UK GDPR for beauty salons: a practical checklist.

Beauty businesses often collect personal information at many small moments: an online booking, a phone call, a consultation form, a patch-test note, a photograph, a payment, a Wi-Fi sign-in or a marketing message. Compliance becomes difficult when each tool is viewed in isolation.

A useful review starts with the complete data journey.

2026 update: the DUAA is now in force

The Data (Use and Access) Act 2025 overview from the ICO says all its data-protection provisions were in force by 19 June 2026. The Act amends rather than replaces the UK GDPR, Data Protection Act 2018 and PECR.

For a salon, the most practical review points include:

• a required process for data-protection complaints;
• updated right-of-access rules, including clarification around reasonable and proportionate searches;
• changes to storage and access technologies, with additional limited exceptions;
• changes concerning automated decision-making and safeguards;
• clarification that direct marketing may be a legitimate interest under data-protection law, while separate PECR rules still apply to electronic mail.

Do not rename the privacy notice and consider the work complete. Check the systems, complaint route, cookie configuration, rights procedure and marketing logic against current ICO guidance.

1. Map what the salon actually processes

Create an inventory that identifies:

• the data category;
• the person it relates to;
• the purpose;
• where it comes from;
• each system and supplier that receives it;
• who can access it;
• where it is stored or transferred;
• how long it is retained;
• how it is corrected, exported or deleted.

Include the less obvious systems: personal messaging devices, CCTV, staff scheduling, email exports, spreadsheets, cloud backups, social-media messages and generated content tools.

The ICO’s data minimisation guidance explains that personal data should be adequate, relevant and limited to what is necessary for the stated purpose. “It may be useful later” is not a clear purpose.

Prioritise the inventory by plausible impact:

Data or system	Typical risk question	First control to verify
Basic booking record	Can the wrong staff member view or change it?	Roles, authentication and audit
Consultation or suitability information	Does it reveal health or other special category data?	Necessity, condition, access and retention
Before-and-after media	Is service evidence being reused for marketing?	Separate purpose and permission
WhatsApp or social inbox	Is context copied to personal devices or hidden from the team?	Approved inbox, ownership and deletion
CCTV	Are purpose, signage, viewing and retention controlled?	Documented need and access
AI or automation supplier	Is client content used beyond the instructed service?	Contract, configuration and supplier assessment

One useful register row should connect data → person → purpose → lawful basis → system → recipients → location → access → retention → deletion method → owner. If an owner cannot complete those fields, the activity is not yet understood.

2. Document purpose and lawful basis

Consent is not required for every use of personal data, and it should not be chosen automatically. Booking and providing a requested service, meeting a legal obligation, legitimate interests and consent can apply in different circumstances.

For each activity, record the purpose and appropriate Article 6 lawful basis before processing. If the salon collects information that reveals health data—for example, some consultation or suitability information—special category rules may apply as well. In that case, the business needs both an Article 6 basis and an applicable Article 9 condition, plus stronger attention to minimisation and security. The ICO provides specific special category data guidance.

Do not collect a broad health history merely because a template includes it. Work with appropriate professional advice to define what each service genuinely requires.

The DUAA’s clarification that direct marketing can be a legitimate interest does not make every marketing message lawful. The data-protection basis and the PECR rule for the channel are separate questions. Record both where necessary.

3. Give privacy information at the right time

A privacy notice should explain, in accessible language:

• who controls the data and how to contact the business;
• what categories are collected and why;
• lawful bases and, where relevant, special category conditions;
• recipients or categories of recipients;
• international transfer information where relevant;
• retention approach;
• individual rights and how to exercise them;
• the right to complain to the ICO;
• important automated processing, where applicable.

The notice must reflect reality. Updating website wording without changing uncontrolled spreadsheets or supplier access is not compliance. The ICO provides a small-organisation privacy notice checklist.

Place concise privacy information at booking, consultation, Wi-Fi, forms and other collection points, with a route to the full notice.

4. Separate service communication from marketing

An appointment confirmation and a promotional campaign do different jobs. Do not hide marketing agreement inside the acceptance needed to book.

Electronic mail under PECR is broad and includes email, text and some direct messaging. The ICO states that organisations normally need consent to send unsolicited electronic marketing to individual subscribers unless a limited soft opt-in applies. Valid consent must be freely given, specific, informed and indicated by a positive action; pre-ticked boxes are not enough. Read the ICO’s current electronic marketing guidance.

Maintain evidence of the rule relied on, channel-specific preferences and a suppression record so an opt-out is respected in later imports and campaigns.

5. Review cookies and similar technologies

A privacy-policy link does not by itself authorise analytics or advertising technologies. Under the updated rules, some storage or access can operate without consent where a specific exception applies. The ICO’s April 2026 guidance on storage and access technologies covers strictly necessary use and newer limited exceptions, including certain statistical-purpose and site-appearance or functionality uses.

Do not classify all analytics as exempt. Check the exact purpose, parties, information used and conditions. Some exceptions require clear information and a simple means of objecting. Tracking and profiling for online advertising generally require a different assessment, and non-exempt technologies must not be pre-enabled before valid consent.

Audit the live site, not only the consent-banner settings. Tags can be injected by chat, video, maps, booking widgets, analytics and advertising tools. Record each technology’s purpose, provider, duration, data flow, rule relied on and actual blocked-or-enabled state.

6. Control images and social content

An identifiable client image is personal data. Before using photographs, videos, testimonials or before-and-after content, document the purpose, permission and withdrawal process appropriate to the use. Keep marketing permission distinct from any image captured for a service record.

AI-generated or edited media also needs human review. Do not upload private client material into an AI tool without an approved purpose, supplier assessment and access controls.

7. Assess software suppliers

For each booking, beauty salon CRM, messaging, payment, analytics and AI provider, establish:

• whether it acts as controller, processor or in another role;
• the written terms and processing instructions;
• subprocessors and data locations;
• security and access controls;
• incident notification;
• export, deletion and contract-end return;
• support for individual rights;
• what customer data is used to improve or train models.

AI does not replace the existing data-protection principles. The ICO’s AI and data protection guidance emphasises lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security and accountability.

Run one contract-end test before purchase: export a realistic client record, identify every subprocessor that retains a copy and obtain a clear answer for deletion from live systems and backups. Supplier claims should become recorded evidence, configuration or contract language.

Create an incident card for staff: stop further exposure, preserve facts, tell the named owner, assess people and data affected, document the decision and communicate where required. Do not wait for perfect certainty before escalating an accidental email, stolen device, shared password or exposed consultation form.

8. Set retention by purpose

UK GDPR does not provide one universal retention period for every salon record. The ICO’s storage limitation guidance says data should not identify people for longer than necessary for the purpose.

Create a schedule by record category. Consider the service, contracts, complaints, tax, insurance, professional requirements and limitation periods with qualified advice. Then configure deletion or review rather than keeping everything indefinitely.

9. Prepare for rights requests

Staff must recognise a request even when it arrives casually by email, social media or in person. Subject access and erasure are not the same, and erasure is not absolute. The ICO says subject access requests normally require a response without undue delay and within one month, subject to the applicable rules and possible extensions. See its subject access guide and right to erasure guidance.

Create an identity-verification, search, review, redaction and secure-response process before the first request arrives.

Test the search across booking, CRM, email, messages, forms, media libraries, exports and backups. The updated right-of-access framework refers to reasonable and proportionate searches; it is not permission to search only the easiest system.

10. Add a data-protection complaints process

The ICO’s data-protection complaints guidance says organisations must give people a way to complain, acknowledge receipt within 30 days, take appropriate steps and keep the person informed without undue delay, then communicate the outcome without undue delay.

Make the route easy to find and use. A complaint may arrive through reception, email or social media even if a form exists. Staff need to recognise it, record the received date, preserve relevant evidence, assign an investigator, manage conflicts and explain the outcome and ICO route.

Keep complaints distinct from service recovery while coordinating them. A complaint about a late appointment may be operational; a complaint that the salon disclosed consultation information is a data-protection matter and may also require incident assessment.

11. Make accountability routine

Assign an owner, train staff, review access, test restoration and incident handling, and revisit the data map when a new tool or campaign is introduced. The goal is not a folder of policies. It is a salon operation where the privacy explanation, system configuration and staff behaviour tell the same story.

Use a rolling schedule:

• monthly: leavers, administrator access, suppression failures and unresolved requests or complaints;
• quarterly: retention actions, supplier changes, cookie scan, restoration test and staff spot-check;
• before every launch: new purpose, data, supplier, automated decision, image use or marketing channel;
• annually: full data map, notices, records of processing, contracts, incident exercise and training.

The strongest evidence of accountability is not a long policy. It is a traceable decision: what the salon considered, what it configured, who owns it and when it will be reviewed.