Hair salon client records and the PDPA in Malaysia: what the law really asks

Name, +60 mobile number, appointment history, the colour formula from her last balayage, the note that her scalp reacted to a particular developer: your client file is full of personal data. Malaysia's Personal Data Protection Act 2010 (PDPA) therefore applies to your hair salon, whether you run eight chairs in a Bangsar shoplot, a two-chair studio in Penang, or keep the whole client list in a notebook next to the till in Ipoh.

The PDPA also just had its biggest overhaul since it came into force: the Personal Data Protection (Amendment) Act 2024 commenced in three phases during 2025, raising maximum penalties to RM1,000,000, renaming "data users" to "data controllers" and introducing mandatory breach notification. Plenty of compliance marketing has used those headlines to frighten small businesses. The reality for a salon is calmer: most of what the law asks is honest habits, and the scariest-sounding new duties, like appointing a data protection officer, do not apply to a business of your size at all.

This guide is published by ViteUneCoupe, a free online booking system for hair salons with no commission, whose free plan includes a client database with full appointment history. The rules below apply whatever tool you use, paper book included, and the important points link to primary sources: the Act itself, the Personal Data Protection Department (pdp.gov.my) and analyses by law firms practising in Malaysia, not somebody's compliance sales page. One honest note before we start: this is general information, not legal advice. For anything with real stakes, talk to a Malaysian lawyer or check with the Personal Data Protection Commissioner's office.

Does the PDPA apply to your salon?

Yes, as soon as you process information about identifiable people in connection with a commercial transaction, which is exactly what a client file is. A first name attached to a +60 number is enough, and there is no small business exemption: the Personal Data Protection Act 2010 (Act 709) applies to sole proprietors and Sdn Bhd companies alike (checked in October 2026). Since 1 April 2025 the law calls you a data controller rather than a "data user": same role, new name, meaning the person who decides why and how client data is processed. That is you, the salon owner, whatever software sits underneath.

Three clarifications that surprise many salon owners:

• Paper counts. A box of client record cards or an appointment book with phone numbers is personal data just like software.
• You almost certainly do NOT need to register with the Commissioner. Registration under the PDPA applies only to the 13 classes of data controllers specified by the Class of Data Users Order 2013, such as banking, insurance, healthcare, education, tourism and hospitality, and utilities (checked in October 2026). Hairdressing is not among them, so an ordinary hair salon has no registration to file and no fee to pay. The list can be amended, and the Commissioner ran several public consultations on PDPA rules during 2025, so a once-a-year glance at pdp.gov.my is a cheap habit.
• You almost certainly do NOT need a data protection officer. Since 1 June 2025 some organisations must appoint a DPO, but only above thresholds a salon never reaches. More on that below.

What changed with the 2024 amendments

The Amendment Act commenced in phases on 1 January, 1 April and 1 June 2025, as set out in DFDL's implementation analysis (checked in October 2026). For a salon, the parts that matter:

On the DPO: under the Commissioner's guidelines, appointment is mandatory only where processing involves personal data of more than 20,000 individuals, sensitive personal data (including financial data) of more than 10,000 individuals, or regular and systematic monitoring of individuals, per DLA Piper's summary of the February 2025 guidelines (checked in October 2026). A salon with 1,500 clients is nowhere near either number. You still carry the ordinary duties below; you just do not need to hire or designate an officer, register one with the Commissioner, or pay anyone for the privilege.

What personal data does a hair salon actually hold?

Take an honest inventory, paper included. A typical Malaysian salon holds:

• Contact details: name, +60 mobile number, sometimes email or address.
• Appointment history: dates, services, which stylist, amounts paid in RM.
• Technical notes: colour formula, developer volume, processing time, hair condition.
• Free-text notes: "prefers the corner chair", "always 15 minutes late", and whatever else gets typed in.
• Sometimes photos: before-and-after shots kept on a record or posted to Instagram.
• Staff data too: if you use a fingerprint clock-in device, that is now sensitive biometric data under the amended Act, with stricter consent and security expectations.

One number to leave out: the MyKad / NRIC number. Malaysia has no outright ban on collecting it, but the General Principle says personal data must not be excessive for the purpose, and booking a haircut or running a membership card never needs a national identity number. A mobile number or a membership code does the same job with none of the risk. The less you hold, the less you have to protect.

Health-adjacent notes deserve care: "reacted to the previous colour brand" exists to keep the client safe on her next colour service. Keep such notes factual and minimal (product, reaction, date, no speculation) and never pull them into a marketing export. And remember that free-text notes are readable by the client if she ever asks for her data: never write anything in a record you could not comfortably show to the person it describes.

The seven principles, translated into salon practice

The PDPA is built on seven data protection principles. Here is each one as a salon habit rather than a legal clause:

• General Principle (consent and necessity): process client data only with consent and only as needed for the service. A client who gives you her number so you can manage her appointment has consented to exactly that. Collect nothing you do not need.
• Notice and Choice Principle: tell clients in writing what you collect, why, who it may be shared with (your booking software, for instance) and how to reach you about it. One detail specific to Malaysia: section 7(3) of the Act requires the notice to be in both Bahasa Malaysia and English. An English-only privacy notice on your booking page does not meet the requirement, so publish both versions. A short bilingual notice at reception plus one on the booking page covers a salon.
• Disclosure Principle: no passing the client list to third parties beyond what the notice said. A departing stylist taking "her" client contacts to a new salon is a disclosure problem as well as a commercial one.
• Security Principle: practical steps proportionate to the risk. One login per stylist rather than a shared password on a sticky note, locked screens on the reception tablet, backups, access on a need basis (a junior who washes hair does not need the full client export), and same-day removal of access when someone leaves.
• Retention Principle: do not keep data forever. See the retention section below.
• Data Integrity Principle: keep records accurate and current; correct a wrong number when you spot it or when the client tells you.
• Access Principle: a client can ask what you hold about her and have it corrected. For a well-kept salon record the honest answer is "of course, here it is".

None of this requires a consultant. It requires deciding who does what, writing a one-page bilingual notice, and tidying the file once or twice a year.

Appointment messages versus marketing, and the right to say stop

Malaysia draws a useful line here. A booking confirmation or a reminder about an appointment the client herself made is part of delivering the service she asked for. A WhatsApp blast offering 20 % off colour services is direct marketing, and section 43 of the PDPA gives every person the right, by written notice at any time, to require you to stop processing their data for direct marketing. Ignore such a request after the Commissioner directs you to comply and you face real penalties.

The safe habits: keep service messages purely informative, run promotions only to clients who said yes, keep a record of who opted in or out, and treat one "please stop" as permanent until the client says otherwise. The moment a "reminder" carries a promo line, it changes category. Our guide to appointment reminders for Malaysian hair salons covers timing and wording in detail.

One honest product note while we are here: ViteUneCoupe's Standard plan (from 29 € excluding tax per month, billed in euros, no commitment, so the RM amount moves with the exchange rate) sends confirmation, reminder and thank-you messages by email only. There is no SMS or WhatsApp sending in any plan, which is a genuine limitation in WhatsApp-first Malaysia, but it also means the tool never sends anything that could drift into unsolicited marketing territory on your behalf.

How long should you keep client records?

The Retention Principle says personal data must not be kept longer than necessary for the purpose. The PDPA sets no fixed retention period for client records: you choose a cut-off, write it down and apply it. A defensible, easy-to-run policy for a Malaysian salon looks like this (the periods are samples of a reasonable policy, not legal deadlines):

LHDN requires business records to be kept for 7 years from the end of the relevant year of assessment, and the PDPA never forces you to delete what tax law obliges you to keep: the invoice survives after the client card is gone. (If SST or e-Invoice record-keeping applies to your salon, our guide to SST and e-Invoice for Malaysian hair salons goes deeper.) Practically: once or twice a year, sort the client file by last appointment date and delete or anonymise the dormant records past your cut-off.

What to do if client data is breached

Since 1 June 2025, Malaysia has a mandatory breach notification regime. Per the Commissioner's guidelines as summarised by DLA Piper (checked in October 2026), if your client file is stolen, your account is hacked or an export is emailed to the wrong person:

• Notify the Commissioner as soon as practicable and within 72 hours where the breach causes or is likely to cause significant harm (financial loss, identity fraud, misuse of sensitive data) or is of significant scale, meaning more than 1,000 affected data subjects.
• Notify the affected clients without unnecessary delay and within 7 days of notifying the Commissioner, where significant harm is likely.
• Keep a breach register for at least two years: what happened, what you did, what you changed. Keep it even for small incidents that needed no notification.

A leaked list of names and appointment dates alone may fall below the significant-harm bar; anything involving payment details, passwords or sensitive notes will not. Either way, rotate every password the same day and write the incident down. For a small salon acting in good faith, the realistic cost of a breach is reputational: the message you would have to send to 800 clients explaining that their file leaked hurts more than any fine.

Choosing or switching software: you stay the data controller

As soon as your client file lives in software, the provider processes data on your behalf, and since April 2025 processors carry their own direct security obligations under the amended Act. But the salon remains the data controller: responsible for the file, whatever tool holds it. Four questions to ask any provider, ViteUneCoupe included, before signing or at renewal:

1. What do your terms commit to on data protection? A serious provider's terms promise security, confidentiality and processing your clients' data only on your instructions. A vendor that has never heard the question is telling you something.
2. Where is the data hosted, and what does the contract say about it? Most booking platforms available in Malaysia host data abroad. The 2024 amendments ease cross-border transfers to jurisdictions with substantially similar protection, but what protects you in practice is the contractual commitment, not the server's postcode.
3. Can you export the full file, and delete a single record? You must be able to retrieve complete client data if you change tools (the new data portability right points the same way) and to delete a card when your retention policy or a client's request says so. A provider that locks your file in undermines your own legal duties. When switching tools: export everything first, verify the export opens and is complete, import into the new tool, then delete your data from the old one and keep written confirmation.
4. Who owns the client relationship? Some marketplaces sit between the salon and its clients. ViteUneCoupe's position is the opposite: the client database is included in the free plan, the file belongs to the salon, it is exportable, and there is 0 % commission and no marketplace in between. Data questions like these sit high in our comparison of booking software for Malaysian hair salons too.

Frequently asked questions

Do I need to register my salon with the Personal Data Protection Commissioner?

No. Registration applies only to the 13 classes of data controllers specified by the Class of Data Users Order 2013, such as banking, insurance, healthcare, education and tourism, and hairdressing is not among them. The PDPA's principles still apply to your client file automatically; there is simply no registration form or fee for a salon. The class list can change, so check pdp.gov.my occasionally.

Does my salon need a data protection officer since the 2025 rules?

Almost certainly not. Mandatory DPO appointment, in force since 1 June 2025, applies only where processing involves personal data of more than 20,000 individuals, sensitive personal data of more than 10,000 individuals, or regular and systematic monitoring. A typical hair salon is far below those thresholds. Running the good habits in this article is still your responsibility as the data controller.

Is a paper appointment book covered by the PDPA?

Yes. Client record cards and an appointment book with phone numbers are personal data processed for a commercial purpose, exactly like software. Keep the book out of sight of other clients, tell clients what you keep, do not keep it forever, and show or correct a record if its owner asks.

Can I keep sending appointment reminders to a client who opted out of marketing?

Yes. A purely informative confirmation or reminder about an appointment the client booked is part of delivering her service, not direct marketing. What must stop, under section 43 of the PDPA, is promotional content: once she says stop, no more offers by WhatsApp, SMS, call or email, and no promo lines smuggled into reminders.

Does my privacy notice really have to be in Bahasa Malaysia and English?

Yes. Section 7(3) of the PDPA requires the written notice to be in the national language and English, and the means to exercise choices must be accessible in both too. One short bilingual notice at reception and the same text on your booking page covers a salon.

What should I do if my client list is hacked or stolen?

Contain it and rotate passwords the same day, then assess the harm. Where significant harm is likely, or more than 1,000 people are affected, notify the Commissioner as soon as practicable and within 72 hours, and notify the affected clients within 7 days of that where significant harm is likely. Whatever the outcome, record the incident in a breach register and keep it for at least two years.