If your salon keeps names, phone numbers or visit history, Malaysia's PDPA 2010 applies — size is irrelevant. Five obligations: collect only what you need, say why, get clear consent before marketing, store it securely and never sell it, and let customers access, correct or withdraw. A written notice at booking and a consent tick-box for WhatsApp promotions cover most of it.
Every salon, spa and clinic collects personal data — a name, a phone number, a birthday, treatment history, sometimes photos. Under Malaysia’s Personal Data Protection Act 2010 (PDPA), that makes you responsible for handling it lawfully. This is not about fear; it is about trust. Customers share their details expecting you to protect them, and getting this right is both a legal duty and a competitive advantage. Here is what it means in practice — note this is general guidance, not legal advice.
Key takeaways
- ✓If you store names and phone numbers, PDPA applies to you — salon size does not matter.
- ✓Collect only what you need, and tell customers why you are collecting it.
- ✓Get clear consent, especially before marketing messages.
- ✓Store data securely and never sell it — a reputable system encrypts and backs up for you.
- ✓Let customers access, correct or withdraw — that is their right under the PDPA.
Do the PDPA rules really apply to a small salon?
Yes. The PDPA governs personal data processed in commercial transactions, and a customer’s name, phone number and visit history are exactly that. There is no exemption for being small. The upside: complying is mostly common sense once you know the principles, and a good system does much of it for you.
Collect only what you need — and say why
Every field you collect should have a purpose. A phone number for reminders makes sense; a customer’s IC number rarely does. When you take details, briefly tell customers what you will use them for — bookings, reminders, and, if they agree, promotions.
- ✓Name and phone — for bookings and reminders.
- ✓Treatment history — for better, safer service.
- ✓Marketing consent — a separate, explicit yes.
Consent: the part most salons get wrong
Collecting a phone number to confirm a booking is one thing; blasting that number with promotions is another. Best practice is to get a clear, separate consent for marketing — a simple opt-in at sign-up — and to honour opt-outs immediately. It protects you legally and keeps your WhatsApp marketing welcome rather than annoying.
Store it securely — and never sell it
PDPA requires reasonable steps to protect personal data from loss, misuse and unauthorised access. In practice that means: no customer lists in an unlocked WhatsApp group or a shared spreadsheet anyone can copy. A reputable cloud system stores data encrypted, backs it up, and limits who on your team can see what through role-based access.
Respect customer rights
Under the PDPA, customers can ask to see the data you hold, correct it if it is wrong, and withdraw consent. Have a simple way to handle these requests — usually one contact email is enough — and act on them promptly. A system that lets you find, edit and export a customer’s record in seconds makes this effortless.
MyBMS Pro gives you a secure, access-controlled home for customer data, with consent tracking and instant record lookup — the practical groundwork for PDPA compliance. Book a free demo, and always confirm your specific obligations with a qualified advisor.
Written by
William Tang · Founder, BMS Solution Sdn. Bhd.
William Tang is the founder of BMS Solution Sdn. Bhd., the Malaysian company behind MyBMS Pro. He works hands-on with salons, spas, clinics and car-grooming businesses across Malaysia, helping them move bookings, POS, memberships and staff management onto one cloud platform.