Data protection for
hairdressers and beauty centres

In general, hairdressers and beauty centres that manage customer data (name, telephone number, treatment history, allergies) process personal data and are subject to the obligations of the GDPR. The precise scope depends on the type of data and the purpose of the processing; it is advisable to analyse each business individually.

Yes. Data relating to allergies, product intolerances, skin reactions or skin conditions recorded on a customer's file are health data under art. 4.15 of the GDPR. Their processing requires the explicit consent of the customer or the need to protect their vital interests. The centre must document this legal basis and apply enhanced security measures.

Only with the customer's explicit consent for that specific purpose. Consent to publish photos on social media or on the salon's website must be free, informed, specific and unambiguous. It cannot be inferred from the service contract. The customer must be able to withdraw consent at any time, and the photos must be deleted if they do so.

Yes. Online appointment booking platforms (Booksy, Fresha, SimplyBook, etc.) collect customers' personal data on behalf of the salon. As a general rule, the salon acts as the data controller and the platform provider may act as a processor. The exact legal relationship depends on each provider's terms; it is advisable to review them and, where the provider acts as a processor, to formalise the DPA and inform the customer that their data are managed through that platform.

No. The customer's file must be retained for as long as necessary for the provision of the service and to address possible claims (generally 3–5 years). Health data (allergies, colour technical sheets) must be retained for as long as necessary for the customer's safety, but no longer. Once the retention periods expire, data must be deleted or anonymised.

Yes, with a valid legal basis. To existing customers who have already used the service, advertising for similar services may be sent without prior consent (prior customer exception, art. 21.2 LSSI), provided that the option to unsubscribe is offered. However, the use of WhatsApp involves a transfer of data to Meta in the USA that must be disclosed in the privacy policy.