GDPR for Freelancers: What Sole Traders Must Do
If you keep a client's email address, a phone number in your contacts or a spreadsheet of leads, data protection law applies to you, even as a one-person business. The good news is that the core duties for a UK freelancer are manageable once you know them. This checklist walks you through what sole traders must do under UK GDPR. It is general information, not legal advice, so check the ICO's guidance or a professional if your situation is unusual.
Key takeaways
- UK GDPR and the Data Protection Act 2018 apply to sole traders who process personal data, including client contact details.
- Most businesses that process personal data must pay an annual data protection fee to the ICO unless they are exempt.
- You need a privacy notice, sensible security, a retention habit and a plan for breaches.
- Serious personal data breaches must be reported to the ICO within 72 hours of you becoming aware of them.
- Collect only what you need, keep it only as long as you need it and know where it lives.
Many freelancers assume data protection is a problem for big companies with marketing databases and HR departments. In reality, the law does not care how big you are. It cares whether you handle information about identifiable people. A freelance designer with a client list, a bookkeeper holding customers' financial records and a personal trainer keeping health notes are all handling personal data.
The aim of this guide is not to turn you into a compliance officer. It is to give you a short list of things to put in place, so you can answer confidently if a client, a prospect or the ICO ever asks how you handle their information.
Does UK GDPR apply to you?
Personal data is any information that relates to an identified or identifiable living person. For a freelancer, that usually includes:
- Client names, email addresses, phone numbers and postal addresses.
- Contact details of people who work at your client businesses.
- Invoices and payment records that name individuals.
- Newsletter subscribers, website enquiry forms and lead lists.
- Personal data you handle on a client's behalf, such as their customer list or staff records.
If you process any of this as part of your business, UK GDPR and the Data Protection Act 2018 apply. The purely personal exemption only covers personal or household activities, such as your own family address book. Once the data is used for your business, it is in scope.
Controller or processor?
You are a controller when you decide why and how personal data is used, for example your own client list or mailing list. You are a processor when you handle personal data purely on a client's instructions, for example a virtual assistant managing a client's inbox or a developer with access to a client's customer database. Many freelancers are both: a controller for their own business records and a processor for client work. Processors have their own duties, and clients will often ask you to sign a data processing agreement.
Pro tip
Write a one-line answer to "what personal data do I hold, and why?" for each type of data in your business. That simple list is the foundation for your privacy notice, your retention rules and your security choices.
Pay the ICO data protection fee (unless exempt)
The Information Commissioner's Office (ICO) is the UK regulator for data protection. Most organizations that process personal data, including sole traders, must pay an annual data protection fee to the ICO unless an exemption applies. The fee is tiered by the size of the organization, and the amounts are set out on the ICO website.
Some processing is exempt. For example, certain businesses that only process data for core purposes such as their own staff administration, accounts and records, or advertising their own services may not need to pay. The rules have details and conditions, so do not assume you are exempt. The ICO has a short self-assessment tool that tells you whether you need to pay.
Common mistake
Assuming that being small automatically means you are exempt from the fee. Exemptions depend on what you do with personal data, not on how much you earn. Using CCTV for business purposes, for example, can affect whether an exemption applies. Check with the ICO's tool rather than guessing.
Know your lawful basis and keep a simple record
You need a lawful basis for each way you use personal data. For most freelancers, a few bases cover almost everything:
| What you do | Likely lawful basis | Notes |
|---|---|---|
| Keeping client contact details to deliver work | Contract | Needed to perform the contract or take steps before it |
| Keeping invoices and accounting records | Legal obligation | Tax law requires you to keep records |
| Following up with past clients about similar services | Legitimate interests | Balance your interest against theirs, and offer an easy opt out |
| Sending a marketing newsletter to individuals | Usually consent | Electronic marketing rules (PECR) also apply |
The table is a simplified guide, not a ruling for your situation. If you rely on consent, keep a record of when and how people gave it, and make it as easy to withdraw as it was to give.
Write down what personal data you hold, why, your lawful basis, where it is stored and how long you keep it. A one-page spreadsheet is fine for most sole traders. If you ever face a complaint or a question from the ICO, this record shows you have thought about it.
Write a clear privacy notice
People have a right to know how you use their data. A privacy notice is how you tell them. Put it on your website, link to it from enquiry forms and newsletter sign-ups, and mention it in your terms of business or proposals.
A freelancer's privacy notice usually covers:
- Who you are. Your name, any business name and how to contact you about data protection.
- What data you collect. For example, names, contact details, project information and payment details.
- Why and on what basis. The purposes and the lawful basis for each.
- Who you share it with. For example, your accountant, cloud software providers, payment processors or subcontractors.
- How long you keep it. Your retention periods or the criteria you use.
- People's rights. Including access, correction, deletion, objection and the right to complain to the ICO.
Write it in plain English. A short, honest notice that matches what you actually do is better than a long template copied from a large company that describes processing you never carry out.
Keep personal data secure
UK GDPR expects security that is appropriate to the risk. For a freelancer, that mostly means protecting your devices and accounts. You do not need enterprise tools, but you do need good habits:
- Lock your devices. Use a strong passcode and turn on full-disk encryption on laptops and phones.
- Use a password manager and unique passwords for every business account.
- Turn on two-step verification for email, cloud storage, accounting software and anything holding client data.
- Keep software updated, including your operating system, browser and plugins on your website.
- Back up important files to a secure location, and test that you can restore them.
- Share files with care. Use access-controlled links instead of emailing sensitive documents as attachments, and remove access when a project ends.
- Watch out for phishing. A compromised email account is one of the most common ways client data leaks.
If you work in cafés or coworking spaces, be aware of who can see your screen, and avoid leaving devices unattended. Paper records count too: keep them locked away and shred them when you no longer need them.
Example
Imagine a freelance bookkeeper who receives clients' bank statements by email. She sets up a secure client portal through her accounting software, asks clients to upload documents there instead, turns on two-step verification for her email and deletes the old attachments from her inbox. Her workflow barely changes, but the risk of a leak from her mailbox drops sharply.
Keep data only as long as you need it
UK GDPR says you should keep personal data no longer than you need it for its purpose. That does not mean deleting everything the day a project ends. Tax law requires you to keep business records for a period, and you may need project files to deal with questions or claims. It does mean having a reason for each type of data you keep, and a routine for clearing out what you no longer need.
A simple approach is to set a retention period for each category in your data record, then run a clean-up once or twice a year. Delete old leads who never became clients, archive or delete finished project files you have no reason to hold, and unsubscribe people from your lists when they ask. Check HMRC's guidance on how long to keep tax records, as those periods can differ from what you would choose for other data.
Handle requests and breaches properly
Requests from individuals
People can ask for a copy of the personal data you hold about them (a subject access request), ask you to correct it, delete it or stop using it for marketing. The law sets time limits for responding, so act promptly and check the ICO's guidance for the details. As a freelancer, these requests are rare, but you should know where everything is so you can find it quickly. If you act as a processor for a client, pass requests about the client's data to them promptly.
Personal data breaches
A personal data breach is any security incident that affects personal data: a lost laptop, an email sent to the wrong person, a hacked account or ransomware. Not every breach has to be reported, but if a breach is likely to result in a risk to people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware of it. If the risk to individuals is high, you must also tell the people affected.
Keep a short log of every breach, even the ones you decide not to report, with what happened, the effects and what you did. If you are a processor, tell your client without undue delay so they can meet their own obligations.
Your GDPR checklist
- List the personal data you hold, why and where it is stored
- Check whether you need to pay the ICO data protection fee
- Note your lawful basis for each type of processing
- Publish a plain-English privacy notice and link to it from forms
- Encrypt devices, use a password manager and turn on two-step verification
- Set retention periods and diarize a twice-yearly clean-up
- Agree data processing terms with clients when you handle their data
- Write a short plan for what to do if there is a breach
Frequently asked questions
Do sole traders really need to comply with GDPR?
Yes, if you process personal data for business purposes. There is no general exemption for small businesses or sole traders. The duties scale to your risk, so a freelancer with a client list has far less to do than a company with large customer databases, but the core principles still apply.
Do I need a privacy notice if I do not have a website?
You still need to tell people how you use their data when you collect it. Without a website you can include a short privacy notice in your proposals, terms of business or email signature with a link to a document. The format is flexible; the information is what matters.
Can I email past clients about my new services?
Often you can, but electronic marketing rules (PECR) apply alongside UK GDPR. Rules differ for individuals and for business contacts, and there is a "soft opt-in" for existing customers in some cases. Always give an easy way to opt out, and check the ICO's guidance on direct marketing before you start.
What happens if I get it wrong?
The ICO can take action ranging from advice and reprimands to fines, and individuals can complain or claim compensation. For most freelancers the bigger risk is reputational: losing a client's trust after a leak. Fixing problems quickly and being open with the people affected goes a long way.
Related reading
The bottom line
GDPR for freelancers comes down to a handful of habits: know what personal data you hold, check whether you owe the ICO data protection fee, tell people how you use their data, keep it secure, delete what you no longer need and act quickly if something goes wrong. An afternoon of setup covers most of it.
This is general information, not legal advice, and guidance and fees can change. Check the ICO's website for current rules and the fee self-assessment, and speak to a data protection professional if you handle sensitive data such as health or financial information.
