The paperwork every tattoo artist needs

The short version: paperwork is the least glamorous part of tattooing and the part most likely to save your livelihood. In Germany, the right forms are not bureaucratic box-ticking: they're what stands between you and a charge of bodily harm, a data-protection fine, and a claim your insurance won't cover because you never had any. This guide walks through the documents every artist working in Germany or the EU should have in place, what legally has to be in them, and how long to keep them. Get this built once, properly, and it protects you for your whole career.

A caveat: this is general information, not legal advice. German tattoo law, the GDPR, and retention rules are detail-heavy and carry real penalties, so have a lawyer and, ideally, a data-protection advisor set up your actual forms. If you have a partner attorney, this is exactly what they're for.

Ready-made templates. GoldSeam offers most of the forms below as branded, bilingual (DE/EN) PDFs on the document downloads page, free to adapt, lawyer-review still required.

1. The consent and disclosure form, your cornerstone

Everything starts here, and it starts with a fact most clients never realise: under German law, pushing a needle into someone's skin meets the definition of bodily harm (Körperverletzung, § 223 StGB). The only thing that makes it lawful is the client's informed consent (§ 228 StGB). Your consent form is the document that proves that consent existed, but only if a genuine consultation (Aufklärungsgespräch) actually happened first. The form records the conversation; it doesn't replace it.

A solid form has three jobs: disclose the procedure and its risks, capture the health information, and record the signed consent. The contents that belong in it:

• Identity and date. Client's name, date of birth, address; the artist and studio; the date.
• Confirmation of the consultation. That risks, the process, the materials, and aftercare were explained, and that all questions were answered.
• Risk disclosure. Pain and bleeding; swelling, redness, possible scarring; infection; allergic reactions, especially to coloured and red inks; the fact that pigment migrates to the lymph nodes and that long-term effects can't be fully ruled out by current science; photosensitivity and UV reactions; natural fading and ageing; that the result can deviate from the stencil because of skin; and the heightened risks of cover-ups, scars, and stretch marks.
• The insurance note. Under § 52(2) SGB V, a statutory health insurer can seek partial cost recovery from the client if a self-chosen cosmetic procedure causes complications, worth stating so clients understand the stakes.
• The health questionnaire (its own section below).
• Confirmation that written aftercare was received.
• A truthfulness declaration, signature, and date.

Here's the part that even experienced artists get wrong, and it matters: the blanket "I release the artist from all liability" clause you see on many template forms does not actually protect you from your own mistakes. Consent legitimises the intended, properly performed tattoo; it does not let you contract away liability for your own negligence, a hygiene failure, or malpractice. You cannot sign away someone's right to claim for harm you caused by doing the job badly. So don't treat the waiver as armour. Your real protection is doing the work correctly and carrying insurance (more on that at the end).

A practical tip: the German tattoo association (BVT) offers a lawyer-drafted consent form, and it deliberately leaves out commercial terms like pricing, deposits, and no-show policy. Those belong in a separate studio contract, ideally customised for you by a lawyer. Keep the medical-legal consent and the business contract as two distinct documents.

2. The health questionnaire: legally radioactive, handle with care

The health questions feel routine, but legally they're the most sensitive thing in your studio. Allergies, medications, chronic conditions, pregnancy, blood thinners, skin conditions: all of that is health data, which the GDPR treats as a "special category" under Article 9. Processing special-category data is generally prohibited, allowed only under a narrow set of exceptions. The one you rely on is the client's explicit consent (Art. 9(2)(a)), and European case law is clear that you need both that Article 9 ground and an ordinary Article 6 ground (such as performing the contract). So the consent to process health data has to be explicit, specific, and name the data category and purpose; a general "I agree to the terms" isn't enough.

Three consequences flow from that:

• Heightened security is mandatory, not optional. Your protective measures for these forms must be demonstrably stronger than for ordinary data: locked cabinets for paper, restricted access (only the people who genuinely need it), encryption if you ever transmit them. Document this in your record of processing.
• Ask only what you need. Data minimisation applies hard here: collect what's relevant to tattooing safely, and nothing more. Don't hoard medical histories you'll never use.
• A large-scale, systematic processing of health data can trigger a data-protection impact assessment (DPIA, Art. 35); a single-chair studio's routine intake usually won't, but it's worth checking with an advisor rather than assuming.

3. Age verification

As covered in our tattoo law guide, Germany has no fixed statutory minimum age, since the validity of consent turns on the young person's maturity, which is exactly why almost every studio draws a hard line at 18. For your paperwork: check photo ID and record the date of birth for everyone. Where you do tattoo an older minor, keep the guardian's written consent, have the guardian present, and take a copy of the guardian's ID. Be aware that a parental signature carries less legal weight than people assume, since it can't manufacture the minor's own capacity to consent, but it documents good faith and protects you practically. Under-14s, in practice, never.

4. The aftercare sheet

Give every client written aftercare instructions, and record on the consent form that they received and understood them. This is genuinely protective, not just polite: a meaningful share of "the studio's fault" infections actually happen at home during healing. A signed line confirming the client got clear aftercare guidance is your evidence that you did your part, and it cuts down the anxious "is this normal?" messages, too.

5. Data protection for client data: the GDPR baseline

Beyond the health questionnaire, you're handling names, contacts, photos, and booking data, which makes you a data controller with a set of standing duties. The essentials:

• A legal basis for each use: contract performance for delivering the tattoo, explicit consent for the health data, and a separate consent for using photos of the work in marketing.
• Information at collection (Art. 13): tell clients who you are, why you're processing their data, the legal basis, who else sees it (your booking software, email tool, etc.), how long you keep it, and their rights, including the right to complain to a supervisory authority. In practice this lives in a privacy policy (Datenschutzerklärung) on your site, referenced on the form.
• A record of processing activities (Art. 30): a living internal document listing your processing purposes, data categories, recipients, and security measures. It has no "expiry"; you keep it current and produce it if an authority asks.
• A processor agreement (AVV) with every service that touches client data: booking systems, email platforms, cloud storage. Prefer EU-hosted providers, and be cautious with US tools (the CLOUD Act complicates things).
• Security measures (Art. 32) appropriate to the data, stricter for the health information.
• Data-subject rights: clients can request access (Art. 15), deletion (Art. 17), and withdraw consent at any time, as easily as they gave it (Art. 7(3)). On withdrawal you stop future processing, for example pulling their photo from your feed, though data you're lawfully required to retain can stay until that period ends.

One reassurance: a formal data-protection officer (Datenschutzbeauftragter) is generally only mandatory once you have around 20 people continuously engaged in automated data processing, or for certain high-risk processing, so a small studio usually doesn't need one. Still worth confirming for your specific setup.

6. How long to keep it: the retention tension

This is where artists get genuinely confused, because two principles pull in opposite directions. GDPR data minimisation says delete when you no longer need it. But your consent and health forms are your defence evidence if a client ever brings a claim, so you want them for as long as a claim is possible. Squaring those is a judgement call, not a single fixed number:

• Business records (invoices, accounting documents) have their own statutory retention under tax and commercial law: historically up to ten years, recently shortened for some accounting vouchers to eight. Confirm the current figures with your tax advisor.
• Consent and health forms are driven by liability, not tax. Ordinary civil claims time-bar after about three years, but personal-injury claims carry a long-stop that can run up to thirty years regardless of when the harm is discovered. Because of that long tail, many studios keep consent and health records for around ten years as a pragmatic compromise, but the right figure for you is a decision to make with your lawyer, not a number to copy off a template.

Whatever period you choose, store the forms securely the entire time and delete them reliably at the end. "We keep everything forever in a drawer" is its own GDPR problem.

7. Liability insurance

Finally, the document that does what the consent waiver legally cannot. Professional/business liability insurance (Betriebshaftpflicht) isn't strictly required by law to operate, but it's essential, and landlords and studios renting you a chair will often demand proof of it before you start. As the person doing the work, you carry full legal liability, and even slight negligence, like an infection traced to technique or damage to a client's property, can produce claims large enough to end your business. A good policy covers third-party personal injury and property damage from your professional activity, the cost of expert assessors, and crucially your legal defence, including fending off unjustified claims. Remember the connection: your consent form documents that the client agreed to the tattoo; your insurance covers the fault that no form can ever waive. You need both.

The bottom line

The paperwork kit is small and you build it once: a lawyer-checked consent-and-disclosure form with the health questionnaire, a written aftercare sheet, solid ID and minor-consent practice, a GDPR setup (privacy policy, record of processing, processor agreements, secure storage) that treats health data with the extra care the law demands, a sensible retention period decided with your advisors, and real liability insurance behind all of it. None of it is exciting. All of it protects you, and a client who's handed a clear, professional consent form quietly trusts you more, not less. Set it up properly, store it securely, and then get back to the part you actually came to do.

Key Takeaways

• A tattoo is legally bodily harm made lawful by informed consent, so the consent-and-disclosure form is your cornerstone.
• A blanket "release from all liability" clause does not protect you from your own negligence.
• Health questionnaire answers are special-category data under GDPR Article 9 and need explicit consent and stronger security.
• Verify age and record date of birth for everyone; almost every studio requires clients to be 18.
• Give written aftercare and record on the consent form that the client received it.
• Retention is a judgement call: many studios keep consent and health forms for around ten years.
• Business liability insurance covers the fault no consent form can waive, so you need both.

Sources

• § 52 SGB V, Leistungsbeschränkung bei Selbstverschulden (gesetze-im-internet.de)
• Art. 9 GDPR, processing of special categories of personal data
• § 38 BDSG, designation of a data protection officer (gesetze-im-internet.de)