Hair salon client records and the PDPA in Singapore: the practical guide

Name, +65 mobile number, appointment history, the colour formula from her last balayage, the note that she is sensitive to a particular developer: your client file is full of personal data. Singapore's Personal Data Protection Act (PDPA) therefore applies to your hair salon, whether you run six chairs off Orchard Road or cut hair alone in an HDB shopfront with a client list that lives in a notebook.

The good news is that the real obligations are smaller and more practical than most of the compliance marketing circulating online suggests. What the law actually asks of a small salon is honest habits: collect only what you need, tell clients what you do with it, keep it secure, do not keep it forever, answer requests, and name one person as responsible. There is no licence to buy and no annual data protection fee to pay.

This guide is published by ViteUneCoupe, a free online booking system for hair salons with no commission, whose free plan includes a client database with full appointment history. The rules below apply whatever tool you use, paper book included, and every important point links to the primary source: the Personal Data Protection Commission (PDPC) or IRAS, not somebody's compliance sales page. One honest note before we start: this is general information, not legal advice. For anything with real stakes, talk to a lawyer or check directly with the PDPC.

Does the PDPA apply to your salon?

Yes, as soon as you keep information about identifiable people. A first name attached to a +65 number is enough. The PDPA applies to private sector organisations of every size, sole proprietors included, and there is no small business exemption from the core data protection obligations listed by the PDPC (checked in October 2026): consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, data breach notification and accountability.

Three clarifications that surprise many salon owners:

• Paper counts. A box of client record cards or an appointment book with contact details is personal data just like software.
• There is no registration fee. You do not pay anything or apply for anything just to hold a client file. Your obligations are about behaviour, not paperwork you buy.
• You do have to name a data protection officer. Unlike most of the rules, this one is explicit and applies even to a one-person business. More on that below, and it is less scary than it sounds.

What personal data does a hair salon actually hold?

Take an honest inventory, paper included. A typical Singapore salon holds:

• Contact details: name, +65 mobile number, email, sometimes an address.
• Appointment history: dates, services, which stylist, amounts paid.
• Technical notes: colour formula, developer volume, processing time, hair condition, preferences.
• Free-text notes: "prefers the window seat", "always fifteen minutes late", and whatever else gets typed in.
• Sometimes photos: before-and-after shots kept on a record or posted to Instagram.
• Online booking data: whatever your booking page collects, which is personal data exactly like the paper card.

One thing a salon should simply never hold: NRIC numbers. Since 1 September 2019, the PDPC's advisory guidelines on NRIC numbers generally prohibit organisations from collecting, using or disclosing NRIC numbers, or holding physical NRICs, unless the law requires it or identification to a high degree of fidelity is genuinely necessary. Booking a haircut never meets that bar. A membership programme does not either: use a mobile number or a membership code instead.

Health-adjacent notes deserve care too. "Reacted to the previous colour brand" or "sensitive scalp" exists to keep the client safe: keep such notes factual and minimal (product, reaction, date, no speculation), and never pull them into a marketing export. Do not stop recording them out of nervousness; losing that history is worse than keeping it, and it is exactly the kind of note a reasonable client expects you to keep.

Finally, remember that free-text notes are readable by the client if she ever asks for a copy of her data. A simple rule keeps you safe: never write anything in a client record you could not comfortably show to the person it describes.

Consent, purpose and telling clients what you do

The PDPA's first three obligations work as a unit: you may collect, use and disclose personal data only for purposes a reasonable person would consider appropriate, you must notify the individual of those purposes on or before collection, and you need consent for them.

In practice this is lighter than it reads, because the PDPA recognises deemed consent: a client who gives you her number so you can book and manage her appointment has, by providing it voluntarily for that obvious purpose, consented to exactly that use. You do not need a signed form to keep a record card or look up last visit's formula.

What you do need is plain-language notification. Two simple measures cover a salon:

• In the salon: a short notice at reception, along the lines of "We keep your contact details, service history and colour notes to manage your appointments and keep colour services safe. Ask us at any time to see, correct or delete them." That wording is a sample to adapt, not an official template.
• Online: a short privacy notice on or linked from your booking page, visible where clients type in their details, naming the software that stores the data.

Where real consent choices matter is beyond the appointment itself: adding a client to a promotional broadcast list, or posting her before-and-after photo on your salon's Instagram. A verbal yes for the record card does not cover publication; ask separately and note the answer.

Marketing messages and the Do Not Call registry

Singapore draws a sharp line between messages about an appointment and messages that sell.

A booking confirmation or a reminder the day before, sent to the client who made the booking and saying nothing promotional, is a message that facilitates the transaction the client herself asked for. A blast offering 20 % off colour services is telemarketing, and if it goes to a Singapore telephone number by call or SMS it runs into the Do Not Call registry, where consumers register numbers they do not want marketed to. Before sending promotional SMS or making marketing calls you must either hold the client's clear consent to receive them or check her number against the registry, and the moment a "reminder" carries a promo line it changes category. Bulk marketing email has its own rules under the Spam Control Act (unsubscribe facility, honest headers), so keep promotional emails clean and easy to leave too.

The safe habit: keep service messages purely informative, and run promotions only to clients who ticked a box saying yes. Our guide to appointment reminders for Singapore hair salons covers the DNC rules, timing and wording in detail. One honest product note while we are here: ViteUneCoupe's Standard plan (from 29 € excluding tax per month, billed in euros, no commitment) sends confirmation, reminder and thank-you messages by email only, there is no SMS or WhatsApp in any plan, which incidentally keeps those messages well clear of the DNC regime.

How long should you keep client records?

The retention limitation obligation says you must stop keeping personal data once it no longer serves a business or legal purpose. The PDPA deliberately sets no fixed retention period for client records: you choose your own, justify it, write it down and apply it. For a Singapore salon, a defensible and easy-to-run policy looks like this (the periods are samples of a reasonable policy, not legal deadlines):

IRAS requires business records and accounts to be kept for at least 5 years, and the PDPA never forces you to delete what tax law obliges you to keep: the invoice survives even after the client card is gone. Practically, once or twice a year, sort your client file by last appointment date and delete or anonymise the dormant records past your cut-off.

Access and correction requests

Two requests can land at reception, and both are core PDPA rights:

• Access: "What do you hold about me?" You provide her personal data and how it has been used or disclosed over the past year, free-text notes included. Respond as soon as reasonably possible; if you cannot answer within 30 days, you must tell the client within those 30 days when you will.
• Correction: a wrong number or misspelt name gets corrected.

No formality is required from the client: a question at the basin counts, though asking her to put it in writing makes your life easier. For a well-kept salon record the practical answer is almost always "of course, here it is" on the spot, which is the point of writing factual notes. There is no general erasure right in the PDPA as there is in Europe, but a client can withdraw consent with reasonable notice, after which you stop using her data and apply your retention policy; deleting the record of someone who asks is almost always the simplest and best answer anyway.

Appointing a DPO, even in a one-chair salon

This is the obligation small businesses most often miss, because it sounds like something for banks. It is not: under the accountability obligation, every organisation must designate at least one data protection officer and make a business contact available so people can reach them with data questions (checked in October 2026 on the PDPC's DPO pages).

For a small salon, in practice:

• The DPO can be you, the owner. No certification is legally required, and the role can sit on top of the day job.
• The duties are the ones in this article: know what data the salon holds, make sure the notice, retention and security habits actually run, and be the person who answers when a client asks a data question.
• Make a contact point available, for example a dedicated email address on your website or booking page, and keep your DPO details up to date in your ACRA BizFile+ business profile, which is where the PDPC encourages organisations to maintain them.

Ten minutes of admin, once. It also happens to be the first thing the PDPC looks for if a complaint ever lands.

Protecting the file: security and staff access

The protection obligation asks for security arrangements that are reasonable for the risk. Translated for a salon:

• One login per person: each stylist has her own account in the software, not a shared password on a sticky note at reception.
• Strong, separate passwords, different from personal accounts, with the owner's account protected best of all.
• Backups: one paper notebook can be lost in a flood or a renovation; a spreadsheet on a single laptop with no backup is no better.
• Locked devices: the reception tablet locks when it is put down; the laptop does not travel unencrypted.
• Access on a need basis: a junior who only washes hair does not need the full client export. Most booking tools let you give staff a calendar view without the database.
• Leavers handled same-day: when a stylist leaves, her access ends immediately. A client list walking out with a departing stylist is a PDPA problem as well as a commercial one.

Choosing software: where the data sits and the transfer limitation obligation

As soon as your client file lives in software, your provider processes data on your behalf, but you remain responsible for the file. And because most booking platforms available in Singapore are foreign companies hosting data overseas, one PDPA rule becomes very practical: the transfer limitation obligation says personal data may only be transferred outside Singapore where the recipient is bound to a standard of protection comparable to the PDPA, which for a salon means the vendor's contract has to carry that promise. Four questions to ask any provider, ViteUneCoupe included, before signing or at renewal:

1. What do your terms say about data protection? A serious provider's terms commit to security, confidentiality and processing your clients' data only on your behalf. If a vendor has never heard the question, that tells you something.
2. Where is the data hosted, and what does the contract promise about it? Overseas hosting is not forbidden, it is the norm, but under the transfer limitation obligation you need the contractual commitment, not just a server location. "Hosted in Singapore" alone is a location, not a compliance certificate, and "hosted abroad" with solid contractual protection is perfectly lawful.
3. Can you export your full file, and delete a record? You must be able to retrieve complete client data if you change tools, and to delete a card when your retention policy or a client's withdrawal of consent says so. A provider that locks your file in undermines your own obligations; our guide to switching salon booking software in Singapore explains how to export before you cancel.
4. Who owns the client relationship? Some marketplaces sit between the salon and its clients, who become users of the platform as much as clients of your salon. ViteUneCoupe's position is the opposite: the client file belongs to the salon, exportable, 0 % commission, no marketplace in between. To be equally honest about its limits for a Singapore salon: reminders are email only and the subscription is billed in euros, not SGD, so the card payment carries exchange rate movement and possibly a small foreign currency fee. Export rights and data questions sit high in our comparison of booking software for Singapore hair salons too.

What happens if data is breached

Since the 2021 amendments, the PDPA has a mandatory data breach notification regime, and the PDPC's data breach reporting pages set out the mechanics (checked in October 2026). If your client file is stolen, your account is hacked or an export is emailed to the wrong person:

• Assess quickly. Once you have credible grounds to believe a breach occurred, you must assess within 30 calendar days whether it is notifiable.
• A breach is notifiable if it is likely to result in significant harm to the people affected, or if it affects 500 or more individuals. Names and appointment histories alone will often fall below the significant-harm bar; anything involving account credentials or financial data will not.
• If it is notifiable, you must notify the PDPC as soon as practicable and no later than 3 calendar days after making that determination, and notify the affected clients too where significant harm is likely.

Either way, write down what happened, what you did and what you changed. The PDPC can issue directions and financial penalties for breaches of the data protection obligations, but for a small salon acting in good faith the realistic damage is reputational: the WhatsApp message you would have to send to 800 clients explaining that their file leaked costs more than any fine.

Frequently asked questions

Do I need to register my salon with the PDPC?

There is no licence and no fee for holding a client file: the PDPA's obligations apply automatically. The one explicit administrative duty is designating a data protection officer and making a business contact for data questions available, which the PDPC encourages you to keep up to date in your ACRA BizFile+ profile. The DPO can simply be the salon owner.

Can I ask clients for their NRIC number for my membership programme?

No. Since 1 September 2019 the PDPC's advisory guidelines generally prohibit collecting NRIC numbers unless the law requires it or high-fidelity identification is genuinely necessary, and a salon membership never qualifies. Use the client's mobile number or a membership code instead.

Are appointment reminders covered by the Do Not Call registry?

A purely informative confirmation or reminder about an appointment the client booked is a message that facilitates her own transaction, not telemarketing. The moment the message carries a promotion it becomes a marketing message, and sending it by call or SMS to a Singapore number then requires consent or a DNC registry check. Email reminders sit outside the DNC registry entirely, which covers Singapore telephone numbers.

How long can I keep a client's record after her last visit?

The PDPA sets no fixed period: keep data only as long as a business or legal purpose remains, choose your own cut-off, write it down and apply it. A documented policy such as "deleted three years after the last appointment" is easy to defend and easy to run. Invoices and accounts follow IRAS rules instead and must be kept for at least 5 years.

Is a paper appointment book covered by the PDPA?

Yes. Client record cards and an appointment book with contact details are personal data just like software. The same habits apply: tell clients what you keep, do not keep it forever, keep the book out of sight of other clients, and show or correct a record if its owner asks.

What should I do if my client list is hacked or stolen?

Contain it, then assess within 30 days whether the breach is notifiable: likely significant harm to those affected, or 500 or more people involved. If it is, notify the PDPC within 3 calendar days of that determination and tell the affected clients where significant harm is likely. Whatever the outcome, document the incident and what you changed, and rotate every password the same day.