Data protection in a tattoo studio: client data, photos and retention under GDPR

Data protection sounds like paperwork for large companies. In a tattoo studio it is very concrete: you know who has which allergy, who was pregnant, what somebody's thigh looks like and who never paid their deposit. That is exactly the kind of data whose loss really hurts, for your clients and for you.

What data does a tattoo studio actually hold?

Almost every studio underestimates the amount. Write down once where client data sits and you quickly reach six or seven places.

• Contact details: name, phone, email, Instagram handle, sometimes a postal address.
• Appointment data: motif, placement, size, price, deposit, who was where and when.
• Health answers from the consent form: allergies, medication, existing conditions, pregnancy.
• Photos: before, after, healed, sometimes with a face, often with recognisable features such as scars or other tattoos.
• Payment data: amounts, payment methods, receipt numbers, and whatever sits with your payment provider for online payments.
• Chat threads: WhatsApp, Instagram DMs, emails, often with health details buried in the text.

Which rules apply in the EU and in Switzerland?

The GDPR applies in the EU, and in Switzerland the revised data protection act has been in force since 1 September 2023. For daily studio work both come down to the same principles. You do not need a data protection officer to meet them, you need order.

• Purpose limitation: you store data for the appointment, the treatment, documentation and billing, not just in case.
• Data minimisation: what you do not need, you do not ask for. Date of birth yes, blood type no.
• Security: access only for those who need it, devices locked, data encrypted, backups in place.
• Transparency: clients have to know what you collect and why. That is what the privacy policy is for.
• Access and deletion: clients may ask what you hold about them and request deletion, as long as no retention duty stands in the way.

Health data and photos: the two sensitive areas

Health answers are a special category of personal data. In practice that means they belong in a system with access control, not in a spreadsheet on the studio desktop and certainly not as a photo of the filled in form in a WhatsApp chat. In a studio with several artists, ideally only the person doing the appointment sees them.

Photos are the second area where things regularly go wrong. For your portfolio and Instagram you need consent that is voluntary, clear and revocable. Ask separately whether the face may be recognisable, because for many clients that is the real question. And remember that image files can carry metadata, including the location where they were taken.

Why WhatsApp and Instagram are not a client database

The chat is the most convenient place and the worst storage. If your phone goes missing, the client history is either gone or in someone else's hands, depending on how well it was locked. An account can be suspended, a chat thread cannot be searched properly, and health details in a DM are visible to anyone glancing at the screen.

The answer is not to ban the channel but to separate it: keep communicating in the chat, and keep the data in a system you can export, protect and clear out. What that looks like is in the article on client management in the studio.

How long do you have to keep client data?

The accounting numbers are fixed: Switzerland requires business records and receipts to be kept for 10 years, Germany 8 years for booking records and invoices and 10 years for books and annual accounts, Austria 7 years. Everything else is a decision you make once and then apply consistently.

The difference between must and may matters here. You must keep accounting records even if a client asks for deletion. Marketing data you may only keep for as long as the consent stands. Throw both into one pot and you end up deleting either too much or nothing at all.

The eight point checklist for your studio

1. 1Privacy policy on your website and linked from the booking form, in plain language.
2. 2Data processing agreements with your software providers, meaning your booking tool, newsletter service and payment provider.
3. 3Check the data location: client data belongs in the EU or Switzerland, and you should be able to say where it sits.
4. 4Access rights in the team: who needs which data? A guest artist does not need the history of every client.
5. 5Lock your devices: passcode or Face ID on phone and tablet, screen lock on the studio computer, no shared passwords.
6. 6Deletion plan: one sentence per type of data saying when it disappears. Without that sentence you never delete anything.
7. 7Answer access requests: when somebody asks what you hold, it should take you an hour, not a week.
8. 8Newsletter only with consent: a separate checkbox, never pre ticked, an unsubscribe link in every email. More in the newsletter article.

Template: a privacy note for your booking form

We store your details in order to arrange your appointment, document the tattoo and handle payment. Health answers from the consent form are treated as a special category of data and are not passed on to third parties. Accounting records are kept for as long as the law requires, everything else is deleted once we no longer need it.

We only use photos of your tattoo if you agree separately. You can withdraw that agreement at any time, and it will not affect your appointment in any way.

You can ask at any time what data we hold about you and request correction or deletion. Write to us at [email address]. The full privacy policy is available at [link].