Hair salon client records in Canada: the practical privacy guide

Ask any colourist in Toronto, Calgary or Halifax what makes a regular feel like a regular and you will hear the same answer: the record. The formula from last visit, the developer volume, how long it processed, the note that she is growing out her fringe and books every five weeks. That record, on paper or in software, is one of the most valuable assets in your salon.

It is also a file full of other people's personal information, and in Canada that comes with rules most salon articles either skip or get wrong by importing European law. This guide covers both halves: how to build a client record that earns repeat business, and what Canadian privacy law actually asks of the salon that holds it. It is published by ViteUneCoupe, which offers a free client database and online booking system for hair salons with 0% commission on bookings, but everything below applies whatever tool you use, a card index included.

One honest note before we start: this is general information with links to the primary sources, not legal advice, and the applicable law changes depending on your province. For anything with real stakes, talk to a lawyer in your province.

Which privacy law applies to your hair salon?

Canada does not have one single privacy rulebook, but the map is simpler than it looks.

The federal baseline is PIPEDA, the Personal Information Protection and Electronic Documents Act. As the Office of the Privacy Commissioner of Canada (OPC) explains, checked in October 2026, it applies to private-sector organizations that collect, use or disclose personal information in the course of a commercial activity. There is no small-business exemption: a one-chair salon in Winnipeg is covered the same way a ten-chair salon in Ottawa is. A client's name attached to a cell number is already personal information.

Three provinces run their own private-sector laws instead, deemed substantially similar to PIPEDA:

• British Columbia has its Personal Information Protection Act, which the province's PIPA guide for businesses confirms applies to every private-sector organization in B.C.
• Alberta has its own PIPA, overseen by the Alberta OIPC, with mandatory breach notification rules that have existed since 2010.
• Québec has its private-sector law, substantially reinforced by Law 25, with duties that go further than PIPEDA on several points. If your salon is in Québec, that is the framework to learn, and this Canada-wide guide is not a substitute for it.

For a salon in Ontario, Manitoba, Saskatchewan, the Atlantic provinces or the territories, PIPEDA is your law for client records. Wherever you are, the practical duties below are close enough that the same habits keep you on side; the differences that matter are flagged as they come up.

Two reassuring differences from what you may have read about Europe or the UK: there is no registration and no annual privacy fee to pay in Canada for an ordinary salon client list, and no certificate to obtain. The law works on accountability: you follow the rules and you should be able to show that you do.

What a useful salon client record contains

Privacy law and good salon management agree on the starting point: collect what the next appointment needs, and no more. A record that earns its keep holds:

• Contact details. Name, cell number, email. Enough to confirm, remind, and reach the client if her stylist is off sick.
• Visit history. Dates, services, which stylist, what she paid. Filled in automatically when the record lives in your booking software.
• Technical notes. Colour formula, developer volume, processing time, toner, how her hair lifted. For a colourist, this is the heart of the record, and the reason a client cannot simply be "remembered".
• Preferences. Prefers a quiet appointment, hates heavy layers, always books a blow dry. Small notes with an outsized effect on how valued she feels.
• Rebooking status. Did she leave with her next appointment booked? That one field drives your retention work.

Two writing rules keep the file safe. First, note facts, not opinions: "coloured elsewhere in June, uneven lift on ends" ages better than anything sarcastic. Second, write every note as if the client might read it, because under Canadian law she can ask to.

Allergy notes and patch tests: handle with extra care

A note like "reacted to PPD in 2024" or "sensitive scalp, patch test before colour" is health information. In the OPC's own breach guidance, medical information sits on the list of inherently sensitive data, and sensitive data gets stricter treatment across every Canadian regime.

That does not mean you should stop recording allergies; a patch-test note is a safety record, and losing it is worse than keeping it. It means three habits:

1. Record the allergy with the client's clear, explicit agreement, because it is necessary for her safety, and tell her that is why you keep it.
2. Keep the note minimal and factual: the product, the reaction, the date. No diagnosis, no speculation.
3. Never share it, and keep it out of any marketing export.

Photos follow the same logic. Keeping a before-and-after in the client's record and posting it on the salon's Instagram are two different uses, and the yes you got for one does not cover the other.

The practical duties, salon edition

PIPEDA is built on ten fair information principles. Translated for a salon floor, they come down to five habits:

1. Say what you do, and do what you say. One plain paragraph on your booking page covers it: "We keep your contact details and service history to manage your appointments. We never sell them. Ask us at any time to see, correct or delete your information." Under the openness and accountability principles, the sentence you publish is the promise you are held to.
2. Collect for the appointment, not for the drawer. You do not need a birthdate for a balayage. The less you hold, the less a mistake can spill.
3. Lock it. Strong, unique passwords, one login per staff member rather than a shared password on a sticky note, paper cards in a drawer that actually locks, and the reception tablet set to lock when it is put down.
4. Cut access the day someone leaves. When a stylist moves on, her login dies that afternoon. A client list walking out with a departing stylist is both a privacy problem and the oldest commercial injury in hairdressing. The same logic applies in reverse to chair renters: their clients are theirs, and your employed stylists' records should not be an open book to them.
5. Delete on a schedule. Canadian privacy law sets no magic number of years for salon records, but the retention principle is real: do not keep personal information after it has served its purpose. Once a year, sort the file by last visit and clear out the clients you have not seen since your own cut-off, shredding paper as you go.

The money side runs on a different clock: the Canada Revenue Agency expects business books and records to be kept for six years from the end of the last tax year they relate to. Invoices and sales records archive separately until that clock runs out; the colour formula does not need to.

Reminders, marketing texts and CASL

The client record is where the phone numbers and emails live, and separate federal rules kick in when you start sending. An appointment confirmation or a reminder the day before is service information about a booking the client made; a promotion, a birthday offer or a "we have not seen you in a while" message is commercial electronic mail under Canada's Anti-Spam Legislation (CASL), which demands consent, sender identification and an unsubscribe mechanism. Mixing the two is the classic trap: a reminder that ends with "ask about our colour special" has just changed category. The full rules, timing and wording are a topic of their own, covered in our guide to appointment reminders for Canadian hair salons, and reminders remain the cheapest fix for no-shows in a Canadian salon.

When a client asks about her record

Under PIPEDA, access is a right with a clock attached. Section 8 of the Act requires an organization to respond to an access request "not later than thirty days after receipt of the request", and if you fail to respond in time, you are "deemed to have refused the request", which the client can take to the Privacy Commissioner. Four requests can land at your reception desk:

• "What do you have on me?" You show her the record, free-text notes included, within 30 days. A visit history and a colour formula are nothing to hide, and the conversation usually ends in a rebooking.
• "That is wrong, fix it." A misspelled name or an outdated number gets corrected. Accuracy is one of the ten principles, not a favour.
• "Delete my information." Honour it, and keep only what another law obliges you to keep, such as invoices inside the CRA's six-year window. Say plainly what you kept and why.
• "Stop texting me." Always, immediately. Consent can be withdrawn, and a message sent to someone who opted out is marketing against yourself.

A structured client file is what makes this painless: finding and exporting one client's history in two clicks beats an afternoon in a box of cards.

If client data leaks: breach rules by province

Since 2018, PIPEDA has mandatory breach rules, and the OPC's guidance sets out the mechanics: when a breach of security safeguards creates a real risk of significant harm, you must report it to the OPC and notify the affected clients "as soon as feasible". Harm is weighed on two factors: how sensitive the data is, and how likely it is to be misused. A stolen laptop with names and appointment times might not meet the bar; a leaked file with health notes could. Whether you report or not, you must keep a record of every breach for two years.

Provincial nuances worth knowing: Alberta's PIPA has had its own mandatory reporting to the Alberta OIPC since 2010, under the same real-risk-of-significant-harm threshold, and Québec runs its own incident regime with a register and its own regulator. If you are in B.C., check the current state of PIPA before assuming the federal mechanics apply word for word.

The cheapest breach plan is the boring one: know today which passwords you would change, which provider you would call, and how you would know what was on the lost device.

Where your booking software keeps the data

As soon as the client file lives in software, your provider processes personal information on your behalf, and this is the part Canadian salon owners ask about most: "my software is American, is that allowed?"

The honest, sourced answer: Canadian law does not require Canadian hosting for a salon's client list. The OPC's guidelines for processing personal data across borders, checked in October 2026, state that PIPEDA "does not distinguish between domestic and international transfers of data", and that a transfer to a service provider for processing is a use, not a disclosure needing fresh consent. What the law demands instead is accountability and honesty: you remain responsible for the file in the provider's hands, the protection it gets there should be comparable, normally through the provider's contract terms, and you should make it plain to clients that their information "may be processed in a foreign country and that it may be accessible to law enforcement and national security authorities of that jurisdiction". One sentence in your privacy note covers that. Québec adds its own assessment step before information leaves the province, which is one more reason Québec salons should work from Québec-specific guidance.

So when you choose or review a booking tool, ask three questions in writing, the same three we use in our comparison of booking software for Canadian hair salons:

1. Where is the data hosted? A provider that cannot answer clearly is the red flag, more than any particular country.
2. Can you export and delete? You must be able to retrieve your client list if you leave, and delete a record when a client asks. A provider that locks your file in puts you in breach of your own duties.
3. Who owns the client relationship? Some marketplaces sit between you and your clients, who become users of their platform as much as clients of your salon.

For transparency, here is where ViteUneCoupe stands on its own three questions: salon data is hosted in France and Germany, under Europe's GDPR regime; the client file belongs to the salon and stays exportable; and there is no marketplace between you and your clients, with unlimited online bookings and 0% commission on the free plan. The paid Standard plan (from 29 € excl. tax per month, billed in euros, no commitment) adds confirmation, reminder and thank-you emails and calendar sync. Two honest limits for a Canadian salon: the subscription is billed in euros, not Canadian dollars, and reminders are email only, as ViteUneCoupe does not send SMS. And no software, ours included, makes a salon "compliant" by itself: the duties in this guide stay yours, a good tool just makes them far less painful.

Frequently asked questions

Does PIPEDA apply to a one-chair hair salon?

Yes. PIPEDA applies to personal information handled in the course of commercial activity, with no size or revenue threshold, and a name attached to a cell number already qualifies. In British Columbia, Alberta and Québec, the provincial private-sector law applies instead for business done inside the province, with the same bottom line: a salon of any size is covered.

Do I need a signed consent form to keep colour formulas on file?

No Canadian law requires a signed form for ordinary service notes kept to run the client's own appointments; keeping them is part of the service relationship, and the consent that matters is the clear understanding of what you keep and why. Handle health-related notes such as allergies with explicit agreement and extra care, and get a separate, specific yes before publishing any client photo.

Is it illegal for my salon software to host client data in the United States?

No. The OPC is explicit that PIPEDA does not distinguish between domestic and international transfers. You stay accountable for the data, the provider should give it comparable protection through its contract, and your privacy note should say that information may be processed abroad and be accessible to that country's authorities. Québec salons have an additional assessment duty under their provincial law before information leaves the province.

How long should I keep a client's record after her last visit?

There is no fixed statutory period for service records: the retention principle says keep personal information only as long as it serves its purpose, so set your own cut-off, write it down and apply it once a year. Money records are different: the CRA expects books and records to be kept six years from the end of the last tax year they relate to.

What do I do first if my client list leaks?

Contain it: change the passwords, cut the compromised access, and find out exactly what was exposed and for whom. Then assess the harm: if the leak creates a real risk of significant harm, PIPEDA requires reporting it to the Privacy Commissioner and notifying the affected clients as soon as feasible, and Alberta and Québec have their own reporting duties. Record the incident either way, and keep that record for at least two years.

Is a paper appointment book covered by Canadian privacy law?

Yes. The rules cover personal information, not technology, so a card index or an appointment book with names and numbers counts. The same habits apply in both formats: tell clients what you keep, lock the book away from browsing eyes, shred instead of tossing, and show or delete a record when its owner asks.