Do I need to register as a data controller?

In the EU and Georgia you mainly need internal documentation and GDPR principles compliance. In most CIS countries, notifying the regulator is mandatory when processing client data. Confirm with a lawyer in your country.

Can I store before-and-after photos?

Yes, but only with written client consent and the ability to delete the photo on first request. Publishing on social media is a separate consent — without it, this is a direct violation.

What if a receptionist leaves with the client base?

Immediately change passwords, revoke access, document the fact, and assess the risk. If the data may have leaked, several jurisdictions require notifying the regulator and the clients themselves.

How can a client delete their data?

On a client’s request, you must delete or anonymize their data within a reasonable time. In a CRM this should be a few clicks, not a search through backup archives.

Salon Client Data: GDPR Compliance Without Fines

What Counts as Client Data in a Salon

Name, phone, visit history, before-and-after photos, and notes on client preferences are all personal data. Even a loyalty card number without a name falls under the definition.

In the EU and Georgia, GDPR-style rules apply with fines of up to 4% of annual turnover. Real investigations most often start with a client complaint.

Four Mistakes That Get Fined

The first is keeping the client base in Excel or the receptionist’s phone notes. A lost file or a former employee walking away with the base is an incident that the law requires you to report.

The second is missing consent: the client booked an appointment and the phone number quietly ends up in a marketing list. The third is access for everyone: cleaners and interns should not see client phone numbers. The fourth is indefinite retention: data of long-gone clients sits in the base for years.

How to Collect Consent Properly

Consent must be voluntary, specific, and confirmed: a checkbox on the intake form, a button in the booking form, or a reply in a messenger. The wording is simple — what the client agrees to: bookings, visit reminders, promotions.

Separate the consents: an appointment reminder is part of fulfilling the service, while a marketing newsletter is a separate consent that can be withdrawn in one click. The client needs a clear way to opt out.

Where to Store Data Safely

A cloud CRM with encryption, backups, and role-based access is safer than a spreadsheet on the receptionist’s computer. In the cloud, data is not lost with a laptop, and access is revoked with one click when someone leaves.

Check three things with your vendor: where the servers physically are, how often backups are made, and whether you, as the salon owner, can delete a client’s data on request.

A One-Evening Compliance Checklist

Verify: you have active consents for every client in the base; each employee sees only what they need for work; access is personal, not a shared login; data is deleted on client request; you have a backup of the base.

Slotly stores salon data in an encrypted cloud with automatic backups, and notification consents are recorded in the client card — this covers most of the checklist without extra paperwork.

GDPR for Beauty Salons: Handling Client Data Legally

What Counts as Client Data in a Salon

Four Mistakes That Get Fined

How to Collect Consent Properly

Where to Store Data Safely

A One-Evening Compliance Checklist

Часто задаваемые вопросы