GDPR • Client data
GDPR and client data in a salon: how to protect cards, photos and consents
A salon collects personal data at every booking: name, phone, allergies and sometimes before/after photos. Under GDPR, the salon must be able to show how it collects, stores and accesses this data. Below you'll see how to protect client data in a salon under GDPR, without the jargon.
The essential measures (short answer)
- Request and record explicit consent for contact data and for before/after photos.
- Encrypt client data at rest and in transit.
- Grant access rights by role: front desk, stylists and the manager see only what they need.
- Keep an access log: who opened a client's card and when.
- Define a retention period and respond to client requests (access, erasure).
The client's rights
- Right of access: the client can request a copy of the data in their card.
- Right to rectification: they can ask for an incorrect record to be fixed (for example a wrongly noted allergy).
- Right to withdraw consent for the use of before/after photos.
- Right to erasure, when there is no longer a legal basis to retain the data.
Table: GDPR requirement and how to meet it
GDPR requirements for a salon
| Requirement | How to meet it |
|---|---|
| Legal basis | Explicit consent or performance of the service |
| Security | Encryption, access log, backup |
| Access | Role-based rights, authentication |
| Before/after photos | Separate, revocable consent |
Common mistakes
- Posting before/after photos on social media without the client's consent.
- Keeping client data in a WhatsApp group or an unencrypted file, accessible to the whole team.
- Having no access log, so you cannot prove who read a client's data.
How 4beautify helps
- A web app, with no installation, built on GDPR principles.
- Before/after photos live on the client card, not on the stylist's personal phone.
- Colour formulas and service history centralised in one place, not in notebooks.