GDPR for beauty therapists in the UK: client data and consent

GDPR for beauty therapists in the UK means handling client records under the UK GDPR and the Data Protection Act 2018. Allergy and patch-test results can reveal health information, which needs a lawful basis and a separate condition under Article 9 of the UK GDPR, according to the UK Government. PECR also requires consent before promotional emails and texts, subject to the soft opt-in for existing customers.

It’s easy to treat a consultation form as routine salon paperwork. But client health notes, photographs and contact details all need careful handling. Permission to use personal data for marketing is separate from consent to treatment or permission to keep a photo in a client record.

This guide explains what to consider when collecting and storing client information, recording patch-test results, taking before-and-after photos and sending promotional messages. It outlines how the rules apply to everyday salon work and how to make your record-keeping and consent processes more organised.

Why follow GDPR if I comply with the Data Protection Act?

UK beauty salons processing personal data are subject to the UK GDPR and the Data Protection Act 2018, according to the UK Government. That applies to digital records as well as paper forms.

Duties beyond Data Protection Act compliance

Previous compliance with the Data Protection Act doesn’t remove current data protection duties. The UK Government states that salons processing special category health data need both a standard lawful basis and a separate condition under Article 9 of the UK GDPR. A client’s allergy notes or medication details may include health information. Explicit consent can provide a condition in some situations, but it doesn’t replace the need for a lawful basis.

Booking platforms and data processing agreements

A data processing agreement sets out how an online booking platform handles personal data for a salon. Salons using these platforms should have an agreement in place. Consider what information the system processes, such as names, contact details and appointment records, and how the agreement allocates responsibilities. For mobile beauty professionals, a booking setup for mobile beauty can support appointment administration, while the salon remains responsible for its data protection decisions.

If a breach exposes client information, assess the risk promptly. The Information Commissioner’s Office says a breach posing a risk to people’s rights and freedoms must be reported to the relevant supervisory authority within 72 hours of the salon becoming aware of it.

ICO registration and data protection fees

Whether a therapist must register with the ICO and pay a data protection fee depends on the business’s data processing and whether an exemption applies. Most small UK businesses that need to pay the fee pay £52 a year for tier 1, or £47 by direct debit. Use the ICO’s fee-checking process to establish whether the requirement applies to your business.

Fines and risks for beauty therapists

Data protection failures can expose a salon to regulatory action, financial penalties and harm to client trust. Under the UK GDPR, serious client-data breaches can result in fines of up to £17.5 million or 4% of annual global turnover, whichever is higher. A misplaced consultation form or an email sent to the wrong recipient can also expose private client details. Clear access controls and prompt breach handling help limit avoidable risks.

Are allergy records and patch test results personal data?

Yes. A patch-test result linked to a named client is personal data, and allergy details can reveal health information. For beauty therapists in the UK, GDPR means collecting these records for clear, treatment-related purposes, not as general notes. Keep entries accurate and relevant, and limit access to people who need the information for their work.

Consent is one possible lawful basis for processing personal data, but it is not automatically the right basis for every purpose. Explain in your privacy information what you collect, why you use it, how long you keep it and how clients can exercise their rights. Agreement to keep a treatment record does not automatically cover unrelated uses, such as promotional messages. Record these purposes separately.

Set a retention schedule for each type of record, linked to its purpose. UK GDPR says personal data should be kept only as long as necessary. When allergy details or patch-test results are no longer needed, securely dispose of paper copies and delete digital records, including redundant copies where practical. If a data breach exposes records, include the affected information in your response and risk assessment.

Clients can ask to access their personal information and request corrections. They also have rights to erasure, restriction, objection and data portability, although these rights depend on the circumstances. The Information Commissioner’s Office says a subject access request generally needs a response within one month. For a complex request, the deadline may be extended by up to two more months.

Make requests easy to recognise, whether a client asks informally by email or in person. Locate relevant records across consultation forms, appointment notes and messages, then respond securely. A clear privacy policy helps clients understand these purposes and rights. Digital consultation and consent forms can help organise collected information; see how a digital booking setup could look.

Do I need consent to post before-and-after photos?

Get clear permission before taking or sharing identifiable treatment photos. Permission to keep an image in a client record does not automatically allow you to use it publicly.

Consent for treatment photos and social media

Ask before taking a before-and-after photo, then obtain permission again before posting it. A client may agree to keep an image in their record but decline public use. Specify the intended channels, such as Instagram or your salon website, so the client knows where the photo may appear. Record their choice and make it straightforward to withdraw permission.

Lawful basis and explicit consent

For marketing images, beauty salons and cosmetic practices should obtain explicit written consent. In established clinics such as Vie Aesthetics, capturing clinical before-and-after imagery requires strict consent protocols to ensure patient confidentiality is respected. A signed form can record the purpose and selected channels, but the client’s choice should be specific to those uses. If a photo also reveals health information, processing it requires a lawful basis and a separate condition for that special category data. Keep permission for photos distinct from consent to treatment.

Consent on consultation forms

A consultation form can collect photo permissions if the choices are clear and separate. Offer distinct options for keeping an image in the client record and sharing it on social media. Don’t use pre-ticked boxes. Record when consent was collected, which uses were agreed, and any later withdrawal. Keep photos only for as long as active consent supports their use.

Website cookies and tracking choices are separate from photo permission. A client’s agreement to share an image does not also authorise tracking on your salon website. Using a managed cloud consent platform can help ensure your website handles visitor cookies and privacy regulations transparently. Explain these choices separately, and link the consent record to the relevant image and use.

PECR rules for promotional emails and texts

PECR requires UK salons to get consent before sending promotional emails or texts to individual clients, subject to the soft opt-in for existing customers. A message advertising a discount on a future treatment is promotional. An appointment confirmation, by contrast, provides information about a booking already made. Keep marketing messages separate from necessary appointment communications.

For a new client, treat marketing permission separately from collecting contact details for bookings. Get consent before adding their details to a promotional mailing list. Use a clear, unticked choice that identifies your salon and explains what messages they’ll receive. A client who shares a mobile number to arrange an appointment has not automatically agreed to receive offers by text. Record when and how permission was collected.

The soft opt-in can apply to existing customers, but it is not blanket permission to market to every past or potential client. Keep records of how a contact became a customer and which messages they agreed to receive. If you rely on this route, give clients the opportunity to refuse marketing when collecting their contact details and in each message.

Make it easy to withdraw permission. Include a working unsubscribe option in promotional emails and a clear way to opt out of texts. Act on the request by removing the person from marketing messages, while retaining only the information needed to respect their choice. Don’t use sensitive allergy or treatment details to target promotions just because you hold them for an appointment.

Before sending a one-off offer, seasonal campaign or rebooking prompt, identify its purpose and check the client’s permission or whether the soft opt-in applies. Include an opt-out route in the message. Data protection compliance and PECR’s marketing requirements are related, but meeting one does not replace the other.

Bookivo

Bookivo can help bring appointment management and your client-facing booking journey into a more organised system. Its online appointment booking system and branded booking website help beauty and aesthetics businesses manage bookings in one place. If you’re reviewing how client information moves through your booking process, consider how the platform fits alongside your privacy information, consent choices and data protection procedures.

Booking software does not decide your lawful basis, set your retention periods or make your business GDPR compliant. You remain responsible for those decisions, including reviewing the data processing agreement and explaining your practices to clients. Bookivo may suit salons and therapists who want to manage appointments through a branded digital experience instead of relying solely on scattered booking messages.

Make your client-data process easier to maintain

Make privacy practices part of your normal business routine. Keep responsibilities clear, review how client information moves through your booking process, and make consent choices easy to understand. Data protection habits are easier to maintain when they fit into everyday appointment management rather than a separate collection of scattered notes.

For beauty therapists in the UK, GDPR compliance is an ongoing part of running a professional service, not a one-off paperwork task. Bookivo offers Beauty & Salon Booking Software, Aesthetics Clinic Booking Software and an Online Appointment Booking System to support appointment management. Your business remains responsible for its own data protection decisions and procedures.

Choose a next step that suits your salon, clinic or solo practice. A more organised booking process can provide a practical foundation for handling client information thoughtfully.

Frequently Asked Questions

How does a beauty salon collect and use personal data?

Salons collect personal data through booking forms, consultation records, payment processes and conversations with clients. A booking may need a client’s name and contact details, while a consultation may record information relevant to a service. Use each detail for a defined purpose, limit access to people who need it, and don’t reuse treatment information for unrelated marketing.

How long should you keep records?

Keep client records only for as long as they’re needed for the purpose for which you collected them. Set a retention schedule that distinguishes, for example, appointment details from health-related consultation notes. Review it periodically, then securely dispose of paper files and delete digital records when they’re no longer needed. One retention period may not suit every type of record.

Do salons need a privacy policy?

Give clients clear privacy information explaining how your salon uses their personal data. You could provide this in a privacy notice or policy on a booking page or alongside a consultation form. Explain why you collect information, how clients can raise questions and where they can learn about their data rights. Make sure the wording reflects your actual practices.

How does UK GDPR affect my beauty salon business?

UK GDPR affects how a salon collects, stores, uses and shares information that identifies clients. This includes ordinary details such as contact information and records that may reveal health information. Your salon also needs clear processes for handling client requests, protecting records and responding to problems. The practical requirements depend on what information you handle and why.

Okay, so what do I need to do to create a GDPR-compliant salon?

Start by mapping the client information your salon collects, from online bookings to consultation notes. Record why each detail is needed, who can access it and how long it should be kept. Give clients clear privacy information, separate treatment permissions from marketing choices, and establish a process for requests and suspected data breaches. Review these arrangements when your services or systems change.

What is UK GDPR?

UK GDPR is the data protection framework that governs how organisations process personal data in the United Kingdom. For a beauty business, processing includes collecting, storing, viewing and sharing client information. It works alongside the Data Protection Act 2018. Together, these rules shape how salons handle client records and explain their use of personal information.