Client privacy notice

What you need to know

The plain-English guidance that comes with this document.

• Salons hold real personal data — this is your GDPR notice for clients. Names, contact details and, importantly, health information (allergies, conditions, patch tests) are all personal data, and health details are "special category" data with extra protection. UK GDPR says you must tell clients, in plain language, what you hold and why. This notice does that — display it and/or hand it over, and point to it on your consultation card.
• You're the "data controller". That's why this notice carries your name and address — a privacy notice has to identify who's responsible for the data. If you ever appoint someone to handle data questions, add their contact here.
• Health data needs a clear basis — usually the client's permission. Because health information is sensitive, be able to show why you hold it (to treat safely) and that the client agreed. The consultation card's "the information I've given is accurate and I'm happy to go ahead" plus this notice covers the everyday case; keep it honest and proportionate — only collect what you actually need.
• Keep it secure, and don't keep it forever. Lock paper cards away or use a password-protected system, don't leave client details on the reception desk, and clear out records you no longer need. A shoebox of old client cards anyone could read is a breach waiting to happen.
• Marketing is opt-in. Texting or emailing clients offers needs their consent, and an easy way to opt out. Don't assume a client who booked a haircut wants your newsletter.
• Clients can ask to see their data. If a client asks for a copy of what you hold (a "subject access request"), you generally have to provide it, free, within a month. It's rare in a salon, but know it can happen.
• Applies UK-wide. UK GDPR and the Data Protection Act apply across the whole UK. The ICO has free, small-business-friendly guidance if you want to go further.