Hairdresser Client Card and GDPR

A hairdresser's client card is usually a simple notebook: preferred length, clipper number, dye colour, a phone number for booking. The problem starts when the card gets a line such as "allergic to dyes" or "psoriasis on the scalp". At that point an ordinary notebook becomes a set of health data. This article shows what to put on a client card in a hair salon, what to avoid, and what to do so that the card is a document and not a risk. We cover consents and monitoring separately, in the text on GDPR in a barbershop (RODO in Polish). Here we focus on the card itself.

Key takeaways

• The GDPR does not tell you to keep a client card. We did not find a provision that would require one. If you keep one, you are responsible for the data it contains.
• Record only what the service needs. The data minimisation principle (Article 5(1)(c)) rules out a "just in case" ID number (PESEL), address or date of birth.
• Allergies and skin conditions are health data. This is a special category whose processing is in principle prohibited unless you meet a condition from Article 9(2). The simplest route is explicit consent.
• The client must know what you do with the card. You provide the information under Article 13 when you collect the data.
• You set the retention period and justify it by the purpose. The GDPR does not give a number of years.

Why a client card in a salon

The card has three jobs. It shortens the conversation ("same as last time"), it helps avoid mistakes (wrong colour, wrong dye), and it shows that you know what you did for a given client. That last point matters when a client makes a complaint or a report, which we write about in the texts on allergy to beard dyes and on a client complaint to Sanepid.

Each of these jobs is a separate purpose of processing. The purpose determines what you may record, because data must be collected for specified, explicit and legitimate purposes (Article 5(1)(b)).

What data you may record on a hairdresser's client card

Turn the question "may I" into "what for". Data must be adequate, relevant and limited to what is necessary (Article 5(1)(c)). For a typical hairdressing service this means a short list:

Data	What for	Note
First name (and possibly surname)	Recognising the client	A first name is enough if that is enough for you
Phone	Booking and reminding about a visit	The basis is often the contract (Article 6(1)(b))
Service history and preferences	Repeating the service, protecting against mistakes	A description of the treatment, not of the client's life
Dye colour and composition	Safety, repeating the colour	This is data about the service, not about health
Address	Only for visits at the client's home	Not needed in the salon
E-mail	Optional contact	Marketing requires a separate basis

If you offer on-site services, you collect the address only for those visits. Do not add other fields "just in case". Data should also be accurate and, where necessary, kept up to date (Article 5(1)(d)), so tidy the cards from time to time.

Allergies and health data: when it is a special category

The GDPR defines data concerning health as data related to the physical or mental health of a person which reveal information about their health status (Article 4(15)). The sentence "allergy to PPD" falls within that definition. Health data belongs to the special categories whose processing is prohibited (Article 9(1)), unless one of the conditions in paragraph 2 applies.

In a hair salon the simplest condition is the client's explicit consent to the processing of this data for a specific purpose (Article 9(2)(a)). The other conditions in paragraph 2 concern narrower situations, for example establishing, exercising or defending legal claims (point (f)). We do not settle when any of them would work in your salon. If you plan to rely on something other than consent, consult a lawyer.

What follows in practice:

• Ask about allergies only when you perform a treatment where it matters (colouring, chemical treatments). For an ordinary haircut there is no point in adding an "illnesses" field.
• Record the conclusion on the card, not the diagnosis. "Reaction to dye, no colouring" says more than a full description of the complaint.
• We described the skin conditions for which you refuse a service in the text on skin diseases and refusing a service. A note about a refusal can also be health data, so handle it carefully.

Consent must be presented in a manner clearly distinguishable from other matters, in clear and plain language (Article 7(2)). The client may withdraw it at any time, and withdrawing must be as easy as giving it (Article 7(3)). It is also worth knowing Article 7(4): in assessing whether consent is freely given, account is taken of whether the service is made conditional on consent to data that is not necessary for it.

Consent, information and the basis for processing

Collecting data starts with information. When you collect data from the client, you provide, among other things, your identity and contact details, the purposes and legal basis, the recipients of the data, the retention period or the criteria for setting it, the client's rights (access, rectification, erasure, restriction, objection), the right to withdraw consent and to lodge a complaint with a supervisory authority (Article 13(1) and (2)).

In a salon this is one sheet of paper by the till or a short text in the booking form. The most common bases for ordinary data on the card are:

• Contract (Article 6(1)(b)): data necessary to perform the service, including booking a visit.
• Legitimate interests (Article 6(1)(f)): for example a record of what you did for the client, in case of a complaint. The client may object (Article 21(1)), and for direct marketing the objection is absolute (Article 21(2) and (3)).
• Consent (Article 6(1)(a)): for example for "before and after" photos and marketing messages, separately from the health consent.

Write down which basis you assign to which field in the record of processing activities. An entrepreneur employing fewer than 250 people is exempt from it, but not where the processing is not occasional or includes special categories of data (Article 30(5)). A permanent client card with data on allergies meets those conditions, so in practice you should keep the record. You will find the Polish data protection authority's (UODO) guidance on creating it in the Office's study (in Polish).

Retention, period and deleting data

The GDPR does not say how many years you may keep a card. Data must be kept no longer than is necessary for the purposes of processing (Article 5(1)(e)). So you have to justify the period yourself by the purpose. For a card that serves as a defence in case of a complaint, a reference point is often the limitation periods. The Civil Code provides three years for claims related to running a business, with the end of the period falling on the last day of the calendar year (Article 118). Claims may have other periods, so do not treat this as a ready-made number.

A simple rule: decide, write it in the information for the client, and apply it. For example, you can set separate periods for service history, health data and marketing data. You delete marketing data after consent is withdrawn, and the client may demand erasure of data that is no longer necessary for the purposes for which it was collected (Article 17(1)(a)). Always check whether you are keeping it for another reason, for example an accounting one.

A client card template: the structure without legal wording

Below is the skeleton of a card. Adapt the wording of the clauses and consents to your salon or take it from ready-made documents.

1. Header: the client's first name, phone, date of the first visit.
2. Information: a pointer to the information clause and confirmation that the client received it.
3. Service history: date, type of service, tools or products used, notes on preferences.
4. Safety field (only for chemical treatments): allergy test, result, decision to perform or refuse.
5. Consents: separate fields, not ticked by default, for health data, photos and marketing.
6. Date of deletion or review of the card.

Consent for health, image and marketing are three different consents. Combining them in one signature is the most common mistake, and we also write about it in connection with the salon terms and conditions.

A hairdresser's client card: paper or a booking app

The form does not change the rules, it changes the risks. You keep a paper card in a lockable drawer, not on the counter by the chair. The security of processing must be appropriate to the risk (Article 32(1)). In an app:

• check who the provider is. When the provider processes data on your behalf, you need a contract or another legal instrument meeting Article 28(3), and the controller must use processors providing sufficient guarantees (Article 28(1)),
• protect access with a password and do not share one account between employees,
• do not enter allergies in a free notes field that everyone on the team can see, without need.

In the event of a personal data breach (for example a lost phone with cards), you notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of persons (Article 33(1)). In the Foundation package you will find a client GDPR consent form, the salon's privacy policy and a record of processing activities, which put this area in order.

Frequently asked questions

Does a hairdresser have to keep a client card?

We did not find a provision of the GDPR or the infectious diseases act that would require a client card in a hair salon. It is your organisational decision, but if you keep one, you process personal data and have GDPR obligations.

Can I record on the card that a client has an allergy?

Information about an allergy is data concerning health. Its processing is prohibited unless you meet a condition from Article 9(2), and in a salon the simplest way is to obtain the client's explicit consent. Record only what is needed to perform the treatment safely.

How long should I keep a client card?

The GDPR does not give a number of years. You keep data no longer than is necessary for the purpose (Article 5(1)(e)). Set the period yourself, justify it and put it in the information for the client. The limitation periods for claims under the Civil Code (Article 118) can be one reference point.

Can a client demand deletion of their card?

They can demand erasure of data, among other cases, where it is no longer necessary for the purposes of collection, or where they withdrew consent and there is no other basis (Article 17(1)). Before you delete, check whether you have an obligation or a legitimate reason to keep part of the data.

Is a client card in an app different from a paper one?

The rules are the same. What is added is a contract with the app provider, if it processes data on your behalf (Article 28), and securing access to the system (Article 32).

---

Legal status as of: 2 November 2026
Legal basis: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR; text in the Polish language version, among others Article 4(15), Articles 5, 6, 7, 9, 13, 17, 21, 28, 30(5), 32, 33); Act of 23 April 1964, the Civil Code (consolidated text Journal of Laws 2026, item 795; Article 118). We also used the UODO guidance on the record of processing activities. We did not check: the Act of 10 May 2018 on the protection of personal data, positions or decisions of UODO concerning client cards in salons, the rules on cosmetics safety and treatment documentation, limitation periods other than those in Article 118, or the rules on patients' rights (we do not apply them to hairdressing services). The conclusions on the bases for processing in a salon are our interpretation and require confirmation by a lawyer or a data protection officer. This text is not legal advice.
Last review: 2 November 2026