Protection Act 2018, supervised in Ireland by the Data Protection Commission, which publishes guidance written specifically for SMEs and micro businesses. There is no small business exemption: the DPC's own SME guidance assumes the one person business is in scope.

Three clarifications that surprise many salon owners:

• Paper counts. A structured set of client record cards or an appointment book with client details falls under GDPR, not just software.
• There is nothing to register. Unlike some countries, Ireland has no annual data protection fee and no registration with the DPC just for holding a client file. Your obligations are about how you behave, not paperwork you file.
• A written record is still wise. GDPR's exemption from keeping a formal record of processing for businesses under 250 staff is narrower than it sounds: it falls away where processing is a regular part of the business or involves health data, and a salon's client file is both. Half a page listing what you hold, why, where and for how long covers it, and it is the first thing you would be asked for if the DPC ever called.

What personal data does a hair salon actually hold?

Take an honest inventory, paper included. A typical salon holds:

• Contact details: name, mobile number, email, sometimes a postal address.
• Appointment history: dates, services, which stylist, amounts paid.
• Technical notes: colour formula, developer volume, processing time, hair condition, preferences.
• Free-text notes: "prefers the basin by the window", "always ten minutes late", and whatever else gets typed in.
• Sometimes photos: before-and-after shots kept on a record or posted to Instagram.
• Online booking data: whatever your booking page collects, which is personal data exactly like the paper card.

One category deserves particular care. A note such as "allergic to PPD" or "scalp treated for psoriasis" is health information, and health data is special category data under Article 9 of the GDPR, as the DPC explains: its processing is prohibited except in limited circumstances, the most practical of which for a salon is the client's explicit consent. In practice: record an allergy or patch-test result with the client's clear agreement, because it exists to keep her safe, keep the note to the strict minimum (product, reaction, date, no speculation), and never share it or include it in a marketing export. Do not stop recording patch tests out of GDPR nervousness; losing that history is far worse than keeping it, and your insurer will expect to see it if a reaction ever becomes a claim.

Photos follow the same logic: keeping a before-and-after in the client's record and publishing it on your salon's Instagram are two different uses that need two separate agreements. A verbal yes for the record card does not cover publication.

Finally, remember that free-text notes are readable by the client if she ever asks for a copy of her data. A simple rule keeps you safe: never write anything in a client record you could not comfortably show to the person it describes.

What legal bases cover a salon's client data?

GDPR requires every use of personal data to rest on a legal basis, and the DPC's guidance on legal bases is clear that there is no hierarchy: you pick the one that honestly fits, and consent is not the default for everything. Three cover almost everything a salon does:

• Performing the service (contract): booking the appointment, looking up last visit's colour formula, contacting the client if you need to move her slot. No separate consent needed; this is the business relationship itself.
• Legal obligation: keeping invoices and accounts for Revenue. Revenue requires business records to be kept for six years, and GDPR never forces you to delete what tax law obliges you to keep.
• Consent: publishing a photo, recording health information such as a patch-test result (explicit consent, because it is special category data), and most promotional messages, which have their own extra rules covered below.

Telling clients what you do with their data

GDPR requires clear information at the point you collect details, and the DPC's transparency guidance frames it as a duty to communicate in plain language: who holds the data, what for, how long, who it is shared with, and what rights people have. For a salon, two simple measures cover it:

• In the salon: a short notice at reception, along the lines of "We keep your contact details, service history and any allergy notes to manage your appointments and keep colour services safe. Ask us at any time to see, correct or delete them."
• Online: a privacy notice on or linked from your booking page, visible where clients type in their details, naming the software that stores the data.

Information is not consent: you do not need every client to sign a form just so you can keep a record card. You simply need to make it easy for her to find out what you do.

How long should you keep client records?

GDPR's storage limitation principle says you must not keep personal data longer than you need it, and it deliberately sets no fixed retention period for client records: you choose your own, justify it, write it down and apply it. For an Irish salon, a defensible and easy-to-run policy looks like this:

The 3-year figure for lapsed clients is an example of a reasonable policy, not a legal deadline: what matters is that you pick a period you can justify, document it and actually apply it. Practically, once or twice a year, sort your client file by last appointment date and delete or anonymise the dormant records past your cut-off. Accounting data is different: it sits in archive until the Revenue six-year clock runs out, then gets destroyed.

Appointment reminders or marketing messages: two different regimes

This is where Irish rules have real teeth, so it is worth getting exactly right.

Service messages (a booking confirmation, a reminder the day before, a message about a schedule change) are administrative communications about an appointment the client herself booked, not direct marketing, as long as they stay purely informative. "Your appointment is tomorrow at 2pm" is a service message; "Your appointment is tomorrow at 2pm, and ask us about our colour offer" is marketing. The automatic confirmation, reminder and thank-you emails in ViteUneCoupe's Standard plan (from 29 € ex-VAT per month, billed in euros, no commitment) are exactly this kind of message, and our guide to appointment reminders for Irish hair salons covers timing and wording in detail. One honest product note: ViteUneCoupe sends email only, there is no SMS in any plan.

Marketing messages (a colour promotion, a birthday offer, a "we have not seen you in a while" discount) fall under the Irish ePrivacy Regulations, SI 336 of 2011, on top of GDPR. The DPC's rules for electronic direct marketing set the general rule, which is prior opt-in consent, with one practical exception for existing customers under Regulation 13(11). You may email or text marketing to an existing client without separate consent only if all of these hold at once:

1. you obtained her details in the context of a sale, so an actual paying client, not an enquiry;
2. you are marketing your own services, similar to what she bought;
3. she was clearly offered the chance to object when you collected her details, and again in every single message;
4. the first marketing message goes out within 12 months of the sale.

The classic trap: recycling numbers and emails collected for bookings into a promotional list without ever having offered that opt-out. If you plan campaigns, add the tick-box at the moment you first collect contact details, keep the evidence, and honour every unsubscribe before the next send. The DPC takes this seriously: sending marketing without a valid basis, or to someone who opted out, is a criminal offence, and the DPC prosecutes companies for unsolicited marketing messages, with each message a separate charge. Done properly, a gentle rebooking email is still one of the best tools a salon has; our guide to client retention and rebooking for Irish salons goes through the sequences that work.

Your clients' rights over their data

Four requests can land at reception, and the DPC's guide to individuals' rights under GDPR frames them all:

• Access: "What do you hold about me?" You provide the full record, free-text notes included, normally within one month.
• Rectification: a wrong number or misspelt name gets corrected.
• Erasure: "Delete my record." You delete contact details and history, but you keep what the law obliges you to keep, such as invoices in her name for the Revenue retention period, and you say so.
• Portability: a client can ask for a copy of her data in a reusable format.

No formality is required from the client: a verbal request at the basin counts, although asking her to put it in writing makes your life easier. For a well-kept salon record the practical answer is almost always "of course, here it is" on the spot, which is the point of writing factual notes.

Securing the client file: the basics

Translated for a salon, the DPC's expectation of security proportionate to the risk means:

• One login per person: each stylist has their own account in the software, not a shared password on a sticky note at reception.
• Strong, separate passwords, different from personal accounts.
• Backups: a single paper notebook can be lost in a flood or a break-in; an Excel file on one laptop with no backup is no better.
• Locked devices: the reception tablet locks when it is put down, the laptop does not go home unencrypted.
• Leavers handled same-day: when a stylist leaves, her access ends immediately. A client list walking out with a departing stylist is a data protection problem as well as a commercial one.

If a serious breach happens (the file is stolen, the account is hacked), the DPC's breach notification rules require notifying the DPC without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to pose a risk to the people concerned. Either way, write down what happened, what you did and what you changed: that record is required even for breaches you do not report.

What to check in your booking software

As soon as your client file lives in software, the provider processes data on your behalf: you are the controller and it is your processor, a relationship the DPC expects to be governed by a written contract covering security, confidentiality and what happens to the data at the end. You remain responsible for the file. Four questions to ask any provider, ViteUneCoupe included, before signing or at renewal:

1. Is there a data processing agreement? Serious providers build Article 28 processing terms into their contract. If a vendor has never heard the question, that tells you something.
2. Where is the data hosted? Hosting within the EU or EEA keeps things simple because the GDPR applies directly; hosting outside it is not forbidden but needs transfer safeguards, so ask which ones. And be wary of the reverse shortcut: "hosted in the EU" on its own is a location, not a compliance certificate. Security practices, access controls and the processing contract matter just as much.
3. Can you export your file? You must be able to retrieve your complete client data if you change tools, and to delete a record when a client asks. A provider that locks your file in puts you in breach of your own obligations; our guide to switching salon booking software in Ireland explains how to export before you cancel.
4. Who owns the client relationship? Some marketplaces sit between the salon and its clients, who become users of the platform as much as clients of your salon. ViteUneCoupe's position is the opposite: the client file belongs to the salon, exportable, with no marketplace in between. Export rights and data questions sit high in our comparison of booking software for Irish hair salons too.

Frequently asked questions

Do I need to register my salon with the Data Protection Commission?

No. Ireland has no registration system and no annual data protection fee for ordinary businesses: GDPR obligations apply automatically, with nothing to file just for holding a client file. What the DPC expects from a micro business is behaviour, not paperwork: know what you hold and why, tell clients in plain language, keep it secure, answer requests within a month, and do not keep data forever.

Are colour formulas and allergy notes special category data?

The colour formula itself is ordinary personal data. An allergy note or patch-test result relates to health, which is special category data under Article 9 of the GDPR: record it with the client's explicit agreement, keep it minimal and factual, and never share it or use it for marketing. Keep recording patch tests; they protect the client and you, and your insurer will want the history if a reaction ever becomes a claim.

Can I email or text promotions to my clients in Ireland?

Only with opt-in consent, or under the existing customer exception in Regulation 13(11) of the ePrivacy Regulations: the client actually bought from you, you market your own similar services, she could object both when you collected her details and in every message, and the first marketing message went out within 12 months of the sale. Breaching these rules is a criminal offence that the DPC prosecutes. Appointment confirmations and reminders are service messages, not marketing, and need no marketing consent.

How long can I keep a client's record after her last visit?

GDPR sets no fixed period: you choose one, justify it, write it down and apply it. A documented policy such as "deleted three years after the last appointment" is easy to defend and easy to run. Invoices and accounts follow Revenue's rules instead and must be kept for six years, even if the client card itself is long gone.

Is a paper appointment book covered by GDPR?

Yes. Structured paper records such as client cards or an appointment book with contact details are covered just like software. The same rules apply: tell clients what you keep, do not keep it forever, keep the book out of sight of other clients, and show or delete a record if its owner asks.

What happens if a small salon ignores all this?

The DPC can issue reprimands, orders and fines under GDPR, and it criminally prosecutes unlawful electronic marketing, with each message a potential separate charge. For a small salon acting in good faith, the realistic day-to-day risks are closer to home: an ignored access request turning a loyal client into a formal complaint, a marketing text to someone who opted out, or a client file leaving with a departing stylist. A short retention policy, a plain privacy notice and tidy opt-out habits cover the essentials.