How long should a salon keep client record cards?

UK law sets no fixed time. The NHBF's example record card says six years, which matches the time limit for most claims, and your insurer may have its own rule.

What should be on a client record card?

Contact details, health and allergy answers, each patch test with its date and result, and what was done each visit with the products, amounts and timings, signed and dated.

Are client record cards covered by GDPR?

Yes, on paper or digital. Health answers such as allergies are special category data, so keep them secure and only for as long as you need them.

Can a client ask to see their record card?

Yes. They can ask for a copy of everything you hold on them, and you have one calendar month to send it, usually free.

Is a digital record card better than paper?

Both are allowed. Digital records can't be lost or misfiled and can be read on your phone, while paper needs a locked drawer and a shredder.

Guide18 October 20267 minute read

Client record cards: paper or digital, and what to keep

A record card tells you what you did last time, from the colour formula to the date of the last patch test. It's also the first thing your insurer asks for if a client complains. Here's what to write on one, where to keep it and how long for.

Matt Suckling

Director, FullDiary

Every good stylist and therapist keeps notes. The question is whether they're in a shoebox under the desk, spread across the notes app on your phone, or somewhere you can find them in five seconds with the client already in the chair.

What a record card is for

Getting it right again. The formula, the timings and the products, so the next colour matches the last one.
Keeping it safe. Allergies, skin conditions, medication and the date of the last patch test, checked before you start.
Showing what happened. If a client says a treatment hurt them, a signed and dated record of what you asked and what you did is your best evidence. Insurers ask for it.

What to write on it

Name, phone number and email, plus date of birth if you offer treatments with an age limit
Health and allergy answers from your consultation form, signed and dated
Each allergy alert or patch test, with the date, the product, the result and whether the service went ahead
Each visit, with the date, who did it, the service, the products and how much of each, and the timings
Any reaction or anything that went wrong, and the advice you gave
Notes for next time
The client's signature on the consultation, and yours

Colour formulas and photos

Write a formula so that someone else could mix it. That means the brand and shades, the developer strength, the mixing ratio, where it went and how long it was left. "Usual colour" is no help to the stylist covering your day off.

Before and after photos are worth taking, with the client's agreement. If someone can be recognised from a photo, it's usually their personal data, the same as their name. A photo that shows a skin or scalp condition says something about their health, so look after it as carefully as their health answers.

Paper or digital

Paper cards cost nothing and work without a signal. They also get lost, stained and misfiled, can only be read at the desk, and need a locked drawer and a shredder.
Digital records can be read on your phone, can't be misfiled and can tell you when a patch test is due again. They need a login for each person, a strong password and a backup.

Either is fine under UK GDPR as long as it's secure, and the ICO's guide to data security covers locks and shredding as well as passwords and backups. Keeping records on a phone or computer usually means paying the ICO's data protection fee. For most small businesses that's 52 GBP a year, or 47 GBP by direct debit.

How long to keep records

UK GDPR doesn't give a number. You decide how long you need each kind of record, write it down if you can, and delete records once that time is up. Keeping everything forever just in case isn't allowed.

For hair and beauty, the NHBF's example record card says keep record cards for six years, and its allergy alert guidance says keep each signed test record for at least six years. Six years is also the time limit for a claim over a contract. An injury claim usually has three years from when the person knew about it, and for a client who was under 18 that three years usually starts on their 18th birthday.

Keep a client's records for six years after their last visit, unless your insurer says longer.
For a client who was under 18, keep them until at least their 21st birthday if that's later.
Keep anything to do with a complaint or claim until it's settled, even past six years.
Once a year, delete the records that are past their time.
Shred paper, and delete digital records properly, backups included.

A client can ask for a copy of everything you hold on them at any time. You have one calendar month to send it, and in most cases you can't charge for it.

Moving old cards over

Start with your regulars, the clients you'll see in the next few months.
Copy over what you need to work safely, such as allergies, the last patch test date and result, and the current formula.
Keep a signed paper original for as long as you keep records, or scan it and keep the scan with the record.
Shred the paper once it's no longer needed.

Client records in FullDiary

Visit records. After each visit, write up what you did from the booking. A hair salon starts with the colour formula, processing time, products used, notes for next time and photos. A beauty salon starts with the treatment, whether a patch test was done, skin notes and products. Change the fields to suit you.
Next time, a new record starts from the last one's formula and products, so you only type what changed.
Up to four photos a visit, kept with the record. The client sees them on their own page unless you untick Customer can see it on the Photos field.
Consultation and patch test forms are asked when clients book, signed with a typed name and dated. The patch test form asks on the first visit and again after 180 days.
Private notes, dated on the client's profile and never shown to them.
Who sees what. Each login on your team can be allowed to see records and notes, or kept away from them.
Kept in the EU, locked to your business and never used to train AI.
Your list comes with you from a spreadsheet or another booking system, and deleting a client removes their notes, forms and visit records.

Client records, visit records and forms are on every plan, free included.

Client records: forms, notes and what you did last time

Sources

No fixed retention period, and keeping data only as long as you need it.

ICO: storage limitation

Health data, and what you infer about someone's health, is special category data.

ICO: what is special category data?

A photo of someone who can be recognised is usually their personal data.

ICO: taking photographs, data protection advice

A client's right to a copy of their data, and the one month to reply.

ICO: subject access request advice

The data protection fee, and its exemptions.

ICO: guide to the data protection fee

Keeping paper and digital records secure.

ICO: a guide to data security

The NHBF's example record card, which says keep record cards for six years.

NHBF: example consultation, allergy alert and industry tests record

Keeping a signed record of every allergy alert test for at least six years.

NHBF: set up an allergy alert testing system

Six years for a claim over a contract.

Limitation Act 1980, section 5

Three years for an injury claim, from when the person knew.

Limitation Act 1980, section 11

For a child, the time starts when they turn 18.

Limitation Act 1980, section 28

This guide is general information, not legal advice.

Questions people ask

How long should a salon keep client record cards?: UK law sets no fixed time. The NHBF's example record card says six years, which matches the time limit for most claims, and your insurer may have its own rule.
What should be on a client record card?: Contact details, health and allergy answers, each patch test with its date and result, and what was done each visit with the products, amounts and timings, signed and dated.
Are client record cards covered by GDPR?: Yes, on paper or digital. Health answers such as allergies are special category data, so keep them secure and only for as long as you need them.
Can a client ask to see their record card?: Yes. They can ask for a copy of everything you hold on them, and you have one calendar month to send it, usually free.
Is a digital record card better than paper?: Both are allowed. Digital records can't be lost or misfiled and can be read on your phone, while paper needs a locked drawer and a shredder.