From the 25th May 2018, the changes to GDPR will apply to all business owners and how these businesses deal with personal information. GDPR stands for General Data Protection Regulation and is very similar to the DPA, otherwise known as the Data Protection Act.
As a salon owner, who currently holds certain amounts of information on their clients, this change could certainly affect you. If you’re already completely compliant with the DPA then the effect will most likely be marginal, but as responsible business owners, it’s important to ensure you’re aware of all the changes and how it might affect the way in which you deal with your client’s personal information.
Auditing yourself
The GDPR will require you to fully document the personal information you hold, where the information has initially come from and also what the business does or plans to do with the information. Auditing your business so that you have all of this information documented and at hand will allow you to much more easily comply with the GDPR requirements.
You can read more on how to keep track of your client consultation records here.
Right of individuals
Although very similar to the Right of Individuals requirements within the DPA, there are some changes with the application of the GDPR. There is a new measure called the right to data portability, which means if a client asks to see the personal information or data you hold on them, you must provide it to them within 30 days in a clear, readable format, free of charge.
Lawful basis
Businesses will now need to document the lawful basis they are using to justify holding onto the personal information of their clients. With lawful basis, people’s personal information or data should not be held or used by businesses, so documenting this for your salon will enable you to more easily comply with the requirements.
With the application of the GDPR, your customers will now have the right to have their information deleted from your records in a number of different circumstances.
Consent
Assuming consent is now no longer an option. With the GDPR in place, all data holding must be opt-in only and personal information for a minor needs to have opt-in permission from a parent or guardian before it can be held or used. If you have already complied with opt-in collection of data for your business in regards to the DPA, you usually won’t have to gain new consent for the GDPR. However, you need to ensure you have recorded consent for all of your held data.
Privacy notices
In terms of the DPA, businesses have to tell people that they are collecting their data and what this will be used for, if anything. To comply with the GDPR, you will now also have to tell customers:
- Why it’s legal to hold personal information for your business
- The length of time you will hold the data
- That they are able to complain if they are not happy to the Information Commissioners Office (ICO)
Data breaches
In the event of a data breach, which may affect your customers, you are now required to inform the customer or customers involved in the breach and also the ICO. A procedure should be in place within every business to detect potential personal information breaches and a plan of steps to deal with the situation, which includes informing those involved.
As business owners, it’s always important to stay up to date with changes in legalities in any way that could affect your business or clients. The change to the GDPR is for the benefit and safety of consumers and will allow your business to ensure that your loyal customers’ information is safeguarded and properly used.
What are your tips for preparing for the changes for GDPR? Share yours with us in the comments on Facebook and Twitter.
Salon Saver also provides insurance for salons.
Other Articles:

Top Insurance Tips for Waxing Studios
Why Aromatherapists Need Insurance for Their Salon
Best Insurance for Cosmetic Clinics
1 comment
Really helpful guys thanks!