GDPR
Data processor - all salon staff members handling data are data processors. Other data processers could be the companies we work with such as Phorest software & Mutu phone systems.
IF the Data Processor starts to make their own decisions on what data to collect to do with the data (i.e not following the organisation rules and polcies), they become the Data Controller and therefore liable for its security.