GDPR for freelancers: what you really must arrange with client data
Written by Ilias Aarrass6 min read · Published on · Last reviewed on 
In short
A sole proprietorship falls under the GDPR too: record which personal data you process, publish a privacy statement, sign processor agreements and report a serious data breach within 72 hours.
- The processing register exemption for organisations under 250 staff does not apply to structural processing, which continuous client records always are.
- Every processing activity needs a legal basis: the contract for client records, the law for your retention duty and consent for newsletters.
- Invoices and payment details are kept for seven years under the tax retention duty, even if a client asks for deletion.
- You respond to a request for access or deletion within one month.
The GDPR applies to anyone processing personal data, regardless of company size. A client list with names, addresses and phone numbers is already a processing activity, and nearly every freelancer has one. At the same time the idea that a sole trader needs a thick privacy policy is wrong: for most entrepreneurs it comes down to five concrete things you arrange once and review annually. This article lines them up, plus the two places where freelancers usually slip: processing agreements and retention periods.
The minimum to have in place
The GDPR does not ask for paperwork for its own sake but for accountability: you must be able to show which data you hold, why, and how you protect it. For an average freelance practice with client details, quotations, invoices and a mailing list that is manageable.
- A processing register: a simple overview of what you store, why, for how long and with whom you share it.
- A legal basis per processing activity. For client records that is the contract, for your retention obligation the law, for newsletters consent.
- A privacy statement on your website, in plain language, with your contact details.
- Security proportionate to the risk: two-factor on your mail and accounting, an encrypted laptop, no client data in shared folders.
- Processing agreements with the suppliers who process data on your behalf.
Processing agreements: the most common gap
As soon as a supplier processes personal data on your instructions, you need a processing agreement with them. That reaches further than you would think: your accounting software, your mail provider, your invoicing tool, your online calendar, your newsletter service and whoever hosts your website. The good news is that nearly all of them have a standard agreement ready; you only need to accept and save it. Do that in one afternoon for all your tools and file them with your register.
The reverse also happens: you can be the processor. If you work as a freelance IT specialist inside a client's system, handle administration or payroll for others, or manage their CRM, the client is the controller and you the processor. Then the client signs an agreement with you. Do not refuse: it is standard and protects you equally, because it puts in writing where your responsibility ends.
Retention: seven years for tax, shorter for the rest
Here two rules collide, and it is the most-asked question. The GDPR says: do not keep data longer than necessary. Tax law says: keep your records for seven years. They do not contradict each other, because the statutory retention duty is itself a valid ground. So invoices, contracts and payment details are kept for seven years, even if the client asks for deletion. What falls outside it should go: recruitment data, an old newsletter list, quotations that never became assignments, or that copy of an ID document you should never have made.
A client who wants to see or delete their data has that right. You respond within a month, explaining what you hold and why part of it must remain. The request need not be a form: an email suffices. File that correspondence with your records so you can later show you responded in time.
Copies of ID documents
As a contractor you almost never need a copy of a client's or fellow freelancer's passport. For employees it is the reverse: there the copy belongs in your payroll records. If a client asks you for a copy without an employment relationship, provide at most a redacted version without the citizen service number and photo.
A data breach: what to do in the first 72 hours
A data breach is not only a hack. Emailing an invoice to the wrong recipient, losing an unlocked phone or sending a newsletter with every address in the cc field are breaches too. The rule: if there is a risk to the people involved, report it to the data protection authority within 72 hours, and with a high risk inform those people as well. If the risk is negligible, a note in your own breach register suffices.
The practical lesson lies in preparation, not in the report. Two things cut the risk enormously: two-factor authentication on your mail and accounting, and not leaving client data loose on your laptop or in your downloads folder but keeping it in one system. That is the same discipline your administration already asks for, see keeping private and business separate.
What you concretely need in place
The GDPR sounds heavier than it is for a sole trader. This is the short list, with the deadline that goes with each item.
| What | When required | Deadline |
|---|---|---|
| Privacy statement on your website | As soon as you process personal data | Before the first processing |
| Record of processing activities | For structural processing | Kept up to date continuously |
| Data processing agreement | With every party processing data for you | Before you use that service |
| Report a data breach to the regulator | When there is a risk to the people involved | Within 72 hours |
| Retaining data | Tax records versus other data | 7 years for tax, shorter for the rest |
Frequently asked questions
Does the GDPR apply to a sole trader without staff?
Yes. The law looks at the processing of personal data, not your size or legal form. What does scale are the measures: with a small client list of ordinary contact details a simple register, a privacy statement and sound security suffice.
Are company details personal data too?
Details of a legal entity are not, but a contact person's name, email address and phone number are. And with a sole trader the company details effectively coincide with the person, so treat them as personal data.
What do I risk by arranging nothing?
Fines for small businesses are rare, but the authority can enforce and clients can claim damages. More relevant in practice: larger clients routinely ask for a processing agreement and privacy statement during tenders. Without those documents you are out before your rate is discussed.
Sources
- Steps to comply with the GDPRbusiness.gov.nl · business.gov.nl
- Keeping processing recordsbusiness.gov.nl · business.gov.nl
Sources checked on
This article provides general information based on the rules known for 2026 and does not replace personal tax advice. For your specific situation, we're happy to take a look with you.
