PI-WIKI-LEG-06 · Business Ethics · reviewed 2026-10-31
Legal Compliance Standards
Critical numbers
GDPR Breach Notification72 hours from discovery to supervisory authority
Data Encryption (at rest)AES-256 (good practice; GDPR sets no algorithm)
Data Encryption (in transit)TLS 1.2 or higher (good practice)
Record Retention (consent)Set by national law; 7 years is a common choice
Consent TypeWritten, procedure-specific, time-stamped, pre-procedure
Minimum Age for Tattooing18 in the UK and many US states; no EU-wide rule
ID Verification TriggerAny client appearing under 25
Public Liability Insurance (UK/EU)No statutory minimum; £/€5M per claim is common
GDPR Maximum Fine4% of global annual turnover or €20M (higher applies)
GDPR Special-Category DataHealth data = Article 9, highest protection tier
Thailand PDPA Effective2022, health data requires explicit consent
Singapore PDPA DPO RequirementData Protection Officer required if processing personal data commercially
Do not
- Using a single generic consent form for all procedures
- Storing client health data in unencrypted email
- Relying on verbal ID confirmation without a documented check
- Not informing clients of the right to withdraw consent
- Operating without studio liability insurance
- Not updating consent forms after procedure or material changes
Applicable standards
- European Union — GDPR (EU) 2016/679
- United States — State body art licensing
- ASEAN & Asia-Pacific — Thailand