When you need it
If you rely on legitimate interests to keep notes about clients, data protection law expects you to have weighed your interest against theirs and written it down. This is the three-part test, filled in for a salon using Rapport. Keep your copy with your other records and review it once a year. Health details are special category data and need explicit consent as well; this assessment does not cover them.
The template
| Question | Your answer (edit to fit) |
|---|---|
| Purpose: what are we trying to achieve? | To give clients a personal service by remembering what they told us: how they like their hair, what they mentioned last time, what to ask about. To run the diary accurately from spoken notes. |
| Is it a legitimate interest? | Yes. Remembering clients is the ordinary business of a salon and clients expect it. It is not unlawful or unethical. |
| Necessity: is processing needed for it? | Yes. Written notes are the only reliable way to remember across a team and over months. Spoken notes are turned into text; the audio is not kept, which is the least intrusive way to capture them. |
| Balance: what are the risks to clients? | A note could contain something a client would not want shared. Mitigations: Only me notes are readable only by the writer and the owner; health details are never saved automatically and only by the owner or a manager with the client’s consent; mentioned third parties are recorded by first name only; every change can be undone; clients can see and erase their notes on request. |
| Would clients expect this? | Yes. Clients routinely tell their stylist about their lives and expect them to remember. We tell clients in our privacy notice that we keep notes, including spoken ones, and who processes them. |
| Safeguards and retention | Notes are kept for as long as the person is a client and erased on request. Rapport’s suppliers do not keep note text or use it for training. Access is limited by role in HQ. |
| Decision and date | Legitimate interests applies for ordinary client notes. Explicit consent is obtained separately for any health detail. Assessed by [name] on [date]; review by [date + 12 months]. |
This is a template, not legal advice. Have it checked before you rely on it.