Client files and GDPR: what you may do, what you must do, and what you needn't fear

Your planner holds 300 names, phone numbers and notes like "Ivana — allergic to ammonia, colour 7.1". Then someone mentions GDPR over coffee, along with fines of up to €20 million, and suddenly you feel like you're running an illegal archive. You're not. A client file is a normal and necessary part of the job — it just needs to be kept with a little order. This guide walks through all of it without legal jargon, but one thing straight away: this is not legal advice — for specific dilemmas, check with your lawyer.

What actually counts as "personal data" in your client file

Personal data is anything by which a specific person can be identified. In a salon or a practice, that means:

• first name and surname, phone number, e-mail address
• appointment and service history ("balayage 12 March, haircut 28 April")
• your notes ("prefers cooler water", "runs 10 minutes late", "shade 6.35 last time")
• before/after photos
• no-show and cancellation records
• allergies and health notes

The first thing to take off the table: GDPR doesn't say "you're not allowed to have this". It says "have a reason for having it, look after it properly and delete it when it's no longer needed". That's the whole philosophy. Everything else is detail.

Are you allowed to record it? Consent and legitimate interest, in plain language

For a basic client file you don't need any special paperwork. A client booked an appointment — for that appointment to exist at all, you need her name and contact details. To know next time what was done and with which shade, you need the service history. Lawyers call this "performance of a contract" and "legitimate interest". Translated: data you genuinely need to do the job the client themselves asked for — you may keep it without anyone signing anything.

Consent (an explicit "yes" from the client) is needed for things that are NOT necessary for the service itself:

• sending promotional messages and newsletters
• posting a photo of a haircut on Instagram or your website
• anything that would make the client wonder: "how did they get that?"

How to sort it in practice, in 30 seconds: at the first visit, one sentence — "Mind if I e-mail you the occasional offer?" — and a tick with a date in their file. No solicitors, no three-page forms. All that matters is that the answer is written down somewhere and that the client can withdraw consent whenever they like.

Allergies and health notes — raise the bar here

Under GDPR, health data is a "special category" — more sensitive than names and phone numbers. An allergy to hair colour, a sensitive scalp, pregnancy, a shoulder injury before a massage: all of these are health data.

Does that mean you're not allowed to write them down? Quite the opposite — you often MUST know them so you don't harm the client. But three rules apply:

1. The client tells you themselves, and you ask whether you may write it down. "I'll note down that you're allergic to ammonia so we don't have to go over it again next time — all right?" That's explicit consent, spoken and recorded.
2. Record only what you need for the service. "Allergic to PPD" — yes. Diagnoses, treatments and other people's medical stories — no.
3. Write only what you could calmly show the client. The client has the right to see everything you keep about them. A note saying "hard work, always haggling" may one day end up right under that same client's nose. Professional notes, always.

That conversation doesn't have to wait for the chair. In Appointa you can attach a pre-appointment questionnaire to a service, so the client enters her colour allergy or massage contraindications herself while booking — the answers stay recorded in her file. Rule one thus arrives in black and white: the client gave the information herself, in writing, and the trail sits with her file instead of being retold from memory.

Planner, Excel or an app — where the data is safest

Here's where most owners get a surprise: GDPR doesn't care whether your client file lives on paper or on a computer. The rules are the same. The difference is how easily you protect, find and delete the data.

The planner on the front desk. The upside: it's not on the internet, nobody's going to hack it. The downsides: anyone who opens it sees everything — a colleague, the delivery driver, the client who's waiting. If it gets lost, soaked or burnt, there's no copy. And when a client requests erasure, you're leafing through 200 pages hunting for every entry.

Excel on a laptop. Tidier, but ask yourself three questions. Does the laptop have a password? Is there a copy if the disk dies? And most importantly — how many versions of that spreadsheet are floating around? Every time you e-mail the client file or copy it onto a USB stick, you lose control of it. Those are the most common real-world breaches, not hackers.

A booking app. Here the data is held by a system built for the job: passwords, backups, access limited to your team. But not all apps are equal — before choosing one, ask three things: where the servers are (the EU is simpler ground for GDPR), whether you can export your data out, and whether you can permanently delete a client. For comparison, Appointa keeps data on servers in the EU, you import clients from your existing Excel or CSV file, and data export to CSV takes a couple of clicks — while clients can request deletion themselves through the app. That's precisely what inspectors and clients ask about most often.

None of the options is "banned". But let's be honest: the planner and Excel demand far more discipline from you to stay in order.

The right to erasure — what happens when a client says "delete me"

A client has the right to ask to see their data, to have it corrected, to receive a copy — and to have it erased. A scene from real life: a client has moved away to Zagreb and sends a message saying "please delete my data". Now what?

1. Check it's really her. A reply to the number or e-mail you already have on file is enough — you don't need a copy of her ID card.
2. Delete everything, everywhere. The client file, but also her number in your phone, old messages, photos with her face in them. This is where one tidy system beats five scattered places.
3. Reply within a month. A short "deleted" confirmation is all it takes.

If you keep your client file in a system, the whole process is a click or two — in Appointa you export a client's data to CSV when they ask for a copy, and they can request deletion themselves through the app.

Two important exceptions. First: you don't delete issued invoices — you keep those for as long as accounting regulations require, and deleting the client file doesn't affect that (not tax advice — check with your accountant). Second: if the client has an outstanding debt or a dispute with you, you may keep the data connected to it until it's resolved.

And yes: the right to erasure is no reason to panic. In a small salon, a request like this arrives perhaps once a year. All that matters is knowing where everything is, so deletion is a five-minute job, not a five-hour one.

Data hygiene: six habits that keep you calm

This is the part that genuinely protects you — from inspections and from awkward situations alike:

1. Record the minimum. Anything you don't write down, you never have to protect or delete.
2. Clean out the client file once a year. Clients who haven't been in for three years probably aren't coming back — delete them, or at least anonymise them. January is a good slot for it.
3. Limit access. A new trainee doesn't need to see every client's full history on day one. Whoever doesn't need the data for their job doesn't need access to it either.
4. Don't send the client file over WhatsApp or e-mail. Every copy you send is a copy you no longer control.
5. Lock things up. The planner in a drawer, a password on the laptop, a PIN on the phone — and on the tool that holds your client file, switch on two-factor login too (in Appointa: settings, the Security tab), so a stolen password alone is no longer enough to get in. It sounds banal; most real leaks are a stolen bag and an unlocked screen, not hackers out of the films.
6. Have a backup. A fire, a dead disk, a lost planner — ten years of client history gone in a single afternoon. If you use an app, backups are its job; every now and then, run your own CSV export too, purely for peace of mind.

If you run a planner today and decide to switch to a system, you don't have to copy anything out by hand: in Appointa you import clients from an Excel or CSV file in one go, with their no-show history and notes in one place.

You don't need fear — you just need order

Let's recap in numbers. One spoken sentence sorts out marketing consent. Three rules cover allergies and health notes. You have one month to answer an erasure request. One annual clean-out keeps the client file tidy. That's the whole of GDPR for a small service business — not a legal labyrinth, but the kind of hygiene a good salon wants anyway, because the same orderliness that calms an inspector also speeds up your every working day.

And once more, because it matters: this is a practical guide, not legal advice. For specific situations — especially around invoice retention periods and disputed cases — check with your lawyer or accountant.

---

Want a client file that's tidy and GDPR-ready from day one — with data on EU servers, import from Excel and export to CSV? Try the demo for your industry — free, no card required. And the Starter plan is free — up to 30 appointments a month.

---

Frequently asked questions

Do I need signed consent from every client in my file?

No. For data necessary for the service itself — name, contact details, appointment history — you don't need consent, because without it you can't do the job the client themselves asked for. Consent is needed for marketing (newsletters, promotional messages), publishing photos, and health notes such as allergies. And even there, a recorded "yes" with a date is enough — not a form with a signature.

Am I allowed to keep data on clients who no longer come in?

For a while, yes — it's reasonable to keep a client file while there's a realistic chance the client will return. But "forever, just in case" isn't a reason GDPR recognises. The practical rule: clients who haven't shown up in two to three years get deleted or anonymised during your annual clean-out. Invoices are the exception — you keep those in line with accounting regulations.

What if my laptop gets stolen or I lose the planner with client data in it?

First assess the risk: was the device locked with a password, how much data is on it and how sensitive is it. If there's a serious risk to clients (say, an unlocked laptop holding the entire client file and health notes), a breach like that must be reported to AZOP (the Croatian data protection authority) within 72 hours — and where the risk is high, you notify the clients too. That's why a password on the device, and data in a protected system rather than scattered across spreadsheets, is the cheapest insurance you have.