Short answer
You should keep adult skin test records for at least six years, though some UK insurers require seven years. For clients under eighteen, you must retain these records until they reach age twenty-one, and ideally age twenty-five. This ensures you can defend against personal injury claims within the legal time limits.
Insurance and the six-year standard
Skin test records are your primary defence if a client has an adverse reaction to a service and decides to sue. In the UK, the standard limitation period for personal injury claims is three years from the date of the injury or from the date the client first realised the injury was connected to your service.
Because of this, most specialist salon insurers require you to keep records for much longer. The National Hair & Beauty Federation and major insurers recommend keeping skin test records for at least six years. Some insurers go further, explicitly requiring seven years from the date of the last treatment. If a claim is made and you can't produce a signed, dated record of a patch test, your insurer will refuse to cover the claim, which leaves you personally liable for legal fees.
Younger clients and the Limitation Act
The rules change completely when you're treating clients under eighteen. Under the Limitation Act 1980, the standard three-year claim window doesn't start until a minor reaches their eighteenth birthday. This means a child has until their twenty-first birthday to bring a claim against your salon for a treatment they had years earlier.
To protect yourself, you must keep skin test records for younger clients until they reach at least age twenty-one. Legal experts advise keeping them until they turn twenty-five to allow for any delays. If you're using paper record books, this means keeping old boxes of consultation cards long after you've closed the books for that year. You need proof that a minor had a valid test forty-eight hours before their colour service, or you won't have a valid defence.
UK GDPR and secure digital storage
Because skin test records document health information, they're classified as special category data under UK GDPR. This means you must store them securely and you can't keep them longer than necessary. However, defending yourself against legal claims is a legitimate reason to keep these records for six or seven years.
To comply, you can't leave paper cards on the reception desk. They must be locked away or stored in a secure system. Luminate tracks and flags skin test records securely in the cloud, so you don't have to worry about paper records getting lost. Because these tests contain special category data, Luminate stores them with encryption on secure UK and EU hosting, and you can export a customer's full record as a ZIP file if your insurer ever asks to see the proof.
If a client requests that you delete their data under GDPR, you don't have to delete their skin test history if you need it to defend future claims. You should explain that you're retaining the records to comply with your insurance policy, which is a lawful basis for keeping this data.
What this means for your salon
You should check your specific insurance policy terms today to see if your insurer requires a six-year or seven-year retention period. Ensure your team logs every skin test immediately with the client's signature, and keep records for minors until they turn twenty-five. If you're unsure about how your current setup complies with UK rules, you should contact a professional legal advisor or your insurance provider for advice.