Beauty businesses routinely collect information about their clients.

Depending on the services provided, this can include:

• names and contact details
• dates of birth
• consultation forms
• treatment histories
• allergies
• medications
• medical conditions
• contraindications
• pregnancy or breastfeeding information
• photographs
• before-and-after images
• payment information
• appointment records
• treatment notes.

Because some of this information can be sensitive, beauty businesses should understand how Australian privacy requirements may apply.

However, there is an important distinction:

The Privacy Act 1988 does not automatically apply to every small beauty business in Australia.

Whether the federal Privacy Act applies depends on factors including the size and activities of the business and the type of information it handles.

For current information, see the Office of the Australian Information Commissioner — Small Business and the Privacy Act.

Does the Privacy Act Apply to Every Beauty Salon?

No.

Under the current federal framework, most small businesses with annual turnover of $3 million or less are generally not covered by the Privacy Act.

However, there are important exceptions.

A small business can still be covered if, for example, it:

• provides a health service and holds health information
• trades in personal information
• is related to a larger body corporate covered by the Privacy Act
• is a Commonwealth contracted service provider
• falls within another exception specified under the legislation.

This means salon owners should not simply assume:

“I am a small business, so privacy law does not apply to me.”

Nor should ABA state that every salon is automatically subject to the federal Privacy Act.

Use the OAIC Small Business Privacy Checklist to help determine whether your business is covered.

Could a Beauty Business Be a Health Service Provider?

Potentially.

This is particularly important for businesses providing treatments or services represented as relating to a person’s health.

The Privacy Act definition of a health service is broader than simply visiting a doctor or hospital.

The OAIC explains that an organisation providing a health service and holding health information can be covered by the Privacy Act even if it is a small business and even if providing health services is not its primary activity.

Examples given by the OAIC include complementary therapists, gyms and weight-loss clinics as well as traditional healthcare providers.

This does not mean every beauty salon automatically becomes a health service provider simply because it asks clients about contraindications.

The activities of the particular business need to be considered.

Beauty businesses offering services that may fall closer to health-related assessment, treatment or health management should therefore check their position carefully.

See OAIC — What Is a Health Service Provider?.

Businesses uncertain about their status should consider obtaining professional privacy or legal advice.

What Is Health Information?

Health information receives additional protection under Australian privacy law.

It can include information or opinions about:

• a person’s physical health
• mental health
• disability
• health services provided to them
• health services that will be provided
• other health-related matters covered by the Privacy Act definition.

In a beauty setting, information collected during consultation may potentially include sensitive health information.

Examples might include information about:

• allergies
• medications
• medical conditions
• previous procedures
• adverse reactions
• pregnancy
• relevant skin conditions
• contraindications.

Whether particular information legally constitutes health information depends on the circumstances.

Businesses covered by the Privacy Act should understand the additional requirements associated with sensitive information.

See OAIC — Health Information and Your Privacy.

The Australian Privacy Principles

Businesses covered by the Privacy Act must comply with the Australian Privacy Principles, commonly called the APPs.

There are 13 APPs governing matters including:

• collection of personal information
• notification about collection
• use and disclosure
• direct marketing
• cross-border disclosure
• security
• access
• correction.

The APPs are principles-based, which means businesses need to consider how they apply to their particular operations.

Read the current principles at OAIC — Australian Privacy Principles.

Only Collect Information You Actually Need

Beauty consultation forms sometimes collect far more information than is necessary.

A salon should consider why each question is being asked.

For example, information about medications or medical history may be relevant where it affects:

• treatment suitability
• contraindications
• potential adverse reactions
• treatment modifications.

But businesses should avoid collecting sensitive information simply because a generic consultation template includes it.

For organisations covered by the Privacy Act, collection must comply with the applicable APP requirements.

A good practical question is:

“Do we genuinely need this information to provide this service safely and appropriately?”

If the answer is no, reconsider whether it needs to be collected.

Tell Clients Why Information Is Being Collected

Where privacy-law obligations apply, clients should receive appropriate information about the collection and handling of their personal information.

Depending on the circumstances, this can include:

• who is collecting it
• why it is being collected
• how it will be used
• whether it may be disclosed
• consequences if it is not provided
• how the client can access or correct information
• how privacy complaints are handled.

A salon privacy policy and appropriate collection notices can help explain these practices.

For guidance, see OAIC — APP 5: Notification of the Collection of Personal Information.

Consultation Records Should Be Protected

Client consultation forms should not be left:

• unattended at reception
• visible to other clients
• in unlocked public areas
• on shared devices without appropriate access controls
• accessible to staff who have no legitimate reason to view them.

Electronic records also require protection.

Appropriate measures can include:

• individual staff logins
• strong passwords
• multi-factor authentication where available
• appropriate access permissions
• secure backups
• software updates
• device security
• controlled staff access.

Businesses covered by the Privacy Act have obligations under APP 11 to take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

See OAIC — APP 11: Security of Personal Information.

Booking and Salon Management Software

Many salons now store client information in third-party systems.

These can include:

• online booking platforms
• salon management software
• CRM systems
• cloud storage
• payment systems
• email marketing platforms
• automated SMS systems.

Using another company to store the information does not necessarily remove your privacy responsibilities.

Before choosing software, consider:

• what client information is stored
• where information is stored
• who can access it
• what security features are available
• whether information is transferred overseas
• what happens if you cancel the service
• how information can be exported or deleted
• how the provider responds to security breaches.

Businesses covered by the Privacy Act should also consider the requirements applying to overseas disclosure of personal information.

See OAIC — APP 8: Cross-Border Disclosure of Personal Information.

Before-and-After Photographs

Photographs deserve particular attention in the beauty industry.

A photograph can constitute personal information where the person is identified or reasonably identifiable.

Using an image for treatment records is also different from using that image for marketing.

A client agreeing to have treatment photographs taken does not necessarily mean they have agreed to those photographs being published on:

• Instagram
• Facebook
• TikTok
• your website
• advertisements
• training material
• brochures.

Use clear consent processes for marketing images.

Good practice is to explain:

• what images will be taken
• why they are being taken
• where they may be published
• whether the client’s face or identifying features will be visible
• whether the images may be used in paid advertising.

Do not bury broad marketing-image permission inside unrelated treatment consent wording.

Staff Access to Client Records

Staff should only have access to client information necessary for their work.

Reception staff, therapists, contractors and managers may require different levels of access.

Where practical, salon software should use individual staff accounts rather than one shared password.

When a staff member leaves the business:

• disable their system access
• change shared passwords where necessary
• recover business devices
• remove access to cloud systems
• ensure client information has not been retained on personal devices.

Privacy and confidentiality expectations should also form part of staff induction and salon policies.

Client Information on Personal Phones

Allowing staff to store client information on personal phones creates additional risks.

Examples include:

• consultation photographs saved to a personal camera roll
• client phone numbers stored in personal contacts
• screenshots of consultation information
• treatment discussions through personal messaging accounts.

Businesses should establish clear policies regarding:

• photography
• messaging
• storage
• deletion
• use of personal devices.

Where possible, client records should remain within controlled business systems.

Email and Text Messages

Take care when sending sensitive information electronically.

Before sending consultation information, photographs or treatment records:

• verify the recipient
• check the email address or phone number
• avoid unnecessary sensitive information
• use secure systems where appropriate.

Sending confidential information to the wrong client can constitute a data breach.

Privacy and Marketing Consent Are Not the Same Thing

A client’s agreement to provide their contact details for an appointment does not automatically mean unlimited permission to send marketing communications.

Electronic marketing can also fall under the Spam Act 2003, which is administered by the Australian Communications and Media Authority.

Commercial electronic messages generally need to meet requirements relating to:

• consent
• sender identification
• unsubscribe functionality.

Check the current requirements at ACMA — Avoid Sending Spam.

This is separate from the Privacy Act.

A business may therefore need to consider both privacy requirements and electronic-marketing requirements.

How Long Should Client Records Be Kept?

There is no single universal record-retention period applying to every beauty treatment throughout Australia.

Retention requirements can depend on:

• the type of business
• whether the business is a health service provider
• the treatment
• state or territory legislation
• insurance requirements
• taxation and business-record obligations
• potential legal claims.

Businesses should therefore avoid adopting statements such as:

“All salon consultation forms legally have to be kept for seven years.”

unless a specific law or applicable requirement establishes that period.

Check requirements applying to your business and ask your insurer what treatment records they expect you to retain.

Where the Privacy Act applies, APP 11 also addresses circumstances in which personal information that is no longer needed should be destroyed or de-identified, subject to applicable exceptions.

What Is a Data Breach?

A data breach can occur when personal information is:

• lost
• accessed without authorisation
• disclosed without authorisation
• modified without authorisation
• otherwise compromised.

Examples in a beauty business could include:

• a laptop containing consultation records being stolen
• salon software being hacked
• client information being emailed to the wrong person
• an employee accessing records without authority
• a lost phone containing client photographs
• client records being publicly exposed online.

Every business should take data security seriously, whether or not the federal Privacy Act applies.

Does Every Data Breach Have to Be Reported?

No.

The Notifiable Data Breaches scheme applies to entities that are already subject to relevant Privacy Act security obligations.

Where the scheme applies, notification requirements can arise when an eligible data breach is likely to result in serious harm to affected individuals and the applicable statutory tests are met.

This can require notification to:

• affected individuals
• the Australian Information Commissioner.

The rules are more detailed than simply:

“Every hacked salon must report itself to the government.”

If a breach occurs, use the current OAIC — Quick Reference Guide for Responding to Data Breaches.

For the complete scheme, see OAIC — Notifiable Data Breaches Scheme.

Have a Data Breach Response Plan

Even businesses that are not legally required to notify the OAIC can benefit from having a response plan.

The plan can establish:

1. who responds to a suspected breach
2. how affected systems are secured
3. how the extent of the breach is assessed
4. who receives professional advice
5. whether notification obligations apply
6. how affected clients are contacted where appropriate
7. how the cause is corrected.

Businesses covered by the Privacy Act should pay particular attention to OAIC requirements.

See OAIC — Data Breach Preparation and Response.

State and Territory Privacy Laws Can Also Matter

The Privacy Act is Commonwealth legislation, but privacy regulation does not end there.

States and territories have their own privacy and health-record frameworks in various forms.

Which laws apply can depend on:

• jurisdiction
• whether the organisation is public or private
• whether health information is involved
• the nature of the service.

The OAIC maintains a useful starting point with links to the relevant jurisdictions:

OAIC — State and Territory Privacy Legislation.

Businesses handling significant health information should check whether additional state or territory health-record legislation applies to them.

What If the Privacy Act Does Not Apply to My Salon?

Being exempt from the federal Privacy Act does not mean client confidentiality should be ignored.

Client information can still create:

• contractual issues
• consumer-law issues
• employment issues
• insurance implications
• professional obligations
• reputational risks
• cybersecurity risks.

A sensible privacy system remains good business practice.

Small businesses that would otherwise be exempt can also choose to opt in to Privacy Act coverage.

The OAIC provides information about this at OAIC — Opting In to the Privacy Act.

Privacy Checklist for Beauty Businesses

Review the following areas within your business.

Client Information

• Do we know what client information we collect?
• Do we genuinely need each piece of information?
• Do we know whether we collect health information?
• Do we know whether the Privacy Act applies to our business?

Consultation Records

• Are paper records stored securely?
• Are electronic records password protected?
• Is staff access restricted appropriately?
• Are records backed up securely?

Photographs

• Do clients understand why photographs are taken?
• Do we obtain separate appropriate permission before marketing use?
• Are images stored securely?
• Do staff avoid storing client photographs unnecessarily on personal devices?

Software

• Do we know where our salon software stores client data?
• Have we reviewed its privacy and security arrangements?
• Is multi-factor authentication available?
• Can former staff access the system?
• Do we understand whether information is disclosed overseas?

Marketing

• Do we have an appropriate basis for sending marketing messages?
• Do commercial electronic messages identify the sender?
• Can recipients unsubscribe easily?
• Are unsubscribe requests actioned?

Data Breaches

• Do staff know what constitutes a suspected data breach?
• Do we have a response procedure?
• Do we know whether the Notifiable Data Breaches scheme applies to us?
• Do we know where to obtain current OAIC guidance?

Check Current Requirements

Privacy regulation continues to develop.

Do not rely solely on an old salon policy, downloadable template, social-media post or industry article to determine your legal obligations.

Use the relevant government authority to check current information.

Office of the Australian Information Commissioner

OAIC — Small Business
Check whether your business is covered by the Privacy Act.

OAIC — Australian Privacy Principles
Check the current APP requirements.

OAIC — Health Information
Guidance about handling health information.

OAIC — What Is a Health Service Provider?
Useful where your beauty, wellness or aesthetic services may potentially fall within the health-service definition.

OAIC — Notifiable Data Breaches
Current information about responding to eligible data breaches.

OAIC — State and Territory Privacy Legislation
Starting point for checking additional jurisdictional requirements.

Australian Communications and Media Authority

ACMA — Avoid Sending Spam
Check the requirements for commercial email and SMS marketing.

Final Takeaway

Privacy compliance for Australian beauty businesses should not be reduced to:

“Every salon must comply with the Privacy Act.”

That statement is too broad.

Most businesses with annual turnover of $3 million or less are generally outside the federal Privacy Act unless an exception applies.

However, private-sector health service providers can be covered regardless of turnover, as can some other categories of small business.

Beauty businesses therefore need to assess their own activities, particularly where they collect health information or provide services potentially falling within the definition of a health service.

Regardless of whether the Privacy Act applies, protecting consultation records, photographs, health information and contact details is sensible professional practice.

The best approach is to:

collect only what you need, explain why you need it, protect it appropriately, control who can access it and know what to do if something goes wrong.

And because privacy requirements can change, use the links to the OAIC and other government authorities throughout this article to verify the current position.

Important Disclaimer

This article provides general educational information for Australian beauty professionals and businesses. It does not constitute legal or privacy advice.

Privacy obligations can depend on the activities, turnover, information holdings and circumstances of the individual business, as well as applicable Commonwealth, state and territory legislation.

Businesses should check current requirements with the Office of the Australian Information Commissioner and relevant state or territory authorities and obtain professional advice where necessary.