Does GDPR really apply to freelancers?
Yes - and most freelancers underestimate how often. UK GDPR and EU GDPR (Regulation 2016/679) apply whenever you process personal data "wholly or partly by automated means". That includes a single email address in your inbox, a customer name in a CRM, a cookie that identifies a website visitor, and any client data you touch as part of a delivery.
There is no "small business exception" in GDPR. The Information Commissioner's Office (ICO) registration fee - £40-£60 a year for most freelancers - is not optional if you process personal data for a commercial purpose.
Controller or processor? Why it matters
GDPR splits responsibilities between two roles, and most freelancers wear both hats simultaneously.
You are a controller when
You decide why and how personal data is processed. Your own customer list, your invoicing records, your marketing email list, your contact form submissions - you set the purposes, you are the controller. Controller obligations include: lawful basis, transparency (privacy notice), data subject rights, security, breach notification, ICO registration.
You are a processor when
You handle personal data on behalf of a client without setting the purposes. A copywriter writing emails to a client's subscriber list is processing data the client controls. A developer building a feature on a client's database is a processor. A bookkeeper entering invoices is a processor.
Processor obligations are narrower but specific: you must have a written Data Processing Agreement under Article 28 with each client, you must not use sub-processors without permission, and you must notify the controller of any breach "without undue delay".
What your privacy policy must include
Articles 13 and 14 of GDPR set out the minimum content of a privacy notice for the data you collect as a controller:
- Who you are and how to contact you (and your DPO if you have one).
- Categories of personal data you collect - and the source if not collected directly.
- The purposes of processing and the lawful basis for each (Article 6, plus Article 9 if you ever touch special category data).
- Recipients or categories of recipients, including any processors and sub-processors.
- International transfers and the safeguards you rely on (SCCs, adequacy decision, BCRs).
- Retention period - or the criteria you use to determine it.
- Data subject rights and the right to complain to the ICO (or relevant supervisory authority).
- Whether providing data is a statutory or contractual requirement and the consequences of refusing.
- Existence of automated decision-making, including profiling.
A privacy notice that omits any of these is technically non-compliant. Lexara's privacy policy generator walks through each requirement and produces a notice that covers all of them.
Handling client data: the four rules
- Have a written DPA in place before any personal data crosses. A signed Article 28 agreement is mandatory. If your client doesn't provide one, draft one and send it.
- Use named, specific sub-processors. If you use Google Workspace, Notion, Stripe, or any other tool that touches the client's data, name them in your privacy notice and DPA. Get the client's consent before adding new ones.
- Apply appropriate security. Article 32 requires "appropriate technical and organisational measures". For a freelancer, that's typically: full-disk encryption, MFA on all accounts touching client data, no client data on personal devices unsecured, deletion when the engagement ends.
- Notify breaches within 72 hours. If a laptop with client data is stolen, the client's phishing test catches you, or a misdirected email goes out - tell the client immediately. They have a 72-hour ICO clock.
International transfers: where GDPR bites freelancers hardest
If your client is in the UK or EU and you use any tool hosted in the US (most SaaS), you are making an international transfer of personal data. Since the EU-US Data Privacy Framework (July 2023) and its UK extension (October 2023), transfers to certified US providers are permitted under adequacy. For non-certified providers, you need Standard Contractual Clauses (SCCs).
Practical implication: when a client asks where their data is stored, you need a clear answer. Maintain a list of every tool you use and where it sits.
DPO: probably not, but designate someone
Article 37 requires a Data Protection Officer if you are a public authority, your core activities involve large-scale systematic monitoring, or your core activities involve large-scale processing of special category data. Most freelancers don't need a DPO.
You should still have a named contact for data protection - typically you, the freelancer - listed in your privacy notice and reachable from your contact form.
Fines and enforcement
GDPR fines can reach 4% of annual global turnover or €20m (£17.5m under UK GDPR), whichever is higher. In practice the ICO and EU supervisory authorities apply a calibrated approach to small operators - fines for individual freelancers are rare. But the bigger risks are downstream:
- Lost clients. Enterprise procurement teams routinely refuse to engage suppliers without a privacy notice, DPA and ICO registration.
- Indemnity exposure. Most B2B service contracts require the freelancer to indemnify the client against the freelancer's GDPR breaches.
- Reputational damage. A breach affecting a client's data is the kind of incident that ends working relationships permanently.
A 90-minute compliance starter
If you're starting from zero and want to be substantially compliant by lunchtime:
- Register with the ICO if you're UK-based and process personal data (5 minutes).
- Write a privacy notice covering the Article 13/14 requirements above (30 minutes - or 5 minutes with Lexara's generator).
- List the tools you use that touch personal data and confirm each has GDPR safeguards in place (15 minutes).
- Draft a template DPA you can send to clients who don't have their own (15 minutes).
- Turn on MFA on every account that touches client data (15 minutes).
- Document a basic breach response - who you call, what you tell them, when (10 minutes).
That's the foundation. Iterate from there as your client mix and the data you handle change.