Consent forms and GDPR,
in plain English.

What does UK GDPR mean for a salon’s consultation forms?

The health questions on a consultation form collect special category data, which UK GDPR protects more strictly. You need a lawful basis and a separate condition for using it, and for a beauty salon that condition is usually the client’s explicit consent, given with its own clear tick. Tell clients why you ask and how long you keep their answers, keep forms where only the right people can see them, decide how long to keep them, and know what you’ll do if a client asks for a copy or asks you to delete them.

This is general information, not legal advice. The ICO says its guidance is under review after the Data (Use and Access) Act, so check the ICO’s own pages, your insurer or an adviser before you rely on it. We make Covered Beauty, and we’ve said what it does at each step.

Are consultation form answers special category data?

Yes, where they’re about health. The ICO’s guidance, What is special category data?, says data concerning health is personal data about someone’s physical or mental health. It includes any information on injury, disease, disability or disease risk, including medical history, as well as examination data and test results.

Answers about allergies, medication, pregnancy, skin conditions or a reaction to a patch test all say something about a client’s health, so treat the whole form as health data.

What do you need before you collect it?

The ICO says you must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9 (What are the rules on special category data?).

For a beauty salon, the Article 9 condition that usually fits is explicit consent. The ICO’s page on the conditions for processing says explicit consent must be:

• confirmed in a clear statement, spoken or written
• specific about the type of data, here the client’s health
• separate from any other consent you ask for
• freely given, opted in to and possible to withdraw at any time

It also says to take particular care when consent is a condition of your service, as a consultation form usually is: you can only treat safely with the answers. Explain that to clients rather than leaving it to the small print.

There’s a separate condition for health or social care, but the ICO says it’s for health professionals and others who owe a legal duty of confidentiality. If your clinic is led by a nurse, doctor or other health professional, ask your adviser which condition applies to you.

In Covered Beauty

Every form shows the client a note about their health information: that it’s special category data, collected only with their explicit consent and used only so you can treat them safely. They can’t send the form without ticking a separate box giving their explicit consent under UK GDPR Article 9(2)(a), and we record when they ticked it.

What should you tell clients?

The ICO’s page on the right to be informed says that when you collect someone’s data you must tell them, among other things, why you’re using it, how long you’ll keep it and who it’s shared with. Its checklist also includes who you are and how to contact you, your lawful basis, their rights, including the right to withdraw consent, and their right to complain to the ICO.

The ICO says you can put this information on your website, and give short notices with more detail a layer down. On a consultation form, that means saying:

• why you ask: so you can treat them safely
• who sees the answers
• how long you keep them
• that you won’t use them for marketing
• where to read the rest of your privacy information, such as a privacy page on your website

Ask for anything else, such as photos for your social media or marketing emails, with its own tick that starts unticked, so saying no to one doesn’t mean saying no to the treatment.

Do you need to pay the ICO?

The ICO says organisations, including sole traders, that use personal information must pay a data protection fee unless they’re exempt. Its self-assessment takes about 10 minutes and tells you whether you need to pay and how much.

How long should you keep consultation forms?

UK GDPR doesn’t set a fixed period. The ICO’s guidance on storage limitation says it’s up to you: set and write down how long you keep each kind of record, review it, and consider whether you need to keep information to defend possible future legal claims.

BABTAC’s 2016 Good Practice Guide tells its members to keep record cards for seven years, and says a claim will be denied without them. Your insurer’s policy comes first, so check what it asks for.

Covered Beauty keeps signed forms for 7 years from the appointment, or from the day it was signed for a form filled in without a booking, as our privacy notice says, while your account is open. If you ever leave, our terms give you 30 days after your account ends to export your data, so keep your own copy of your forms for as long as your insurer asks.

Paper or digital: which is safer?

Either can be done well or badly. Ask of any system, including a filing cabinet:

• Who can see the answers, and can you limit it to the people who need them?
• Where are they stored, and how are they protected?
• Can you get them out, as a copy for the client or an export for you?
• Does it keep the exact questions the client answered, as well as their answers?

In Covered Beauty, only team members you give the Forms permission can see the answers, in the dashboard or in a backup they download. You can add two-factor sign-in as well. Databases and file storage are in the UK, in London, and health data is encrypted at rest and in transit. Each signed form keeps the version of the questions the client saw, and you can export your data at any time.

What about WhatsApp?

Try not to collect health answers in WhatsApp messages or screenshots. They sit in your phone’s chats and photos, mixed in with everything else, where they’re hard to keep track of or delete when you need to. Send a private link instead, so the chat only holds the link. In Covered Beauty a form link works for 14 days, only for that client.

Is a typed signature valid?

In England and Wales, the Law Commission’s 2019 report says an electronic signature is capable in law of being used to sign a document, as long as the person signing means to authenticate it. Its examples include a name typed at the bottom of an email. If you work in Scotland or Northern Ireland, check with your insurer or an adviser.

Covered Beauty records the name the client types, the date, the version of the form and when they gave their explicit consent. There’s no second signature from the therapist, which BABTAC suggests for record cards, so note who carried out the consultation in the client’s notes.

What if a client asks for a copy, or to delete it?

A copy. In Covered Beauty, download the signed form as a PDF, or use Export all data on their profile.

Deleting it. The ICO’s guidance on the right to erasure says the right isn’t absolute. It doesn’t apply where you need the data to establish, exercise or defend legal claims, and the ICO’s own example is a healthcare provider whose liability insurance requires it to keep records. You must reply within one month.

Decide before you act. In Covered Beauty, Erase client data clears their form answers straight away and anonymises their name, email, phone and notes, while appointment and payment records are kept without their personal details. It can’t be undone.

A quick checklist

• Ask only what you need to treat the client safely.
• Tell clients why you ask, who sees the answers and how long you keep them.
• Put the rest of your privacy information, such as who you are, their rights and how to complain to the ICO, where clients can read it, and tell them where that is.
• Get explicit consent with its own tick, never ticked for them.
• Keep photos and marketing as separate, optional ticks.
• Check whether you need to pay the ICO’s data protection fee.
• Write down how long you keep forms, and why, starting with what your insurer asks.
• Keep forms where only the right people can see them.
• Know what you’ll do when a client asks for a copy or asks you to delete them, and reply within a month.

Want it done for you on every form? See how online consultation forms work, or read what to put in a lash consultation form.

Sources

Each page was read on 21 October 2026.

• ICO: What is special category data?
• ICO: What are the rules on special category data?
• ICO: What are the conditions for processing?
• ICO: Right to be informed
• ICO: Data protection fee
• ICO: Data protection fee self assessment
• ICO: Storage limitation
• ICO: Right to erasure
• Law Commission: Electronic execution of documents
• BABTAC Good Practice Guide 2016 (PDF)