Hair salon client records and privacy in New Zealand: what the Privacy Act 2020 asks of you

Ask any colourist in Auckland, Christchurch or Gore what turns a walk-in into a regular and the answer is the record: the formula from last visit, the developer volume, the note that she reacted to a product in 2023 and needs a patch test before every colour, the fact that she books every five weeks. That file, on paper or in software, is one of the most valuable assets in your salon.

It is also a file full of other people's personal information, and in New Zealand the legal starting point is refreshingly simple and often misunderstood, usually because salon owners read articles written for Australia. Across the Tasman, most small salons are exempt from the Privacy Act thanks to a turnover threshold. New Zealand has no such exemption: the Privacy Act 2020 applies to every agency, from a government department to a one-chair salon in Tauranga. The good news is that what the Act asks of a hair salon is mostly common sense, and this guide walks through it in plain salon terms. It is published by ViteUneCoupe, which offers a free online booking system with a built-in client database for hair salons, but everything below applies whatever you use to keep your records, a card index included.

One honest note before we start: this is general information with links to the primary sources, not legal advice. For anything with real stakes, talk to a lawyer or ask the Office of the Privacy Commissioner directly.

Yes, the Privacy Act 2020 applies to your salon

The Privacy Act 2020 came into force on 1 December 2020 and applies to "agencies", a word the Act uses for essentially everyone who handles personal information in the course of an activity. The Privacy Commissioner's guidance on business obligations, checked in October 2026, spells it out: the Act covers companies, small businesses and sole traders, clubs and charities alike. There is no turnover threshold, no registration, no annual fee, and no paperwork to file just because you exist. You are simply expected to handle personal information properly.

Two concrete consequences follow for a salon:

• Every business needs a privacy officer. The same guidance says every New Zealand business or organisation needs one. In a small salon that is almost always the owner. No legal training is required; the privacy officer is simply the person who knows what the business holds and who deals with questions, requests and problems. Decide who it is, tell the team, done.
• "Personal information" is anything that says something about an identifiable person. A client's name, mobile number, email, visit history, colour formula tied to her name, before-and-after photos, and your staff's employment details all qualify, whatever format they are in.

If you are used to thinking of privacy law as something for corporates, recalibrate: in New Zealand, the law already assumes your salon is in.

The 13 privacy principles, translated into salon language

The Act is built around 13 information privacy principles (IPPs), the full text of which sits in the Privacy Act 2020 on legislation.govt.nz. You do not need to memorise them; grouped by what they mean at the basin and the front desk, they come down to five habits.

Collect only what the next appointment needs (IPPs 1 to 4)

Have a real reason for everything you collect, collect it from the client herself where you can, and do it fairly. A salon needs a name, a mobile number, usually an email, the service history and the technical notes. You do not need a date of birth for a balayage and you do not need a home address to cut a fringe. The less you hold, the less a mistake can spill.

Principle 3 adds the notice duty: when you collect information, the client should know what you are collecting, why, who sees it, and that she can ask to see and correct it. For a salon this is not a 12-page policy; it is a short paragraph on your booking page and a line in how you talk ("I'll note the formula and the patch test on your file so whoever does your colour next time has it").

Keep it safe (IPP 5)

Reasonable security safeguards against loss, misuse and unauthorised access. In salon terms: software with a login per staff member rather than a shared password on the reception computer, paper cards in a drawer that locks rather than a box by the basin, and no client list saved to a personal phone "to be safe". This is also the principle that makes a stolen unlocked laptop with your only copy of the client file a legal problem as well as a commercial one.

Show and fix on request (IPPs 6 and 7)

A client has the right to ask what you hold about her and to request a correction. The Privacy Commissioner's guidance on information requests sets the clock: respond as soon as possible and within 20 working days. For a salon the practical answer is almost always "of course, here it is" on the spot, because a well-kept record contains nothing you would hesitate to show. Which suggests the best writing rule in this whole guide: write every note as if the client might one day read it. "Coloured elsewhere in June, uneven lift on ends" ages well; sarcasm does not.

Use it for what you collected it for (IPPs 8 to 11)

Check information is accurate before acting on it, do not keep it longer than you need it (more on retention below), use it for the purpose you collected it for, and do not disclose it to others without a proper basis. Salon translation: the client file exists to run appointments and keep colour work safe and consistent. Passing client details to a product rep, selling the list, or letting a departing stylist walk out with an export are all disclosure problems, not just bad manners. Marketing is a use question too: a client who gave her email to receive booking confirmations has not necessarily agreed to a weekly promotional newsletter, so ask at collection time.

Mind the borders and the identifiers (IPPs 12 and 13)

Principle 12 governs disclosing personal information outside New Zealand and gets its own section below, because it is the one that touches almost every modern booking system. Principle 13 restricts assigning unique identifiers and is close to irrelevant for a salon: a client number generated by your software to run your own records is normal practice.

New from 1 May 2026: telling people about indirect collection

One recent change is worth knowing because it is new enough that most salon articles have not caught up. The Privacy Amendment Act 2025 added a new principle, IPP 3A, in force since 1 May 2026: when you collect personal information about someone from a source other than the person herself, you must now take reasonable steps to tell her, reasonably promptly, unless an exception applies (for example, she already knows).

When does a salon collect indirectly? More often than you might think: a partner books an appointment as a gift and gives you the recipient's name and number, a client books for her teenager, a new stylist brings notes about former clients. The fix is light: when the new person first confirms or shows up, a sentence covers it ("your partner gave us your number to book this; it's on your client file now, which you can see or correct any time"). Build that sentence into how the front desk handles third-party bookings and IPP 3A is handled.

Colour formulas and allergy notes: is that health information?

This is the question colourists actually ask, so here is the honest answer rather than the scary one.

New Zealand has a specific instrument for health data: the Health Information Privacy Code 2020, which replaces the privacy principles with tailored rules for health agencies: providers of personal or public health or disability services (doctors, nurses, dentists, pharmacists, rest homes) and certain health-sector bodies like ACC and health insurers. Checked in October 2026, hairdressing appears nowhere in that scope. A hair salon cutting and colouring hair is not a health agency, and recording a patch-test result for client safety does not make it one. So the Code's special machinery does not apply to an ordinary salon, and anyone telling you it does is overclaiming.

That is not a licence to be casual. An allergy note like "reacted to PPD, patch test before every colour" is still personal information under the ordinary principles, and it is sensitive by nature, which raises what "reasonable" security and care mean for it. Three habits keep it clean:

1. Record it with the client's clear agreement and tell her why: it exists so nobody ever puts that product near her scalp again. Do not stop recording patch tests; losing that history is far worse than keeping it.
2. Keep it minimal and factual: the product, the reaction, the date. No diagnosis, no speculation.
3. Keep it out of every marketing export and never share it.

Photos follow the same logic. Keeping a before-and-after inside the client's record and posting it on the salon's Instagram are two different uses, and the yes you got for one does not cover the other. Ask separately, every time.

One edge case deserves a flag: a salon that markets itself as treating scalp or hair-loss conditions is drifting towards providing a health service, and should ask the Privacy Commissioner's office or a lawyer rather than guess.

Overseas hosting: what IPP 12 really means for your booking software

Most salon software is cloud software, so your client file physically sits on servers somewhere, very often outside New Zealand. Here is the part most summaries get wrong, so it is worth stating carefully, from the Privacy Commissioner's own guidance on disclosing information outside New Zealand (checked in October 2026).

Using an overseas provider to store or process your data on your behalf is usually not a "disclosure" at all. Under section 11 of the Act, when an overseas company holds information as your agent, a cloud booking system being the textbook example, the information is treated as still held by you. IPP 12's disclosure tests do not apply to that arrangement. What does apply is responsibility: the data remains yours under the New Zealand Privacy Act, you must still meet IPP 5's security standard through the provider you chose, and a breach by your provider is treated as a breach by your salon. Choosing software carefully is therefore not just a feature comparison; it is your main security decision.

IPP 12 proper bites when you genuinely disclose information to an overseas entity for its own purposes, for example handing your client list to a foreign marketing firm. Then you need a basis: the client's informed authorisation, or a recipient subject to comparable safeguards (comparable privacy law, a prescribed binding scheme, or contract clauses). For a salon running its own records, that situation should be rare to nonexistent.

The practical duty that survives all the legal nuance: know where your clients' data lives and be able to say so plainly. Since this guide is published by a software vendor, here is our own disclosure as the example of what any provider should give you. ViteUneCoupe hosts salon data in Europe, in France and Germany, under the European GDPR regime, so your clients' information leaves New Zealand and sits under one of the strictest privacy frameworks in the world, under European rather than New Zealand jurisdiction. The client file belongs to the salon and stays exportable. The free plan includes unlimited online bookings with 0 % commission, a personalised booking page, staff schedules and the client database itself, and New Zealand mobile numbers work in it. The Standard plan (from 29 € excl. tax per month, no commitment) adds confirmation, reminder and thank-you emails plus calendar sync. Two honest limits for a New Zealand salon: the subscription is billed in euros, so the NZ dollar amount on your statement moves with the exchange rate and your bank may add a foreign-transaction fee, and reminders are email only, as ViteUneCoupe does not send SMS; NZ-built systems like Timely and Kitomba offer SMS, and that is a genuine advantage of theirs. How reminders fit into a no-show strategy, email and SMS compared honestly, is covered in our guide to appointment reminders for New Zealand hair salons.

Whoever you choose, ask three questions in writing: where is the data hosted, can I export and delete records myself, and who owns the client relationship. A provider that cannot answer the first one clearly is a bigger red flag than any particular country.

If something goes wrong: notifiable breaches and NotifyUs

Since December 2020, breach notification is mandatory in New Zealand. The Privacy Commissioner's NotifyUs guidance, checked in October 2026, draws the line at serious harm: if a privacy breach has caused, or is likely to cause, serious harm to someone, you must notify the Privacy Commissioner (through the online NotifyUs tool) and the affected people, as soon as practicable and ideally within 72 hours of realising the breach is notifiable. Serious harm includes things like financial fraud, identity theft, physical harm or intimidation, family violence risk, and significant emotional harm.

Calibrate honestly. A misfiled colour card or an email sent to the wrong regular is a breach to fix and learn from, not usually a notifiable one. A stolen laptop holding your whole unencrypted client database, or a vindictive leak of a client's details after a dispute, is exactly what the regime exists for. If you are unsure, the Commissioner's site offers an anonymous self-assessment tool, and the safe habit is to assess every incident rather than decide by gut that it is fine. Write down what happened, what you did and what you changed; that record is what shows you took it seriously.

The practical routine: notices, requests, retention, staff and exports

Everything above compresses into a short list of habits that cost minutes and cover you.

• Publish a two-paragraph privacy notice. On your booking page and visible at the desk: what you collect (contact details, visit history, technical and allergy notes), why (to run appointments and keep colour services safe), who sees it (the salon team, and the booking software that stores it, naming where it is hosted), and that clients can ask to see, correct or delete their file. Plain words beat legal boilerplate.
• Handle access requests by reflex. A client asks what is on her file: show her, within 20 working days at the outside and ideally on the spot. Fix wrong numbers when asked. If she asks you to delete her record, doing so (keeping only what tax law requires, and saying so) is both compliant in spirit and the kind of gesture that gets talked about positively.
• Set a retention rhythm. IPP 9 says keep personal information no longer than the purpose requires, without fixing a number, so fix your own: once a year, sort the file by last visit, clear clients past your cut-off, and shred paper as you go. Money records run on a different clock: Inland Revenue requires business records to be kept for at least 7 years, and if your financial records live in an offshore cloud, IRD expects you or your provider to hold its approval for offshore storage. Invoices and sales data archive on the 7-year clock; the colour formula of a client you have not seen since 2021 does not need to.
• Give every staff member their own login. One account per person, access that ends the day someone resigns, exports limited to the owner. This is IPP 5 in practice, and it is also what stops the oldest commercial injury in hairdressing: the client list leaving with a departing stylist. The same boundary matters in a chair-rental salon, where independent stylists' clients are theirs and your employed staff's records are not an open book to them; write that down on day one.
• Confirm export rights in writing before you commit to software. Your complete client list, formulas and notes included, in a standard format like CSV, exportable by you without asking permission. It is the question that matters most the day you leave a provider, and the full escape plan is in our guide to switching salon booking software in New Zealand. Export rights also sit high in our comparison of booking software for New Zealand hair salons.

None of this is bureaucracy for its own sake. The client file exists to make a client feel known; privacy practice is what keeps that feeling from curdling into "how do they have all this about me". The salons that win on client retention and rebooking are the ones clients trust with the small stuff.

Frequently asked questions

Does the Privacy Act 2020 apply to a small hair salon in New Zealand?

Yes, without exception. Unlike Australia, where a turnover threshold exempts most small businesses, New Zealand's Privacy Act 2020 applies to every agency regardless of size, sole traders and one-chair salons included. There is no registration or fee; you are simply expected to follow the 13 privacy principles, and every business needs a nominated privacy officer, which in a small salon is usually the owner.

Are colour formulas and allergy notes "health information" under New Zealand law?

The Health Information Privacy Code 2020 applies to health agencies, meaning providers of health or disability services and certain health-sector bodies, and an ordinary hair salon is not one, so the Code does not govern your records. Allergy and patch-test notes are still personal information under the ordinary privacy principles and are sensitive by nature: record them with the client's agreement, keep them minimal and factual, and never include them in marketing exports. A salon marketing itself as treating scalp conditions should seek advice before assuming the Code does not apply.

Is it legal for my booking software to store client data overseas?

Generally yes. When an overseas provider holds your data on your behalf as your agent, which is how cloud booking systems work, the Privacy Commissioner's guidance treats the information as still held by your salon rather than disclosed overseas, so IPP 12's disclosure tests are not triggered. You remain responsible for the data under New Zealand law, and your provider's breach counts as your breach, so ask any vendor in writing where data is hosted and whether you can export everything. ViteUneCoupe, for example, hosts salon data in France and Germany under the GDPR.

What do I do if a client asks to see her file?

Show her. Under the Privacy Act she has the right to access her personal information and request corrections, and you must respond as soon as possible, within 20 working days at most. A well-kept salon record contains nothing embarrassing to show, which is the point of writing factual notes. Fixing a wrong number or deleting a record on request costs minutes and builds exactly the trust the record exists to serve.

When do I have to report a privacy breach?

When a breach has caused or is likely to cause serious harm, such as financial fraud, identity theft, intimidation or significant emotional harm, you must notify the Privacy Commissioner through NotifyUs and tell the affected people, as soon as practicable and ideally within 72 hours of realising the breach is notifiable. Minor slips below that threshold should still be fixed and recorded. The Commissioner's website offers an anonymous self-assessment tool if you are unsure.

How long should I keep client records after a last visit?

The Privacy Act sets no number; it says keep personal information no longer than your purpose requires, so set your own cut-off, write it down and apply it once a year. Financial records are different: Inland Revenue requires business records to be kept for at least 7 years, so invoices and sales data stay on that clock even after the client card itself is gone.