Template Data Protection Impact Assessment (DPIA) for salons
Effective from: 22 October 2026
Last changed: 22 October 2026
This is a convenience translation of the Slovenian original, Vzorec ocene učinka (DPIA) za salone. In case of any discrepancy, the Slovenian version prevails.
This template was prepared by Termina, računalniško programiranje, Neya Borysova s.p., Goriška ulica 4, 2000 Maribor, as processor under Article 28(3)(f) GDPR for providers (salons) that enable features on the Termina platform involving clients' health data: the pre-visit questionnaire or the cosmetics questionnaire, the allergy or sensitivity test, the hair profile, the skin profile, the treatment protocol and progress photos. The salon is the controller of this data and is itself responsible for the data protection impact assessment (Article 35 GDPR). The template describes the part of the processing that runs on the platform; the salon completes it with its own circumstances (the parts marked "Salon to complete"), signs it and keeps it as its own documentation. It is not legal advice.
1. Whether the salon needs an impact assessment
An impact assessment is mandatory where processing is likely to result in a high risk to the rights of individuals (Article 35(1) GDPR), in particular for large-scale processing of special categories of data (Article 35(3)(b)). The WP29 guidelines on impact assessments (WP 248 rev.01) consider that processing meeting two or more of nine criteria usually requires an assessment; the list of the Slovenian Information Commissioner of 24 May 2018 names processing operations for which an assessment is mandatory.
The processing on the platform meets the criterion sensitive data (health data, and with progress photos also images of the face or body) and partly the criterion vulnerable individuals (clients in relation to the practitioner, pregnant clients). The criterion large scale is usually not met by a salon with a few hundred clients; there is no evaluation or scoring, no automated decision-making, no systematic monitoring, no matching of datasets and no new technology. The Information Commissioner did not put processing of health data without such additional circumstances on its list (the list names hospital systems, apps monitoring health data and the like).
Conclusion of the template: an impact assessment for an individual salon is not unambiguously mandatory, but it is recommended and the salon completes it with little effort using this template; a documented assessment is also evidence of accountability under Article 5(2) GDPR. A salon that processes data of several thousand clients, uses progress photos on a large scale or links the data with its own systems does need the assessment.
Salon to complete: number of clients per year, which features are enabled, whether health data is also processed outside the platform (paper, own records).
2. Description of the processing
2.1 Nature, scope, context and purposes
| Question | Answer on the platform | Salon to complete |
|---|---|---|
| Purpose | safe performance of a beauty service: choice of product and procedure, avoiding allergens, deciding on a test before colouring or a treatment | the salon must not add other purposes |
| Which data | questionnaire answers (allergies, pregnancy, diabetes, medication, skin condition), result of the allergy or sensitivity test, scalp and allergies in the hair profile, skin conditions and skin reaction, progress photos | own records outside the platform |
| From whom | answers are entered by the client; the test result, profile, protocol and photos are recorded by the salon at the visit | — |
| Individuals | clients of the salon who book through the platform or whom the salon enters; adults and persons from 16 years | — |
| Scale | a few dozen fields per client and up to a few photos per appointment; kept 24 months after the last visit | number of clients |
| Who sees it | only the salon's owner account, and the client sees their own answers; staff see a neutral warning | who in the salon holds the owner account |
| Where | server and encrypted backups in the EU; no transfer to third countries; nothing sent to language models | — |
| Technology | web application, application-level encryption, access log; no biometrics, no profiling, no automated decisions | — |
2.2 Roles
- Controller: the salon (decides which features to enable and why; informs clients; provides the legal basis for data it enters itself).
- Processor: Termina under the Data Processing Agreement (DPA), with the sub-processors in Annex B of the DPA; health data goes only to the hosting provider and the backup storage in the EU.
- Salon staff: persons bound by confidentiality who do not see the content of health data on the platform; what the salon tells them orally is the salon's processing.
3. Necessity and proportionality
- Legal basis: the client's explicit consent (Article 9(2)(a) GDPR), which the platform obtains on the salon's behalf for the questionnaire and progress photos with wording that states the purpose, separately, unticked by default and as easy to withdraw as to give. For the test result, scalp, skin conditions and skin reaction entered by the salon, the salon must obtain the consent itself at the visit and document it (Salon to complete: how — for example a signature on the test form kept by the salon). An alternative basis the salon might consider is Article 9(2)(h) GDPR; it is tied to health care under the responsibility of a person bound by professional secrecy, so it is not reliable for beauty services.
- Data minimisation: questions are limited to what actually changes the decision about the service; there are no free-text health fields in the booking; photos without metadata; staff without content.
- Purpose limitation: the platform does not use the data for advertising, analytics, recommendations or AI training; the salon commits to the same in the DPA.
- Storage limitation: 24 months after the last visit, immediately on withdrawal; shorter makes no sense because allergies do not change between visits, longer is not needed.
- Transparency: Termina's Privacy Policy (section 3) describes the processing; the salon informs clients about its own records (Salon to complete: notice at reception or on the form).
- Rights: the client sees, corrects, withdraws and deletes answers themselves; export in the app; the salon deletes a client on the dashboard; complaint to the Information Commissioner.
4. Risks to individuals and measures
| Risk | Likelihood | Severity | Measures on the platform | Residual risk |
|---|---|---|---|---|
| Disclosure of health data to an unauthorised person (intrusion, leaked backup) | low | high | encryption in transit and at application level with a key outside the database and backups; encrypted backups in the EU; sign-in throttling; two-step administrator sign-in; access log | low |
| Access by a staff member who does not need it | low | medium | staff with their own account do not see the content; neutral warning; the salon shares orally only with the practitioner | low; Salon to complete: instruction to staff |
| Health data in a notification, SMS or email | very low | high | answers and results are never in notifications; automated tests verify this | very low |
| Unfair or invalid consent (condition of the appointment, unclear wording) | low | medium | consent separate, unticked by default, not a condition of booking; record with time and source; withdrawal with one button | low |
| Data entered by the salon without a legal basis | medium | medium | the platform warns the salon at the first entry; the DPA requires the salon's own basis and notice to the client | medium — Salon to complete: procedure at the test |
| A skin photo reveals a condition or identity | low | high | separate explicit consent; private folder, no metadata, no biometrics; publication only after individual approval; withdrawal deletes everything | low |
| Excessive retention | low | medium | automatic deletion after 24 months, immediately on withdrawal, immediately on client deletion; in backups at most 14 days | low |
| Inaccurate data (outdated answer) leads to a wrong decision about the service | medium | medium | annual renewal of the cosmetics questionnaire; the client corrects answers themselves; the salon checks before the service | low — Salon to complete: oral check before the service |
| Loss of data (server failure) | low | low | daily backups with restore test | low |
| Transfer to a third country | — | — | the platform does not transfer health data outside the EU and does not send it to language models | none |
5. Consultation
- Individuals: the salon collects clients' views through feedback on the questionnaire (Salon to complete). Termina designs the questionnaire to be understandable and short and improves it after comments.
- Processor: Termina as processor provides the information in this template and in the DPA (Annexes A and B).
- Data protection officer: the salon is not obliged to appoint one unless the scale of processing requires it (Article 37 GDPR); Salon to complete: whether it has one.
6. Conclusion and prior consultation (Article 36 GDPR)
After the measures taken, the residual risk is not high: the data is limited to the safety of the service, visible only to the salon owner and the client, encrypted, with an access log, with short retention and with a withdrawal that means immediate deletion. Prior consultation with the Information Commissioner under Article 36 is not required unless the salon extends the processing (for example to health purposes, matching with other datasets or large-scale photography without individual consent). The salon reviews the assessment once a year and whenever the enabled features change.
Salon to complete: date, name of the responsible person, signature; date of the next review.
7. Sources
- Regulation (EU) 2016/679 (GDPR), Articles 9, 28, 32, 35 and 36.
- Slovenian Personal Data Protection Act (ZVOP-2), Article 22 (processing log) and Article 69 (impact assessment).
- WP29 Guidelines on Data Protection Impact Assessment, WP 248 rev.01 (endorsed by the European Data Protection Board).
- Information Commissioner of the Republic of Slovenia, List of processing operations subject to the requirement for a data protection impact assessment, no. 014-1/2018/1, 24 May 2018.
- Privacy Policy, sections 3 and 10; Data Processing Agreement, section 3.1 and Annexes A and B.
Questions: info@termina-booking.com