Client Data and India's DPDP Act: What Every Salon Must Do

Every salon holds more personal data than it realises: phone numbers in several places, visit histories, colour formulas, allergy notes, before-and-after photos, birthdays and its staff's fingerprints. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 set out what a business must do with that data. This guide isn't legal advice; for anything unusual, such as CCTV or a dispute with a client, ask a lawyer.

#Does the DPDP Act apply to a salon?

Yes. The Act applies to personal data collected in digital form, and to data collected on paper and digitised later, so a salon that keeps client numbers in a phone, on WhatsApp, in a spreadsheet or in salon software is covered.

Your client is the data principal. Your salon is the data fiduciary, because you decide why and how the data is used. Your software company, or anyone else who handles data for you, is a data processor, which you may use only under a valid contract, and the Rules keep you responsible for security on processing done on your behalf. The exemption for personal or domestic use doesn't cover a business, so a stylist's phone full of salon clients isn't "personal".

A register kept only on paper sits outside the Act, until someone photographs a page to send the accountant on WhatsApp or types a number into the salon phone. Then it's digitised. Treat every photo of a register page as client data.

The Act lets the government exempt some classes of businesses, such as start-ups, from some duties. We found no notified exemption covering salons as of October 2026, so plan as if every duty below applies.

#When do the DPDP rules start applying?

Most duties that matter to a salon apply from May 2027, 18 months after the DPDP Rules were notified on 13 November 2025 (G.S.R. 846(E)). The Rules come into force in three stages.

An October 2026 Removal of Difficulties Order corrected wording in two sections of the Act without adding duties, and a reported plan to shorten the 18-month period hadn't been notified when we checked. Confirm dates on meity.gov.in. Start now anyway: collecting proper marketing consent takes months in a busy salon.

#What client data does your salon hold, and why?

Before you write a notice, list the personal data you hold, where it sits and why. In many salons, client numbers sit in four places: the software, the salon WhatsApp, staff phones and an old register or spreadsheet.

The Act has no separate "sensitive data" category, but allergy, pregnancy and skin notes do real harm if they leak. Keep them to the staff who need them.

#What must your notice to clients say?

Before you ask a client for consent, give her a short notice that makes sense on its own, in clear and plain language. Under Rule 3 it must list the personal data you collect item by item, the specific purpose for each, and how she can withdraw consent, use her rights and complain to the Data Protection Board.

Four rules from the Act shape how you ask:

• Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. No pre-ticked boxes, and no making marketing consent a condition of a haircut.
• Withdrawing must be as easy as agreeing. If she opted in with one reply, opting out can't need a call to the owner.
• She can ask for the notice in English or any Eighth Schedule language, so keep a Hindi or regional version ready.
• You must be able to prove it. If consent is questioned, the burden is on you, so keep the date, the wording and how she agreed.

Existing clients count too: the Act requires a notice to them as soon as reasonably practicable, and lets you keep using their data until they withdraw consent.

#Do you need consent to send WhatsApp bills, reminders and offers?

You can send a client what she asked for, like her bill or a reminder for a booking she made, and you need her separate consent for offers. Meta also requires opt-in before any business messages people on WhatsApp, so marketing needs both permissions.

When a client replies STOP, mark it on her record the same day and remove her from every campaign list. Our WhatsApp marketing guide covers opt-in wording.

#What about clients under 18?

Under the Act, anyone under 18 is a child. Before processing a child's personal data you need verifiable consent from a parent, and you must not track, behaviourally monitor or target advertising at children. The Rules exempt only certain kinds of business from these duties, such as health services, schools and crèches, and salons aren't among them.

Salons see plenty of under-18 clients, from school haircuts to the bridal party's younger cousins. In practice:

• Make the parent the contact for a child's record, and record the parent's consent at the first visit, with the parent present.
• Check the parent is an identifiable adult. Rule 10 expects due diligence, using identity and age details you hold, details the parent provides, or a virtual token from an authorised source such as DigiLocker.
• Never post photos of minors, and when a client turns 18, ask her own consent before any marketing.

The Rules don't spell out how a walk-in salon should verify a parent, so take a lawyer's view. Consent for chemical services is a separate matter, covered in our guide to consultations and patch tests.

#How should you handle staff data, including fingerprints?

Employment is a legitimate use under the Act, so staff data doesn't need consent, but you must tell staff what you hold, keep it secure and stop using it when they leave.

• Tell staff in writing what you collect (ID, bank details, attendance, fingerprint template) and why, in the appointment letter, with a line on keeping client data confidential.
• Restrict the biometric device, so only the owner or manager can add, view or delete fingerprints, and delete a leaver's fingerprints. Keep attendance and salary records as long as labour and tax laws require.

Stylists keep regulars' numbers, chats and photos on their own WhatsApp, so when one leaves, that data, and often those clients, go with her, while your salon stays responsible for it. Have clients contact the salon's number, take photos on a salon device, and on a leaver's last day remove her access and ask her to delete salon client data in writing. Our guide to keeping good stylists covers the other half of that problem.

#How do you protect client data at the front desk?

The leaks a salon can control most aren't hacking. They're a readable screen, a list sent to a WhatsApp group, a forgotten export, or a former employee's login.

#How long can you keep client data?

Keep personal data only while you need it for its purpose, or while a law requires it, then erase it, and make your processor erase it too. The Act requires erasure when a client withdraws consent or the purpose is no longer served.

Two rules pull the other way. The DPDP Rules require keeping personal data and processing logs for at least a year, for purposes such as lawful government requests. And GST law requires registered businesses to keep accounts and invoices until 72 months after the due date of that year's annual return.

#How do you handle a client's request to see or delete her data?

Tell clients how to make a request, check who is asking, and answer within 90 days. Clients can ask for a summary of their data, and for it to be corrected, updated or erased. The Rules require you to publish how to request and a contact person, on your website or app; if you have neither, put them in your notice, at the counter and in your WhatsApp profile, and ask a lawyer whether that's enough.

• Check identity. Act on a request from the client herself, from her registered number or in person, or from a parent for a child. A husband or friend asking for her doesn't count unless she has formally nominated them.
• Settle balances first. If she holds a package or wallet balance, settle or refund it before deleting her record.
• Keep what the law needs. Delete notes, photos and marketing consent, keep invoices as GST law requires, and tell her what you kept, naming your contact person as the Rules require.

A client is expected to use your grievance process before complaining to the Data Protection Board, so a fast, polite answer usually ends the matter.

#What should you do if client data leaks?

Tell every affected client and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware. A salon breach looks ordinary: a stolen phone, a leaver with an export, a list posted to the wrong WhatsApp group, or a breach at your vendor.

Under Rule 7, each affected client must be told what happened, the likely consequences for her, what you've done, how she can protect herself, and whom to contact.

#What are the penalties under the DPDP Act?

The Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach or meet the duties on children's data, and up to ₹50 crore for other breaches of the Act or Rules. The Data Protection Board decides the actual amount case by case.

The Board must weigh factors such as the nature, gravity and duration of the breach, the type of data, repetition and what was done to reduce the harm. For a salon, the useful point is that security, breach reporting and children's data, the duties you're most likely to be tested on, carry the highest ceilings.

#A 30-day DPDP checklist for salons

You can put the basics in place in a month, a week at a time, without stopping the salon.

Choosing or changing software this year? Our salon software checklist includes these data questions, and our guide to switching software covers moving client data safely.