This is a general overview, not legal advice. The Information Commissioner’s Office (ICO) has detailed guidance for small businesses at ico.org.uk.
Every salon keeps personal information: names, phone numbers, appointment history and often health details. UK data protection law applies to all of it. The good news is that most of what it asks for is sensible good practice.
Only keep what you need
Collect the information you need to look after clients and run your business, and no more. Keep it up to date, and do not keep it forever: decide how long you need records for and delete or anonymise old ones.
Health information needs extra care
Consultation forms, allergies, patch tests and medical history count as special category data. Keep it secure, limit who can see it, and make sure clients understand why you are asking. Aesthetics clinics in particular should keep detailed, secure treatment records.
Marketing needs consent
Sending marketing emails and texts to clients generally needs their consent, and they must be able to opt out easily. Record when and how each client gave consent. Appointment confirmations and reminders are service messages, not marketing.
Be ready for client requests
Clients can ask for a copy of the information you hold about them, ask you to correct it, or in some cases ask you to delete it. You usually need to respond within a month. Know where your data is so you can find it quickly.
Tell clients what you do with their data
Your website’s privacy policy should explain what you collect, why, who you share it with (for example your payment or text message provider) and how long you keep it.
Check whether you need to register with the ICO
Most businesses that handle personal information need to pay the ICO data protection fee. The ICO has a short self-assessment on its website.
How WearBeauty helps
- Client data stays in your own WordPress database, not on our servers
- Email, text and WhatsApp marketing consent recorded with the date and where it came from
- Unsubscribe links and Reply STOP handled automatically
- Notes and form answers can be limited to managers or clinical staff
- Works with WordPress’s own personal data export and erase tools, plus an “Erase personal data” button on each client
- Suggested wording for your privacy policy
Step by step: exporting data and handling requests