Beauty Treatment Consent Form: What to Add

The client sits down in the chair and you are holding a form. Should it be a consent to the beauty treatment, a GDPR consent, or both on one sheet? This is the most common question when setting up salon documents. The answer is simple: they are two different things with two different functions. Treatment consent shows that the client knew what she was agreeing to. The GDPR consent and information notice concern her data, including health data. In this article we separate the two and show what to put in each document.

Key takeaways

• Treatment consent and GDPR consent are separate documents with separate purposes. You can hand them over for signing together, but in clearly separated parts.
• In the acts we checked there is no statutory template for a beauty treatment consent. You draft the content yourself, so it must fit the service you perform.
• A health questionnaire collects health data (Article 9 GDPR). The cautious approach: you collect it with the client's explicit consent and you can prove it.
• You collect consent before the treatment. A signature given after the treatment does not show that the client knew the risks beforehand.
• GDPR does not say how many years to keep a client card. You set the period yourself and write it down in the salon's documents.

Treatment consent vs GDPR consent: two different documents

Treatment consent is the client's statement that she has been informed about the treatment and its risks, answered the questionnaire truthfully and decides to have the service. The Civil Code provides that a declaration of intent can be made through any behaviour that reveals the intent sufficiently, including in electronic form (Article 60 of the Civil Code, consolidated text: Journal of Laws 2026, item 795). Health is a personal interest protected by civil law (Article 23). A written consent is therefore not a magic shield, but it is your evidence of what the client knew and confirmed.

The GDPR consent and notice concern something else: what you do with the client's data. Regulation 2016/679 separates three things here.

Document	What it is for	Basis in GDPR
Treatment consent	Information about the treatment and risks, confirmation of the questionnaire, the client's decision	Not required by GDPR, it is part of the service documentation
Consent to process health data	Collecting data from the questionnaire (allergies, pregnancy, skin conditions)	Article 9(2)(a) (explicit consent) and Article 7
Information notice	Telling the client who processes her data and why	Article 13 (this is an information duty, not a consent)

The most common mistake is a single sentence: "I consent to the treatment and to the processing of my data for marketing purposes". GDPR requires that a consent given in a document that also covers other matters be clearly distinguishable from the rest and written in clear and plain language (Article 7(2)). Marketing, photos and health data are separate purposes. We cover this in more detail in the article on GDPR consents of clients in a beauty salon.

Health data in a salon: when you need explicit consent

Article 4(15) GDPR defines data concerning health as data on physical or mental health that reveal information about health status. Article 9(1) prohibits processing it unless one of the conditions in paragraph 2 applies. For a salon the most practical one is point (a): the data subject has given explicit consent for specified purposes.

We did not find guidance from the data protection authority (UODO) written specifically for beauty salons. Comments in the industry are not uniform, and some authors take the view that classic beauty services do not generate Article 9 data at all. The more cautious approach: if you ask about allergies, medication, pregnancy and skin conditions, you treat the answers as health data and document explicit consent. It is worth discussing the final assessment of your situation with a lawyer or a data protection officer.

Three rules from Article 7 will help you design the form:

• You must be able to demonstrate the consent (paragraph 1). A signed paper, an entry in a system with a date, any form, as long as you can show who agreed, when and to what.
• The client can withdraw consent at any time, and withdrawing must be as easy as giving it (paragraph 3). Say on the form how to do it.
• You cannot make a service conditional on a consent that is not needed for it (paragraph 4). Consent to photos or a newsletter cannot be a condition for a manicure.

What treatment consent should contain

The law gives no template, so the list below is a proposal built on good practice and the GIS recommendations, not a list taken from a provision.

1. Salon and client details: name, the client's first and last name, date of birth (useful for recognising minors), date of the visit.
2. Treatment name and short description: for example brow lamination with henna, lash extensions, gel manicure. One sentence on what exactly you will do.
3. Possible side effects: irritation, redness, allergic reaction. Write about what actually comes with the given treatment and products.
4. Contraindications: the list of questions from the questionnaire, or a reference to the client card. The client confirms that she answered truthfully.
5. Safety information: the GIS recommendations say that a notice at the station should state that the tools are clean and safe and that the client may ask about the sterility of the pack. It is worth repeating this on the form.
6. Aftercare: care, what to avoid, when to get in touch if worrying symptoms appear.
7. Client's statement: that she has read the information, had the chance to ask questions and decides to have the treatment.
8. Date and signature of the client and of the person performing the treatment.

For treatments with a patch test, add a separate field for the result and date. Details for henna, lamination and lashes are in the article on the patch test procedure, and for permanent makeup in the article on the PMU consent form.

Questionnaire and consent: how to combine them

In practice the most convenient option is one document with three parts. The first is the questionnaire: questions about allergies, medication, pregnancy, skin conditions and earlier reactions. The second is the treatment consent with information about the risk. The third is separate GDPR statements, signed separately: consent to process health data, and for photos and marketing separate boxes to tick.

The GIS recommendations say that before a service the skin area should be clean and free of signs of infection, allergy, dermatitis, wounds, rash and cuts. This is a good anchor for the questionnaire questions and for a note that you inspected the skin before the treatment. GIS also recommends documentation that lets you link the reusable tools used on a given client with the decontamination processes they went through. You can add a field to the card for the pack or sterilisation cycle number. How to keep such a record is described in the article on the sterilisation log.

How to lay out the card itself is in the articles on the client card and on the pre-treatment questionnaire.

Minor clients and special situations

If the client is under 18, her own consent to the treatment is not enough, because the rules on legal capacity and a parent's or guardian's consent apply. This topic is covered separately in the article on consent of a minor client, so we do not repeat it here. Pregnancy is likewise a separate thread, discussed in the article on special procedures in pregnancy.

Two situations require a decision from you:

• The client does not want to fill in the questionnaire. Without answers you cannot assess contraindications. The decision whether to perform the treatment is yours. Record the refusal with the date.
• The client does not agree to photos or a newsletter. That is her right. You cannot refuse the service for this reason, because such consents are not necessary to perform it (Article 7(4) GDPR).

Storing consents and client cards

Article 5(1)(e) GDPR requires keeping data no longer than is necessary for the purposes of processing. It does not give any number of years. We also did not find a provision that would set a retention period for cards in a beauty salon.

A reference point when setting the period can be the limitation periods for claims under the Civil Code. Claims related to running a business become time-barred after three years (Article 118). A claim for compensation for damage caused by a tort becomes time-barred three years from the day the injured party learned of the damage, and no later than ten years from the event (Article 442¹ § 1). For personal injury to a minor, the limitation period cannot end earlier than two years after the person reaches adulthood (§ 4). This is our line of reasoning, not a requirement. Write the period you choose in your privacy policy and in the record of processing activities together with the justification, and delete or destroy the data when it expires.

Where to get a template and how to adapt it

A ready treatment consent form, together with the client card and privacy policy, is in the NailsReady Foundation package. The template has to be adapted to your services and products, because a consent for brow lamination should describe different risks than a consent for a gel manicure.

Frequently asked questions

Is a beauty treatment consent mandatory by law?

In the acts we checked (the Act on preventing infections, GDPR, the Civil Code, the GIS recommendations) we found no provision requiring a written consent to a beauty treatment or setting its statutory template. We did not search all legal acts, so we do not claim that no such provision exists anywhere. The consent is, however, your evidence of diligence and makes a conversation easier in case of a complaint.

Can the treatment consent and the GDPR consent be on one sheet?

They can, if they are clearly separated and marked separately, written in plain language (Article 7(2) GDPR). Consent for health data, consent for photos and marketing consent should each have its own field. The information notice under Article 13 is not a consent, but information the client receives.

Is verbal consent or a message in a messenger enough?

The Civil Code allows a declaration of intent in any way, including electronically (Article 60), and GDPR requires that you can demonstrate the consent (Article 7(1)). Verbal consent is hard to demonstrate. A message can be saved, but it is easy to lose or challenge. Choose a form that you can document and keep.

How long should I keep signed consents?

GDPR gives no number of years, and we did not find an industry-specific provision. You set the period yourself, for example with the limitation periods for claims in mind, and write it down in the salon's documents. When it expires, you delete the data.

Can I refuse a treatment if the client does not sign the marketing consent?

Not for that reason. Marketing consent and consent to photos are not necessary to perform the service, so you cannot make the treatment conditional on them (Article 7(4) GDPR). The questionnaire and the treatment consent are different: without information about contraindications you have no basis to assess the risk.

What you risk for breaching data protection rules and how to react to a leak is described in the article on reporting a client data leak. Information on GDPR from the supervisory authority is on the website of the Personal Data Protection Office (UODO).

---

Legal status as of: 2 November 2026
Legal basis: Regulation (EU) 2016/679 (GDPR), Article 4(15), Article 5(1)(e), Article 7, Article 9(1)-(2), Article 13 (text from the EU Publications Office); Articles 23, 60, 118 and 442¹ of the Civil Code (consolidated text: Journal of Laws 2026, item 795); "Hygiene and sanitary recommendations and requirements of the Chief Sanitary Inspector for beauty services" (GIS, May 2026). A statutory template for a beauty treatment consent and UODO guidance for beauty salons were not found. Not checked: the 2018 Act on the Protection of Personal Data, patient rights rules, case law and UODO decisions, rules on consent of minors (a separate article).
Last reviewed: 2 November 2026