Hair salon client records and UK GDPR: the practical guide

Name, mobile number, appointment history, the colour formula scribbled on the back of a record card: your client file is full of personal data. UK GDPR therefore applies to your hair salon, whether you are a limited company with six stylists in Manchester or a self-employed stylist in Cardiff whose client list lives in a notebook.

The good news is that the real obligations are smaller, cheaper and more practical than most of the advice circulating online suggests. There is no licence to obtain and no approval to wait for. For most salons it comes down to one modest annual fee, a short written record of what data you hold and why, a clear sentence or two telling clients what you do with their details, and sensible habits around security and deletion.

This guide is published by ViteUneCoupe, a free online booking system for hair salons with no commission, whose free plan includes a client database with full appointment history. The rules below apply whatever tool you use, paper notebook included, and every important point links to the primary source: the Information Commissioner's Office (ICO), GOV.UK or legislation.gov.uk, not somebody's marketing blog.

Does UK GDPR apply to your salon?

Yes, as soon as you keep information about identifiable people. A first name attached to a mobile number is enough. The framework is the UK GDPR together with the Data Protection Act 2018, and it applies to businesses of every size, sole traders included. Data protection is reserved to Westminster, so the same rules apply in England, Scotland, Wales and Northern Ireland: no need to check nation by nation for once.

Two clarifications that surprise many salon owners:

• Paper counts. A structured set of client record cards or an appointment book with client details falls under the rules, not just software.
• UK GDPR is not EU GDPR. Since Brexit the UK runs its own version of the regulation, supervised by the ICO rather than a European authority. The two regimes are still very close in practice, but the fees, forms and guidance that apply to you are the ICO's.

The ICO data protection fee: the one formality most salons must handle

Here is the point that most generic GDPR articles get wrong or skip entirely. In the UK, organisations that process personal data must normally pay an annual data protection fee to the ICO under the Data Protection (Charges and Information) Regulations 2018, unless an exemption applies. This is not a registration you wait to have approved; it is a fee you pay online, and the ICO actively chases businesses that have not paid.

The amounts, as published by the ICO and checked in October 2026:

Almost every hair salon lands in Tier 1, and the fee drops by £5 if you pay by direct debit, so £47 a year in practice. There are exemptions for some processing, and the ICO provides a short self-assessment on its fee pages to check your own situation; note that using CCTV for crime prevention requires the fee regardless. Budget the £47 and move on: it is the cheapest compliance line on your books, and paying it is far cheaper than explaining to the ICO why you did not.

What personal data does a hair salon actually hold?

Take an honest inventory, paper included. A typical salon holds:

• Contact details: name, mobile number, email, sometimes a postal address.
• Appointment history: dates, services, which stylist, amounts paid.
• Technical notes: colour formula, developer strength, processing time, hair condition, preferences.
• Free-text notes: "prefers the basin by the window", "always ten minutes late", and whatever else gets typed in.
• Sometimes photos: before-and-after shots kept on a record or posted to Instagram.

One category deserves particular care. A note such as "allergic to PPD" or "scalp treated for psoriasis" is health information, and health data is special category data under UK GDPR, with stricter rules set out by the ICO. In practice for a salon: record an allergy or patch-test result with the client's explicit agreement, because it is necessary for her safety, keep the note to the strict minimum, and never share it.

Patch tests are the obvious example. The National Hair & Beauty Federation advises keeping a written record of every allergy alert test for at least six years, signed or initialled by stylist and client, partly because your insurer will ask for it if a reaction ever becomes a claim. Keeping those records is both good data protection and good insurance practice: the two pull in the same direction here.

Photos follow the same logic as health notes: keeping a before-and-after in the client's record and publishing it on your salon's Instagram are two different uses that need two separate agreements. A verbal yes for the record card does not cover publication.

Finally, remember that free-text notes are readable by the client if she ever asks for a copy of her data. A simple rule keeps you safe: never write anything in a client record you could not comfortably show to the person it describes. This article covers the legal layer; what actually belongs on each card, field by field, from formula to preferences, is in our practical guide to hairdresser client record cards.

What legal grounds cover a salon's client data?

UK GDPR requires every use of personal data to rest on a lawful basis. Three cover almost everything a salon does:

• Performing the service (contract): booking the appointment, looking up last visit's colour formula, contacting the client if you need to move her slot. No separate consent needed; this is the business relationship itself.
• Legal obligation: keeping financial records for HMRC. A self-employed stylist must keep business records for at least 5 years after the 31 January submission deadline of the relevant tax year; a limited company must keep accounting records for 6 years from the end of the financial year.
• Consent: sending promotional messages, publishing a photo, recording health information. Consent must be a real, active choice, never a pre-ticked box.

Telling clients what you do with their data

UK GDPR requires clear information at the point you collect details: who holds the data, what for, how long, and what rights people have. For a salon, two simple measures cover it:

• In the salon: a short notice at reception, along the lines of "We keep your contact details and service history to manage your appointments. Ask us at any time to see, correct or delete them."
• Online: a privacy note on or linked from your booking page, visible where clients type in their details.

Information is not consent: you do not need every client to sign a form just so you can keep a record card. You simply need to make it easy for her to find out what you do.

How long should you keep client records?

The storage limitation principle, explained by the ICO, says you must not keep personal data longer than you need it, and UK GDPR deliberately sets no fixed retention periods for client records: you choose your own, justify them, write them down and apply them. For a salon, a defensible and easy-to-run policy looks like this:

The 3-year figure for lapsed clients is an example of a reasonable policy, not a legal deadline: what matters is that you pick a period you can justify, document it, and actually apply it. Practically, once or twice a year, sort your client file by last appointment date and delete or anonymise the dormant records that have passed your cut-off. Accounting data is different: it goes into separate archive storage until the HMRC clock runs out, then gets destroyed.

Appointment reminders or marketing messages: two different regimes

This is the most common confusion in salon software marketing, and it is worth getting exactly right.

Service messages (booking confirmation, a reminder the day before, a message about a schedule change) are not direct marketing. The ICO lists appointment confirmations and reminders explicitly as administrative messages that fall outside the marketing rules, as long as they stay purely informative. "Your appointment is tomorrow at 2pm" is a service message; "Your appointment is tomorrow at 2pm, and ask us about our colour offer" is marketing. These reminders are also the single most practical weapon against no-shows in a UK hair salon. The automatic confirmation, reminder and thank-you emails in ViteUneCoupe's Standard plan (from 29 € excl. VAT per month, billed in euros, no commitment) are exactly this kind of message: appointment information, not advertising.

Marketing messages (a colour promotion, a birthday offer, a "we have not seen you in a while" discount) fall under the Privacy and Electronic Communications Regulations (PECR) on top of UK GDPR. The ICO's rules on marketing by email and text require prior consent, with one practical exception known as the soft opt-in: you may market to existing customers about your own similar services, provided you gave them a clear chance to refuse when you collected their details and you offer an easy, free opt-out in every message.

The classic trap: recycling numbers and emails collected for bookings into a promotional mailing list without ever having offered that opt-out. If you plan to run campaigns, add the tick-box at the moment you first collect contact details, and keep the evidence. Our guide to appointment reminders for hair salons covers timing and wording in detail.

Your clients' rights over their data

Four requests can land at reception, and the ICO's subject access guidance frames the first:

• Access: "What do you hold about me?" You provide the full record, free-text notes included, normally within one month.
• Rectification: a wrong number or misspelt name gets corrected.
• Erasure: "Delete my record." You delete contact details and history, but you keep what the law obliges you to keep, such as invoices in her name for the HMRC retention period.
• Portability: a client can ask for a copy of her data in a reusable format.

No formality is required from the client: a verbal request at the basin counts, although asking for it in writing makes your life easier.

Securing the client file: the basics

Translated for a salon, reasonable security means:

• One login per person: each stylist has their own account in the software, not a shared password on a sticky note.
• Strong, separate passwords, different from personal accounts.
• Backups: a single paper notebook can be lost in a flood or a break-in; an Excel file on one laptop with no backup is no better.
• Locked devices: the reception tablet locks when it is put down.
• Leavers handled same-day: when a stylist leaves, their access is cut immediately. A client file walking out with a departing stylist is a data protection problem and a commercial one, a real concern in salons that rent chairs; our guide to chair rental in a UK hair salon touches on who owns which client list.

If a serious breach happens (the file is stolen, the account is hacked), UK GDPR requires notifying the ICO within 72 hours where the breach risks harming the people concerned.

What to check in your booking software

As soon as your client file lives in software, the provider processes data on your behalf: it is a processor under UK GDPR, and you remain responsible for the file. Three questions to ask before signing, or to check with your current provider:

1. Where is the data hosted? Hosting in the UK is simple. Hosting in the European Economic Area is simple too: the ICO confirms that all EEA countries have full UK adequacy, so data can flow there without extra paperwork. ViteUneCoupe hosts salon data in Europe, which sits squarely within that adequacy. Hosting outside the UK and EEA is not forbidden, but it needs transfer safeguards: ask the provider which ones.
2. Can you export your file? You must be able to retrieve your client data if you change tools, and to delete a record when a client asks. A provider that locks your file in puts you in breach of your own obligations; our guide to switching salon booking software explains how to export before you cancel.
3. Who owns the client relationship? Some marketplaces sit between the salon and its clients, who become users of the platform as much as clients of your salon. We detail that trade-off in direct bookings versus marketplaces. ViteUneCoupe's position is the opposite: the client file belongs to the salon, with no marketplace in between.

Frequently asked questions

Do I need to register with the ICO?

Most salons must pay the annual data protection fee, which also places you on the ICO's register: £52 for a micro business, £5 less by direct debit, checked in October 2026. It is a payment, not an approval process. The ICO's fee pages include a short self-assessment to confirm whether an exemption applies to you.

Are colour formulas and allergy notes special category data?

The colour formula itself is ordinary personal data. An allergy note or patch-test result relates to health, which is special category data under UK GDPR: record it with the client's explicit agreement, keep it minimal, and keep patch-test records at least six years, as the NHBF and insurers advise.

Can I text or email promotions to my clients?

Yes, under the PECR soft opt-in: they are existing customers, the promotion concerns your own similar services, you offered a chance to refuse when you collected their details, and every message carries a free, easy opt-out. For anyone else, you need prior consent. Appointment confirmations and reminders are service messages, not marketing, and need no marketing consent.

How long can I keep a client's record after her last visit?

UK GDPR sets no fixed period: you choose one, justify it and apply it. A documented policy such as "deleted three years after the last appointment" is easy to defend and easy to run. Tax records follow their own rules: 5 years after the submission deadline for the self-employed, 6 years for companies.

Is a paper appointment book covered by UK GDPR?

Yes. Structured paper records such as client cards or an appointment book with contact details are covered. The same rules apply: tell clients what you keep, do not keep it forever, keep the book out of sight of other clients, and show or delete a record if its owner asks.

What happens if a salon ignores all this?

The ICO can issue reprimands, enforcement notices and fines, and it routinely fines businesses that simply fail to pay the data protection fee. For a small salon acting in good faith, the realistic day-to-day risks are closer to home: an unanswered access request turning a loyal client into a complaint, or a client file leaving with a departing stylist. The fee, a short retention policy and tidy access habits cover the essentials.