Waterford is home to a thriving business community, and beauty salons in the Waterford City area and beyond are no exception. But many don’t realise the extent of their GDPR obligations — particularly around recording detailed medical histories and skin conditions on consultation forms without treating them as special category data. This guide breaks down exactly what’s required under Irish and EU data protection law.
Join 2,000+ Irish businesses already protected
Absolutely. Under the GDPR and the Irish Data Protection Act 2018, all beauty salons in Waterford that collect, store, or process personal data must be fully compliant. This covers everything from booking details and payment information to CCTV footage and staff records. The DPC can impose fines of up to €20 million for non-compliance, and Irish businesses of all sizes are subject to enforcement.
RISK ASSESSMENT
Recording detailed medical histories and skin conditions on consultation forms without treating them as special category data
Storing before-and-after treatment photos on staff personal phones without security or consent
Sharing client treatment details between therapists via informal channels like WhatsApp
Using loyalty programme data for marketing without separate consent
Failing to secure paper consultation forms left in treatment rooms or at reception
DATA INVENTORY
FREE ASSESSMENT
See exactly where your Beauty Salon in Waterford stands on GDPR compliance — no signup required.
REQUIRED DOCUMENTS
Every Beauty Salon in Ireland needs these documents to demonstrate GDPR compliance.
STEP BY STEP
Update all consultation forms to include a clear GDPR consent statement explaining that medical and health information is being collected and why, and obtain the client's signature.
Store consultation forms containing health data in a locked cabinet or secure digital system — never leave them in open treatment rooms.
Get separate written consent for before-and-after photos, specifying where they will be used (social media, website, training), and allow withdrawal at any time.
Ensure that no client health or treatment data is shared via personal messaging apps — use secure salon management software for internal communication.
Review loyalty programme data: ensure clients consented to marketing use, and delete accounts for clients who have not engaged within a defined period.
Train all therapists and reception staff on handling sensitive client data, including the obligation to keep medical details confidential.
Set a retention schedule: keep active client consultation records for the duration of the relationship, archive inactive records and delete after a reasonable period, keep financial records for six years.
COMMON PITFALLS
Treating consultation forms containing medical histories and medication lists as ordinary paperwork when they actually contain special category data requiring explicit consent.
Therapists taking before-and-after photos on personal phones and posting them on their own social media accounts without the client's or salon's knowledge.
Leaving completed consultation forms on the reception desk or in an unlocked treatment room where other clients can see them.
Using loyalty programme sign-up as blanket consent for all marketing, when GDPR requires specific, informed consent for each processing purpose.
FAQ
Everything you need to know about GDPR compliance for your business.
Contact usNEARBY COUNTIES
OTHER SERVICES
Every day your Beauty Salon in Waterford operates without proper GDPR compliance is a risk. The DPC is increasing enforcement across Ireland — get ahead of it today.
Join 2,000+ Irish businesses. No credit card required.