Regards recording evidence of patch testing, just ask your insurer how they would like it done. They may be satisfied with a note on the record card or on your computer system stating when the test was carried out and not require the client to sign any documentation.
Data Protection law is pretty straightforward. It's about keeping accurate records securely and not disclosing client details to third parties. If you are a member of a trade association, they can usually offer training & advice in this area. Otherwise, local authority advice centres, Citizens Advice etc. can provide guidance for self employed stylists and salon owners.