Privacy basics for salon bookings and appointment reminders

A salon may know more about a customer than its owner realises. Alongside appointment times and phone numbers, staff may record preferences, allergies, photographs, payment notes and personal comments. A simple booking process can gradually become a detailed profile that many people can open.

Begin with the service interaction. Decide what the booking needs, what a practitioner needs to deliver the service and what belongs in a separate promotional relationship. Those decisions can improve both privacy and the customer’s experience.

Make the booking fields earn their place

For each field, ask what staff would be unable to do without it. A name, a time slot and a suitable contact route may be enough for an ordinary appointment. A full residential address or date of birth may not be needed. If you want a birthday offer, assess and explain that additional purpose rather than presenting the field as essential to every booking.

As of 22 October 2026, the substantive DPDP provisions discussed here are scheduled for 13 May 2027 under the commencement notification. The future sections 4 to 7 will require an appropriate route for each lawful purpose. For consent-based collection, prepare the relevant notice and choice, including the requirements developed in rule 3. These steps are readiness work, not a claim that every later duty is already operative.

Keep reminders discreet

An appointment reminder should contain what the customer needs to attend or change the booking. Consider whether the phone is shared and whether a detailed service description could appear where another person sees it. Ask for the customer’s suitable contact route and avoid assuming that a number used once remains appropriate forever.

Separate attendance messages from unrelated promotions. A customer who supplies a number to confirm a haircut has not thereby explained their wishes about every offer the salon may later send. Ensure the selected purpose controls the sender’s audience, including any outside booking or messaging provider.

Before adopting a platform, test the configuration with synthetic records. Check who can see service notes, what appears in reminders and what enters a marketing export. Product defaults may not match the explanation staff give at reception.

A hypothetical appointment workflow

A salon introduces a shared booking calendar. Reception staff need to see availability, customer names and a contact route. Practitioners need relevant service instructions, but those notes do not need to appear in every calendar notification.

The owner creates a narrower reception view and a separate restricted location for necessary service notes. A test reminder confirms the time and provides a way to change the appointment without broadcasting a detailed note. Promotional preferences are kept separate, and a customer who declines offers can still book normally.

When a customer changes their phone number, the receptionist updates the active booking and checks the connected reminder system. The old number is not left as an unexplained duplicate. This practical check prepares for the future section 8(3) accuracy obligation where data is likely to inform a decision affecting the person or be disclosed to another fiduciary.

Be careful with service notes and photographs

Staff should record only information relevant to the service, in respectful language. Personal speculation and unrelated conversation do not become useful records merely because a notes field exists. Information about health or a particular treatment may raise additional obligations under applicable law; assess those separately instead of assuming that the DPDP label answers everything.

A photograph taken to guide a service has a different purpose from a photograph published in an advertisement. Keep the proposed use explicit and assess the required permission before publication. Check for other people and personal details in the background.

Include staff changes and provider access

When someone leaves the salon, remove access to booking accounts and review business records held through their working arrangements. Avoid a shared password that remains known to every former employee. Give outside providers only the access their role needs, with a clear contact if a problem occurs.

Under the future section 8(1) and rule 6 framework, accountability and safeguards will matter even where a supplier runs the software. As practical preparation, identify who owns the calendar, the customer list and each connected service.

The recurring failure is trying to solve privacy with a notice while leaving the calendar open to everyone. Review the fields, the views, the messages and the staff handover together. A customer should be able to understand what the salon needs and see that the information is used with that same care.