One customer. One service journey. Many systems, staff and photographs.

The customer arrives long before any record should exist - a website form, an Instagram DM, a WhatsApp message, a phone call, a walk-in, a booking marketplace, a hotel concierge, a corporate tie-up. Within minutes the same person sits in a booking app, a diary, a lead sheet and somebody's own phone.

Where control breaks: The staff member is the system — and they leave with it

DPDPASomeone asking the price of a package has not agreed to three years of offers. Give a simple notice at the point the enquiry is taken, collect only what the booking needs, keep enquiries off staff members' personal phones, and decide when a lead that never converted is deleted.

Before any service, the customer declares things a stranger would never be told: medical conditions, injuries, medication, allergies, pregnancy where relevant, contraindications. It is collected on a paper form or a Google Form by someone with no clinical training, and it is routinely readable at the front desk.

Where control breaks: Medical declarations, collected at a front desk

DPDPAThis is high-impact health data even though the business is not a clinic. Collect only what is needed to deliver the service safely, keep the form away from reception chat and sales lists, restrict it to the professional who needs it, update it rather than letting it fossilise, and never use it for promotion.

The body becomes data. A trainer records weight, BMI and measurements from the body-composition machine; a stylist assesses skin and hair and notes concerns; a therapist writes a wellness consultation. Some of it lands in a vendor's device app, some in a spreadsheet, some in a staff member's own notebook.

Where control breaks: The body becomes a permanent record

DPDPAA measurement is about the person, not the machine. Explain what is measured and why, keep assessment records in one governed place rather than notebooks and camera rolls, let the customer see and correct them, and set a retention rule - a body record from years ago is not needed for next week's appointment.

The business decides who will do the work and what will be done: a workout programme, a colour formula, a treatment plan and therapist allocation. The day's client list, the caution notes and the patch-test results are routinely posted into the staff WhatsApp group so everyone knows the schedule.

Where control breaks: One customer's caution note reaches every phone on the shift

DPDPAThe plan should reach the professional doing the work - not every phone in the building. Keep customer names, health cautions and photographs out of general staff groups, show assistants the minimum the task needs, and keep planning notes factual: they may be read back one day by the customer they describe.

The session, the cut, the colour, the massage. Each visit appends to a running service history - what was done, which products were used, how the skin reacted, what the customer prefers - plus the observation the staff member types about the person. Reactions and injuries go into an incident register.

Where control breaks: Visit notes compound into an intimate profile

DPDPAA service record is legitimate; a permanent character sketch is not. Keep in-service notes factual and minimal, restrict reaction and incident records to the people who need them, and remember the running history is personal data the customer can ask to see, correct - and eventually have deleted.

The signature moment of this sector. A progress photo, a before-and-after pair, a bridal album, a transformation reel - taken on whoever's phone is nearest, collected into a gallery, shortlisted for Instagram. The customer said yes to a photograph; nobody asked about a channel, a crop or a deadline.

Where control breaks: The customer's body becomes the business's advertisement

DPDPACapturing an image and publishing it are two different decisions and need two different consents. Record purpose, channel and duration; offer cropped or face-hidden options; make withdrawal easy and act on it everywhere, including the copies with the agency and the photographer; and give raw images a retention date.

The service history becomes a marketing asset: a WhatsApp broadcast list, an SMS campaign, a loyalty tier, a customer-value band, an audience uploaded to an ad platform, a member community group where every number is visible, a review reply that confirms exactly which treatment somebody had.

Where control breaks: The campaign list knows what everyone had done

DPDPAA reminder about tomorrow's appointment and a promotion are different messages needing different choices. Hold one opt-out that every channel respects, keep health, body and service categories out of ad audiences, never confirm a customer's treatment in a public reply, and let people leave the group without leaving the gym.

The membership lapses, the customer stops coming - and almost nothing is deleted. The profile, the health form, the measurements, the photographs and the chat threads settle into an archive kept 'for repeat bookings'. And when a staff member leaves, the client list in their phone leaves with them.

Where control breaks: Nobody owns the ex-customers, so nothing is ever deleted

DPDPARetention has to be decided per record, not per person. A tax invoice has grounds to stay; a five-year-old health declaration and a progress photo of a lapsed member do not. Suppress marketing when the relationship ends, delete what has merely never been deleted, and make staff exit a data event: access revoked, copies returned, the customer list stays.