GDPR: Day, Week, and Month Actions for Salons and Barbershops

Yes, UK GDPR applies to salons, and your business is normally the data controller for every client record you hold, even when a booking app stores it. The first step is practical, not legal: map what client data you collect, then check or obtain written Data Processing Agreements from your software vendors. From there, the rest follows: what to collect, how to record consent, and how to handle requests and breaches when they happen.

TL;DR:

• Keep a data map showing what you collect, why, where it is stored, and who handles it; obtain written Data Processing Agreements from each vendor.
• Treat patch test results, allergy notes, and skin conditions as health data: collect only what treatment requires and record separate, explicit consent.
• For promotional texts and emails, get affirmative consent unless details came from a sale and clients could opt out then and in every later message.
• Assess breaches promptly, notify the ICO within 72 hours when individuals face likely risk, and contact affected clients directly when the risk is high.
• Respond to subject access requests within one month, and delete stale appointment records and health notes once they are no longer needed for treatment.

Table of Contents

• What UK GDPR is and who counts as controller vs processor in a salon
• What salon data GDPR covers: routine information and special category data
• Lawful bases and special category rules: Article 6 and Article 9 explained
• Marketing and PECR: emailing and texting clients lawfully
• Using booking, payment and marketing vendors: DPAs and verifying processors
• Security and breaches: practical measures and what to do if data is exposed
• Records, retention, SARs and DPIAs: what to document and when
• Staff training, policies and evidence: making compliance repeatable
• Practical GDPR checklist: actions for a day, a week and a month
• How integrated, branded salon platforms can reduce compliance work
• Handling client confidentiality in shared workspaces and multi-provider setups
• Managing GDPR compliance for booking and payment integrations
• Custom branding, client images and testimonials: staying compliant
• Best practices for managing employee data under GDPR
• Compliance as trust, not just paperwork
• How Exclusively helps salons manage bookings, consent and secure payments
• FAQ
• Sources

What UK GDPR is and who counts as controller vs processor in a salon

UK GDPR is the data protection law that governs how businesses collect, store, and use personal information, enforced by the Information Commissioner’s Office. Most salon owners are controllers, meaning you decide why and how client data gets used, even when a third-party booking platform physically stores it on its servers. The booking software is typically the processor, acting only on your instructions.

That distinction carries real weight. According to ICO guidance, controllers stay legally responsible for compliance and must ensure any processor they use offers sufficient guarantees, usually through a written contract.

In practice, this means you:

• Keep records of what data you hold and why.
• Supervise any software vendor handling client information on your behalf.
• Remain accountable even if a breach originates with your booking app, not your front desk.

What salon data GDPR covers: routine information and special category data

Salons collect more personal data than most owners realize at first glance. Typical records include client names, phone numbers, email addresses, appointment history, payment references, and sometimes photos of hairstyles or treatments.

Some of this crosses into “special category” data, which carries stricter rules. Patch test results, allergy notes, and skin or scalp conditions all qualify because they reveal information about health. Under Article 9 of UK GDPR, this type of data needs both a lawful basis and a specific Article 9 condition before you can process it, with explicit, separately recorded consent as the common approach for salons.

The practical takeaway is minimization: collect only what the service requires, and keep a short note of why each category of data is necessary; for professional development on perinatal care, see formations spécialisées en massage périnatal. Common salon data includes:

• Contact details (name, phone, email, address).
• Appointment and service history.
• Payment references (not full card numbers, which processors handle).
• Health-related notes from patch tests or consultations.

The ICO has reprimanded organizations for excessive special category data collection and weak security measures, a reminder that keeping more sensitive data than you need carries enforcement risk, not just administrative burden.

Lawful bases and special category rules: Article 6 and Article 9 explained

Every piece of personal data you process needs a lawful basis under Article 6. Salons typically rely on one of three:

1. Performance of a contract, which covers booking details and payment information needed to deliver the service a client requested.
2. Legitimate interests, which can support basic record-keeping or fraud prevention, provided it does not override the client’s own privacy expectations.
3. Consent, which applies mainly to marketing communications and to any special category data you collect.

Health-related information, such as patch test results or allergy notes, needs more than a standard lawful basis. Article 9 requires a specific condition on top of your Article 6 basis, and explicit consent, recorded in writing or through a signed form, is the practical route most salons take.

Keep a simple log: which lawful basis applies to which type of data, and where explicit consent was given. A dated consultation form with a signature line for allergy disclosure satisfies this far better than a verbal confirmation nobody wrote down.

Marketing and PECR: emailing and texting clients lawfully

Sending marketing emails or texts to clients involves two overlapping laws. UK GDPR governs your lawful basis for processing their contact details, while the Privacy and Electronic Communications Regulations (PECR) separately govern the act of sending electronic marketing itself.

PECR generally requires clear, affirmative consent before you text or email promotions. There is a narrow exception, the “soft opt-in,” which applies when someone is an existing customer, you collected their details during a sale, and you gave them a clear chance to opt out at the time, plus in every message since.

• Use plain opt-in wording at booking, not a pre-ticked box.
• Keep a dated record of when and how each client consented.
• Include a working unsubscribe link or reply-to-opt-out line in every marketing message.
• Review your marketing list periodically to remove anyone who has not engaged or who opted out.

Pro Tip: Audit your marketing list regularly and remove contacts who never confirmed consent through a genuine opt-in.

Using booking, payment and marketing vendors: DPAs and verifying processors

Your salon stays the controller even when a booking app, payment processor, or email tool handles the actual data storage. The ICO’s guidance on controllers and processors makes clear that controllers must ensure any processor they use provides sufficient guarantees, typically through a written Data Processing Agreement under Article 28.

A proper DPA should spell out:

• What security measures the processor applies to protect client data.
• Whether sub-processors are involved and how they are vetted.
• How and when data gets deleted once you stop using the service.
• Whether data moves outside the UK, and what safeguards apply to that transfer.

Many salon owners assume that agreeing to a vendor’s standard terms of service shifts legal responsibility onto the vendor. It does not. You still need to demonstrate due diligence, which means requesting the DPA directly if it is not offered up front, reading the security and deletion clauses, and filing a copy where you can produce it on request.

Set a recurring reminder, once a year works well, to review every vendor contract: booking software, payment processor, email marketing tool, and anything else that touches client data. Confirm the DPA is still current and that the vendor has not changed its sub-processors without telling you.

Security and breaches: practical measures and what to do if data is exposed

Technical and organizational measures do not need to be elaborate to be effective. Basic steps cover most of the risk:

1. Restrict access to client records to staff who need them, and use individual logins rather than a shared password.
2. Require strong, unique passwords and enable two-factor authentication wherever your booking or payment software supports it.
3. Back up client data regularly and store backups securely, separate from your main system.
4. Limit who can view special category data, such as patch test results, to the staff actually performing the treatment.

If a breach happens, whether it is a lost laptop, a hacked email account, or a vendor’s own security failure, assess the likely risk to affected clients quickly. The ICO’s guidance on controller obligations points to notifying the regulator within 72 hours when a breach is likely to result in risk to individuals, and informing affected clients directly when the risk is high.

Pro Tip: Keep a simple incident log, even for near-misses, so you can show a pattern of vigilance if the ICO ever asks.

Records, retention, SARs and DPIAs: what to document and when

A basic Record of Processing Activities (RoPA) does not need to be complex for a single salon. List what data you collect, why, where it is stored, who else can access it, and how long you keep it.

Retention should be practical: delete appointment and contact records for clients who have not returned within a reasonable period, and remove patch test data once it is no longer relevant to ongoing treatment.

• Map data flows: what comes in, where it is stored, who processes it.
• Set a retention period and a routine for deleting old records.
• Respond to subject access requests (SARs) within one month of receipt.
• Run a Data Protection Impact Assessment (DPIA) when processing is high-risk, such as extensive special category data handling or international transfers through a vendor.

Staff training, policies and evidence: making compliance repeatable

Written policies turn good intentions into something you can actually demonstrate. At minimum, keep a client privacy notice, a retention policy, and a breach response policy, and make the privacy notice visible on your booking page and in the salon itself.

• Brief new staff on data handling during onboarding, not as an afterthought.
• Run a short refresher session whenever you change booking software or marketing tools.
• Use a sign-off sheet so staff confirm they have read current policies.
• Date and version every policy document so you can show the ICO what was in place and when.

Pro Tip: Store training sign-off sheets alongside your policies, dated and versioned, so compliance evidence is ready the moment anyone asks.

Practical GDPR checklist: actions for a day, a week and a month

Compliance builds in layers. Spreading the work across a day, a week, and a month makes it manageable rather than overwhelming for a small team.

1. Today: Map what client data you hold, update your privacy notice, and configure consent capture at booking.
2. This week: Request or review DPAs from every vendor, secure staff accounts with strong passwords and two-factor authentication, and brief your team on the basics.
3. This month: Build a simple RoPA, set a retention schedule, document your SAR process, and run a DPIA if you handle extensive special category data or international transfers.

How integrated, branded salon platforms can reduce compliance work

A platform that combines booking, payments, and client records under one system can simplify several of the tasks above. Built-in consent capture at the point of booking removes the need for a separate paper form, and provider-level access controls limit who on your team can view sensitive notes.

• Consent fields captured directly during online booking, recorded automatically.
• Access permissions set per provider, limiting exposure of client records.
• Export and deletion tools that support SAR responses and retention cleanup.
• A single payment processor relationship, reducing the number of separate vendor contracts you need to verify.

Centralizing these functions in one system does not remove your responsibilities as controller, but it does reduce the number of separate tools and contracts you need to track.

Handling client confidentiality in shared workspaces and multi-provider setups

Suite-style salons and shared workspaces raise a specific wrinkle: multiple independent providers often operate under one roof, sometimes sharing a reception area, a booking screen, or even a client list. Each provider who makes their own decisions about how they use client data is likely a separate controller in their own right, not a processor working for the suite owner.

That separation matters practically. A client’s patch test results or payment history belonging to one provider’s business should not be visible to another provider unless there is a clear reason and the client understands it. Shared booking screens left logged in, printed client lists left on a front desk, or a shared tablet with every provider’s appointments visible all create unnecessary exposure.

A few habits reduce this risk meaningfully:

• Give each provider their own login and client list, rather than one shared account for the whole suite.
• Avoid printing client records where other providers or walk-in clients can see them.
• Clarify in your suite agreement who is responsible for which clients’ data, so accountability is not ambiguous if something goes wrong.
• Lock screens and secure devices between uses, especially on shared front-desk computers.

Clients book with an individual stylist or barber, not with “the building,” so their reasonable expectation is that their information stays with the person they trust, not everyone working nearby.

Managing GDPR compliance for booking and payment integrations

Personalized booking systems collect data at every step: name, contact details, service preferences, appointment history, and payment information. Each integration point is an opportunity to either tighten or loosen your compliance posture, so it is worth treating the booking flow itself as a compliance checkpoint, not just a convenience feature.

When a client books online, the system should only ask for what is genuinely needed to deliver the service. A field asking for health information or allergy details should come with its own explicit consent checkbox, separate from the general booking confirmation, because that data falls under Article 9’s stricter rules.

Payment integrations add another layer. Processors like Square and Stripe handle the actual card data, which reduces your own exposure to that sensitive information, but you still need to understand what each processor does with transaction data and whether their terms meet your obligations as controller. Reviewing Square’s payment processing terms or Stripe’s processing terms before integrating either one into your booking flow tells you exactly what data they process and retain.

Three habits keep integrated booking and payment systems compliant:

• Confirm that any health-related booking fields carry separate, explicit consent, not a bundled checkbox.
• Check what the payment processor retains beyond the transaction itself, and for how long.
• Keep the DPA for your booking platform on file alongside the one for your payment processor, since they may be separate vendors with separate guarantees.

Custom branding, client images and testimonials: staying compliant

Using a client’s photo on your website or social media, or quoting their testimonial, is personal data processing just like any appointment record, and it needs its own lawful basis. A signature on a service consultation form does not automatically cover marketing use of a before-and-after photo.

The practical rule is simple: get specific, written consent for each use you intend. A client who agrees to a photo for your internal portfolio has not agreed to that same photo appearing in a Instagram ad or on your homepage. Separate consent requests for separate purposes avoid ambiguity later.

A few steps keep image and testimonial use clean:

• Use a dedicated consent form for photos and testimonials, separate from treatment consent forms, specifying exactly where the image or quote may appear.
• Record the date and scope of consent, and let clients withdraw it at any time, removing the content when they do.
• Avoid including identifying health details in a testimonial or caption, since combining a client’s name, photo, and a reference to a skin condition or treatment they received for it can inadvertently expose special category data.
• Review your website and social accounts periodically to confirm every published photo or quote still has valid, current consent behind it.

Treat withdrawal requests seriously and promptly. A client who no longer wants their photo online should see it removed within a reasonable timeframe, not left up because reposting is inconvenient.

Best practices for managing employee data under GDPR

Client data gets most of the attention in salon compliance discussions, but staff records carry the same legal weight. Employee files typically include contact details, payroll information, bank details, right-to-work documents, and sometimes health information related to sick leave or workplace accommodations.

The same minimization principle applies: collect what employment law and payroll genuinely require, and avoid keeping informal notes about staff that go beyond what is necessary. Health-related employee information, such as a note about a medical condition affecting scheduling, falls under the same Article 9 special category rules as client health data, meaning it needs a specific condition and careful handling.

Practical steps for employee data include:

• Store personnel files separately from client records, with access limited to whoever handles HR or payroll.
• Set a clear retention period for employee records after someone leaves, rather than keeping files indefinitely.
• Give staff visibility into what personal data you hold about them and how long you keep it, typically through a short staff privacy notice.
• Secure digital HR records with the same access controls and password protections applied to client data.

Employees have the same subject access rights as clients, meaning a staff member can request a copy of their own personnel file, and you need a process ready to respond within the same one-month window that applies to client SARs.

Compliance as trust, not just paperwork

Clients notice when a salon takes their information seriously. A clear privacy notice, an easy opt-out, and visible care with sensitive notes say more about professionalism than most marketing ever will. Document what you do, lean on vendor contracts to cut the manual work, and treat compliance as part of the service you provide.

— Service

How Exclusively helps salons manage bookings, consent and secure payments

Reducing the number of separate systems you manage is one of the most practical ways to cut compliance work. A platform that combines a branded website, booking system, and payment processing under one system can simplify data management, with provider-level access controls so each stylist or barber manages their own client data without unnecessary overlap. Consent capture happens directly at booking, and payments run through Square integrations with clear processing terms.

If you want one system instead of five vendor contracts to track, see pricing plans starting with the Business Website plan at $49 per month, or book a call to walk through what fits your salon.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What is GDPR in hairdressing?

GDPR in hairdressing refers to the data protection rules salons and barbershops must follow when handling client information, including contact details, appointment history, and health-related notes like patch test results. Salons are typically the data controller, responsible for how that information is collected, stored, and shared, even when using third-party booking software.

Is GDPR required in the USA?

UK GDPR and the EU’s GDPR apply specifically to the UK and European Economic Area, not to businesses operating solely in the United States. US salons follow a different patchwork of state privacy laws instead, so a salon’s obligations depend on where it operates and where its clients are located.

What are the 7 GDPR requirements?

Common summaries of GDPR’s core principles include lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability. For salons, this translates into collecting only necessary client data, keeping it accurate and secure, and being able to demonstrate compliance through records and policies.

Is GDPR more strict than HIPAA?

GDPR and HIPAA cover different territories and scopes, so a direct strictness comparison is not straightforward. GDPR applies broadly to all personal data processed in the UK and EU across every sector, while HIPAA applies specifically to health information within the US healthcare system, meaning salons outside the US typically follow GDPR rather than HIPAA regardless of the type of data involved.

Sources

• A guide to controllers and processors | ICO
• Regulation (EU) 2016/679 Article 9 (special categories of personal data)