Hair salon client records and privacy in Australia: what the law really asks

Ask any colourist in Sydney, Brisbane or Launceston what makes a regular feel like a regular and you will hear the same answer: the record. The formula from last visit, the developer volume, how long it processed, the note that she is growing out a fringe and books every five weeks. That file, on paper or in software, is one of the most valuable assets in your salon.

It is also a file full of other people's personal information, and here Australia takes a path most salon articles get wrong, usually by importing European law. The surprise at the heart of this guide: most Australian hair salons are not covered by the Privacy Act at all, because of the small business exemption. That is not the end of the story. Some rules apply to every salon regardless of size, the exemption has exceptions worth understanding, reform is on the table, and a salon that treats client records carelessly pays for it in trust and reviews long before any regulator calls. This guide is published by ViteUneCoupe, which offers a free client database and online booking system for hair salons with 0 % commission, but everything below applies whatever tool you use, a card index included.

One honest note before we start: this is general information with links to the primary sources, not legal advice. For anything with real stakes, talk to a lawyer.

Does the Privacy Act apply to your hair salon?

For most salons, no. Under the small business exemption explained by the Office of the Australian Information Commissioner (OAIC), checked in October 2026, a business with an annual turnover of A$3 million or less is generally not covered by the Privacy Act 1988 or the Australian Privacy Principles (APPs) that sit inside it.

Two details stop that sentence being misread:

• Turnover means all income from all sources, not profit. It excludes assets held, capital gains and proceeds of capital sales. A busy multi-chair salon can have a healthy turnover and still sit far below A$3 million.
• The threshold is about the business, not the shop. If your salon is part of a larger group, or related to a business that is covered, the exemption can fall away, so a salon inside a bigger structure should check rather than assume.

So where a British salon owner reads about UK GDPR duties and a Canadian one about PIPEDA, which has no small business exemption, the typical Australian salon simply is not an "APP entity". There is no privacy regulator registration, no annual fee, and the APPs' formal access and correction machinery does not bind you.

That legal breathing room is real, and this guide will not pretend otherwise. But it comes with three caveats: the exceptions below, the rules that apply to every business regardless of the exemption, and the fact that the exemption itself is slated for review.

The exceptions: when a small salon is covered anyway

The OAIC's small business guidance lists the situations where a business under the threshold is covered regardless. Most are irrelevant to hairdressing (credit reporting bodies, residential tenancy database operators, Commonwealth contractors). Three deserve a salon owner's attention.

Trading in personal information

A small business that discloses or collects personal information for a benefit, service or advantage is covered by the Privacy Act regardless of turnover. The OAIC's guidance on trading in personal information gives the classic examples: buying a mailing list, or passing customer details to someone else for commercial gain. There is an important carve-out: it is not "trading" if every individual concerned has consented, or if the disclosure is required or authorised by law.

Salon translation: renting or selling your client list to a local business, swapping client details with a product rep for a kickback, or buying a marketing list of "local women 25 to 45" without the consent of the people on it would pull you inside the Act, and then almost certainly put you in breach of it. Keep the client list for running the salon and the question never arises. If you ever sell the salon itself, the list usually goes with the business; handle that moment carefully and get advice, because consent is what separates an ordinary business sale from trading.

Health service providers: where allergy notes come in

The exemption also does not apply to a business that provides a health service and holds health information. This is the exception salon owners ask about once they realise their software holds notes like "reacted to PPD in 2023, patch test before every colour".

Here is what the primary source actually supports. The OAIC's explanation of health service providers describes providing a health service as activities such as diagnosing or treating illness or disability, or assessing, maintaining or improving a person's physical or psychological health. Its examples run from GPs, dentists and pharmacists to less obvious cases like gyms, weight loss clinics and childcare centres. Hairdressing appears nowhere on the list, and cutting or colouring hair is not, on the OAIC's description, an activity intended to assess, maintain or improve someone's health. Note also that the exception needs both limbs: providing a health service and holding health information. Holding an allergy note alone does not make you a health service provider.

So the reasonable reading is that an ordinary hair salon recording a patch-test result for client safety does not become a health service provider by doing so. Two honest hedges: the OAIC has not published guidance that names hairdressing either way, and the gym example shows the category follows what you actually do, not your industry label. A salon that markets services as treating a scalp or hair-loss condition is edging towards the definition and should ask the OAIC or a lawyer rather than guess. And whatever the legal status, an allergy note is sensitive by nature; we cover how to handle it a few sections down.

Opting in, and the tax file number rule

Two smaller points from the same OAIC page. A small business can voluntarily opt in to the Privacy Act, trading effort for a trust signal; the OAIC's opt-in guidance explains how, and once in, you are bound until you withdraw. And the Privacy (Tax File Number) Rule 2015 applies to small businesses regardless of the exemption: the TFNs your staff give you for payroll are protected information whatever your turnover, so keep them locked down and never in the client-facing system.

The rules that apply to every salon, exemption or not

The small business exemption is an exemption from the APPs, not from Australian law in general. Three regimes reach every salon.

The Spam Act 2003. Marketing by email or SMS is regulated by the Spam Act whatever your turnover, enforced by the ACMA. The ACMA's rules for businesses are short: consent before you send commercial electronic messages, clear identification of your salon as the sender, and a working unsubscribe honoured promptly, generally within five business days. A purely factual appointment confirmation or reminder sits differently from a promotional blast, but the moment a message promotes an offer it is commercial and the full rules apply; a reminder ending with "ask about our winter colour special" has just changed category. The timing, wording and consent mechanics are a topic of their own, covered in our guide to appointment reminders for Australian hair salons.

The new privacy tort. Since 10 June 2025, Australia has a statutory tort for serious invasions of privacy, introduced by the Privacy and Other Legislation Amendment Act 2024. The OAIC's explanation makes a point that matters here: the tort is broader in application than the Privacy Act and extends to entities that are not APP entities. In plain terms, an exempt salon can still be sued by an individual over a serious, intentional or reckless misuse of their information. The bar is high (reasonable expectation of privacy, seriousness, a public-interest balance), and a misfiled colour card will never meet it. Deliberately leaking a client's details after a dispute might. The exemption is not a licence.

Tax record keeping. The Australian Taxation Office expects business records to be kept for five years, per its record-keeping rules for business, generally from when the record was prepared or obtained or the transaction completed, whichever is later. Invoices and sales records archive on that clock; the colour formula does not need to.

Reform: the exemption is on borrowed time, but no date is set

Treat the exemption as the current state of the law, not a permanent one. Following the multi-year review of the Privacy Act, the Australian Government's September 2023 response agreed in principle to removing the small business exemption, after further consultation with small businesses, an impact analysis and a transition period. The OAIC publicly supports the removal and has said it will help small businesses transition. A first tranche of reforms became law in December 2024 (the same Act that created the privacy tort), but as of October 2026 the exemption itself still stands, with no legislated removal and no commencement date.

The practical conclusion: a salon that builds good habits now loses nothing, and if the exemption goes, has nothing to scramble for. Every habit in the rest of this guide works unchanged under a future, stricter law.

Why good record practice matters even while you are exempt

Set the law aside for a moment. Three commercial reasons carry the argument on their own.

Trust is the product. Clients hand a salon their mobile number, their email, their visit pattern and sometimes an allergy. A client who hears her details were passed around, or sees her before-and-after on Instagram without being asked, does not file a complaint with a regulator. She leaves, and tells people why, sometimes in a review. The salons that win on client retention and rebooking are the ones clients trust with the small stuff.

Staff move on; the list should not. A client list walking out with a departing stylist is the oldest commercial injury in hairdressing, and no privacy statute is what stops it. What stops it: one login per staff member instead of a shared password, access that ends the day someone resigns, and export rights limited to the owner. The same boundary matters in reverse if you rent chairs to independent stylists: their clients are theirs, your employed stylists' records are not an open book to them, and writing that down on day one prevents the ugly argument on the last day.

A lost file is lost revenue. Forget breaches for a second: a stolen laptop or a dead hard drive with your only copy of five years of colour formulas is a disaster with no villain. Software with proper accounts and backups beats a spreadsheet on the reception computer, and both beat a card box next to a basin.

What a useful salon client record contains

Good privacy practice and good salon management agree on the starting point: collect what the next appointment needs, and no more.

• Contact details. Name, mobile, email. Enough to confirm, remind, and reach the client if her stylist is off sick.
• Visit history. Dates, services, which stylist, what she paid. Filled in automatically when the record lives in your booking software.
• Technical notes. Colour formula, developer volume, processing time, toner, how her hair lifted. For a colourist this is the heart of the record, and the reason a client cannot simply be "remembered".
• Preferences. Prefers a quiet appointment, hates heavy layers, always books a blow-wave. Small notes with an outsized effect on how valued she feels.
• Rebooking status. Did she leave with her next appointment booked? That one field drives your retention work.

You do not need a date of birth for a balayage, and you do not need to keep a card on file to take bookings. The less you hold, the less a mistake can spill. Two writing rules keep the file safe: note facts, not opinions ("coloured elsewhere in June, uneven lift on ends" ages better than anything sarcastic), and write every note as if the client might one day read it. Exempt or not, nothing obliges you to show her the file, but the stylist who would be embarrassed to has already written the wrong thing.

Allergy and patch-test notes: handle with extra care

Whatever the Privacy Act's position on your salon, a note like "reacted to PPD, patch test before colour" is health information by nature, and it exists for one reason: safety. Do not stop recording it; losing a patch-test history is worse than keeping one. Three habits keep it clean:

1. Record it with the client's clear agreement, and tell her why: it is there so nobody ever puts that product near her scalp again.
2. Keep it minimal and factual: the product, the reaction, the date. No diagnosis, no speculation.
3. Keep it out of every marketing export, and never share it.

Photos follow the same logic. Keeping a before-and-after inside the client's record and posting it on the salon's Instagram are two different uses, and the yes you got for one does not cover the other. Ask separately, every time.

Retention, exports and switching software

Retention. No Australian law sets a number of years for keeping a colour card. A sensible routine: once a year, sort the file by last visit and clear out clients past your own cut-off, shredding paper as you go. Keep the money records separately until the ATO's five-year clock runs out.

Exports. Whatever software you use, confirm in writing that you can export your complete client list, formulas and notes included, in a standard format like CSV. This is the question that matters most the day you leave a provider: a platform that locks your file in owns your client relationships more than you do. The full escape plan, notice periods and data-migration steps are in our guide to switching salon booking software in Australia, and export rights are one of the seven criteria in our comparison of booking software for Australian hair salons.

Where the data lives: overseas hosting, stated honestly

Most salon software is cloud software, so your client file physically sits on servers somewhere, often outside Australia. For an exempt salon there is no APP machinery governing overseas disclosure, so we will not invent a legal duty where none applies. What an owner should still do is know the answer and be able to say it plainly if a client asks, because "I have no idea where your details are" is a bad look regardless of the law.

Here is ViteUneCoupe's own answer, as an example of the disclosure any provider should give you. Salon data is hosted in Europe, in France and Germany, under the European GDPR regime, which means your clients' information leaves Australia. Practically: it is protected by one of the strictest privacy frameworks in the world, but it sits under European jurisdiction rather than Australian, and page loads travel further than they would from a Sydney data centre. The client file belongs to the salon and stays exportable, and there is no marketplace between you and your clients: the free plan includes unlimited online bookings with 0 % commission, a personalised booking page and the client database itself. The Standard plan (from 29 € excl. tax per month, no commitment) adds confirmation, reminder and thank-you emails plus calendar sync. Two honest limits for an Australian salon: the subscription is billed in euros, so the Australian dollar amount on your card statement moves with the exchange rate and your bank may add a foreign transaction fee, and reminders are email only, as ViteUneCoupe does not send SMS.

Whoever you choose, ask three questions in writing: where is the data hosted, can I export and delete records myself, and who owns the client relationship. A provider that cannot answer the first one clearly is a bigger red flag than any particular country.

Frequently asked questions

Does the Privacy Act apply to my hair salon?

Generally not, if your annual turnover is A$3 million or less: the small business exemption means most hair salons are not covered by the Australian Privacy Principles. Exceptions exist, notably businesses that trade in personal information without consent and businesses that provide a health service and hold health information, and the Government agreed in principle in 2023 to remove the exemption in a future reform, with no date legislated as of October 2026.

Do allergy and patch-test notes make my salon a "health service provider"?

Holding an allergy note alone does not: the exception requires both providing a health service and holding health information, and the OAIC's description of a health service (diagnosing, treating, or assessing and improving health) does not describe ordinary hairdressing, which appears nowhere in its examples. The category follows activity rather than industry labels, so a salon marketing services as treatment for a scalp condition should seek advice. Either way, treat allergy notes as sensitive: minimal, factual, never shared.

Can I send marketing emails and texts to my client list?

Only within the Spam Act 2003, which applies to every business regardless of the Privacy Act exemption: you need consent, clear identification of your salon as the sender, and a working unsubscribe honoured promptly. Plain appointment confirmations and reminders are treated differently from promotions, but one promotional line inside a reminder makes the whole message commercial.

Can a client demand to see or delete her record?

An exempt salon is not bound by the Privacy Act's formal access and correction rights. Showing a client her visit history, fixing a wrong number or deleting her record on request is nonetheless the right call every time: it costs minutes, it builds the trust the record exists to serve, and if the small business exemption is removed, it becomes the law you already follow. Keep anything tax law requires, and say what you kept and why.

How long should I keep client records after a last visit?

No statute fixes a period for service records like colour cards, so set your own cut-off, write it down and apply it once a year. Financial records are different: the ATO expects business records to be kept for five years, so invoices and sales data stay until that clock runs out even after the client card is gone.

Is it a problem that my booking software stores data overseas?

For a salon covered by the small business exemption, no Australian privacy rule forbids it. It is still worth knowing where the data sits, under which country's laws, and whether you can export everything on demand, and worth being able to tell a client plainly. ViteUneCoupe, for example, hosts salon data in France and Germany under the GDPR; other providers use the United States or Australia. The provider that cannot answer the question is the one to avoid.