GDPR for a small salon: what you actually need

The moment you write down a client's name and phone number, you are handling personal data. That applies to a paper appointment book too. GDPR is not only for large companies, and it does not mean you have to hire a lawyer. It means a handful of specific things.

This article is not legal advice. It is an overview of the questions small studios ask most often. If you are unsure about your own case, the website of your national data protection authority is the place to check. In Czechia that is the Úřad pro ochranu osobních údajů, in Slovakia the Úrad na ochranu osobných údajov.

Consent to a booking is not consent to marketing

When a client books, they give you their contact details so you can arrange the visit. That does not mean you can send them offers.

In practice: add one extra checkbox to your booking form, explicitly about receiving news, and leave it unticked by default. Without that tick, send the client only confirmations, reminders and changes to the appointment.

The right to know what you hold

A client can ask what data you keep about them, and you have to give it to them. In practice an export of the client card is enough: contact details, visit history and notes.

That is why it pays to keep this in a system that can export it. It matters most in beauty and aesthetics, where client cards hold the most data. Copying out someone's history by hand from a paper book takes hours.

The right to erasure, within limits

When a client asks to be deleted, you have to delete their contact details. But you still need the record that a paid visit took place, for your accounts.

The answer is anonymisation: the name, email and phone number are overwritten, and the visit stays in your financial history without being linked to a specific person.

Be careful with notes

A note like "prefers Anna" is harmless. A note about someone's health is sensitive data and falls under stricter rules. So do not write more into free text notes than you actually need, and treat anything you write there as something the client may ask to see.

Where your data lives

Consent to a booking is a different thing from consent to marketing, in the same way that a deposit is a different thing from paying for the service in advance.

If you use a booking system, its provider processes your clients' data as well. You should know where its servers are and have a data processing agreement with it. Servers inside the European Union make that question simpler.