Freelance client onboarding: a checklist from yes to kickoff (with a welcome email to copy)

Onboarding is everything between the client saying yes and the real work starting: the agreement, the deposit, billing details, access to their tools, how you'll communicate, and a kickoff. Here's a step-by-step checklist, what usually goes in a contract vs a statement of work, how to ask for access safely, the communication norms worth agreeing up front, and a welcome email, an access request and intake questions you can copy.

The official rules mentioned (written freelance contracts in New York City, New York State and Illinois, data-processing contracts under the EU GDPR, UK GDPR and Canada's PIPEDA, and UK NCSC advice on shared access) were checked against official pages on 2026-10-14. The onboarding steps, the contract vs statement-of-work split, the communication norms and the kickoff agenda are general practice, not something those pages define. Not written by a lawyer.

The short answer

• Get the agreement in writing first: scope, timeline, price, payment terms and who signs off. Some places require it: New York City for freelance contracts of $800 or more (NYC DCWP), Illinois for work worth $500 or more (Illinois DOL).
• Invoice the deposit on acceptance and start when it's paid (our deposits and retainers guide).
• Collect billing details once: the legal name and address to invoice, the billing contact, any purchase order number, and tax forms the client needs (a US client may ask for a Form W-9).
• Ask for your own login, not a shared password, with only the access the work needs. The UK's NCSC: "Delegation should be used instead of sharing accounts wherever possible." (NCSC).
• Agree how you'll communicate: channels, response times, working hours and time zones, how feedback and approvals are given.
• Hold a short kickoff and send a written recap.

1. The onboarding steps, in order

This order is general practice, not a rule. Small jobs can merge steps; big ones may add a discovery phase.

2. The agreement: contract and statement of work

General practice: a contract (or master services agreement) holds the terms that stay the same from job to job; a statement of work (SOW) describes one job. A small freelance job often has one document doing both — a signed proposal or quote with terms can be enough. These are common labels, not legal definitions.

Where a written contract is required. New York City's page says freelance contracts worth $800 or more (including agreements adding up to that in any 120-day period) must be in writing and spell out the work you will perform, the pay for the work and the date you get paid; "You and the hiring party must keep a copy of the written contract." (NYC DCWP). New York State has a statewide law since August 28, 2024 (General Business Law, Article 44-A; NY DOL). Illinois: work worth $500 or more in a 120-day period needs a written contract listing: name and contact information of both the hiring entity and freelance worker, itemization of products and services, rate and method compensation, date of compensation due and dates of services to be provided (Illinois DOL). Its FAQ adds: "A contract does not necessarily have to follow a certain format in order to be valid, and can include a paper document, an email, text message, or some other communication that describes goods or services that the freelance worker promises to provide in exchange for payment from the contracting entity, that both parties (freelance worker and contracting entity) have agreed to." and "The contracting entity must provide a written contract to the freelance worker upon the freelance worker's request." (Illinois DOL FAQ). Elsewhere, a written agreement is still the simplest way to avoid arguments later.

3. Deposit before you start

• Invoice it when the client accepts, and make it due before work starts. Our deposits and retainers guide covers how much, how to credit it on the final invoice, refundability, and GST/HST and UK VAT notes.
• Put the payment terms on the first invoice exactly as agreed (see invoice payment terms explained).
• Say what "start" means: the date you begin once the deposit clears, not the date the contract was signed.

4. Billing details to collect

Ask once, at the start, so the first invoice isn't held up. General practice:

• the legal name and address to put on invoices (often not the brand name you know them by);
• the billing contact or accounts-payable email, and who approves invoices;
• a purchase order (PO) number, if they use them, and whether it must appear on every invoice;
• any supplier or vendor form, and the tax details they need from you. A US client paying you may ask for a Form W-9, "Request for Taxpayer Identification Number and Certification" (IRS: About Form W-9; our guide to it). In the UK or Canada, your VAT or GST/HST registration number goes on the invoice if you're registered.
• the currency you'll invoice in, and how they pay (bank transfer, card, platform).

5. Access to the client's tools and files

• Your own login, not a shared one. The UK's National Cyber Security Centre (NCSC): "Delegation should be used instead of sharing accounts wherever possible." If a password really must be shared: "the password should only be shared within the smallest possible group of known and trusted users" (NCSC: Password policy, shared access).
• Only the access the work needs (general practice): an editor role on one site, not admin on the whole account; one shared folder, not the whole drive.
• Turn on two-step verification on any account you use for the client. The NCSC: "Turning on 2SV is one of the most effective ways to protect online accounts when passwords are still in use, as it helps prevent criminals from gaining access even if they know the password." (NCSC: Secure your important online accounts).
• Keep a short access list: tool, account, permission level, who granted it and when. It makes the end of the project easy.
• At the end, ask the client to remove your access and tell them when you've deleted their files. If a shared password was used: "if someone is no longer allowed access, the password should be changed" (NCSC).

6. If you'll handle personal data

If the work means handling personal data the client is responsible for (their customers' emails, a member list, staff records), data-protection law may treat the client as the controller and you as a processor, and may require a contract. Ask early — it's one of the intake questions below.

Page dates on the check date: EUR-Lex Official Journal L 119, 4.5.2016; ICO latest update 2023-05-19; Justice Laws 2026-09-28; NCSC password policy reviewed 2018-11-19; NCSC small organisations guide reviewed 2026-07-21.

7. Communication norms to agree

General practice. Most onboarding trouble is about expectations nobody said out loud. Agree these in the kickoff and put them in the recap:

8. The kickoff

A short call (or a written kickoff for small jobs). A simple agenda, as general practice:

1. Goals: what the client wants to be true when this is done.
2. Scope recap: deliverables, what's out of scope, and the change-request route.
3. Timeline: milestones, the client's feedback dates, and any fixed dates.
4. People: who decides, who gives feedback, who pays invoices.
5. Access and files: what's been granted, what's still missing.
6. Communication norms (above).
7. Next steps: who does what by when.

Afterwards, send a recap email with the decisions and dates. If anything differs from the agreement, fix it in writing now, not at invoice time.

9. Emails and questions you can copy

Replace everything in [brackets] and delete what doesn't apply.

Welcome email (send on the yes):

Subject: Welcome aboard — next steps for [project name]

Hi [client first name],

Thanks for choosing me for [project name]. Here's what happens next so we can start on [start date]:

- Agreement: I've attached [the contract / the statement of work] covering scope, timeline, price and payment terms. Please sign or reply "Approved" by [date].
- Deposit: the deposit invoice ([amount and currency], due [date]) is attached. Work starts once it's paid.
- Details: please reply with the billing contact, the legal name and address for invoices, any purchase order number, and anything your accounts team needs from me.
- Access: I'll need [list of tools or files]. Please invite me as a user of my own (not a shared login), with only the access this project needs.
- Kickoff: could we meet for [length] on [two or three time options, with time zone]? I'll send a short agenda.

Day to day I'll use [email / tool] for updates and reply within [response time] during [working hours and time zone]. For anything urgent: [how].

Looking forward to it,
[your name]

Access request:

Subject: Access for [project name]

Hi [name],

To start on [date], I'll need:
- [tool or account]: [role or permission level], invited to [your work email]
- [shared folder or files]: [view / edit]
- [anything else]

Please add me as my own user rather than sharing a password, and only with the access this work needs. I'll tell you when I'm done so you can remove it.

Thanks,
[your name]

Intake questions:

Before we start — a few questions
- Who signs off the work, and who else should be copied on updates?
- What does "done" look like for you? Any examples you like or dislike?
- Which dates are fixed (launches, events, board meetings)?
- Where should files and feedback go: [email / shared folder / tool]?
- Which brand, style or technical guidelines should I follow? Please send them or point me to them.
- Will I see any customer or staff personal data? If so, which, and is there a data processing agreement to sign?
- How do invoices get paid on your side: who approves them, and do you need a purchase order number on each one?
- Anything that went wrong with a past freelancer or agency that you'd like to avoid?

10. The checklist

• Yes in writing and a reply with next steps.
• Agreement signed (contract and/or SOW, or a signed proposal with terms); both sides keep a copy.
• Deposit invoiced and paid before work starts (or agreed otherwise in writing).
• Billing details: legal name, address, billing contact, PO number, tax or supplier forms.
• Access: own user accounts, least access needed, two-step verification on, access list kept.
• Personal data: asked whether you'll handle any; data processing terms signed if needed.
• Intake answers and files received.
• Kickoff held, recap sent with decisions, dates and communication norms.
• Project set up on your side: tasks, due dates, a time log if you bill hourly (our timesheet), the first check-in date.
• At the end: final invoice, access removed, files returned or deleted as agreed.

Free tools and kits

• Free quote and estimate generator: the quote the client says yes to, with a deposit and a valid-until date.
• Free invoice generator: the deposit invoice, any currency (runs in your browser; nothing is saved).
• Free timesheet: log hours from the first day.
• How to write a freelance proposal: an outline to copy, so the agreement is mostly written before onboarding starts.
• Our paid Quote & Proposal Kit by Small Rows (US$12, one-time) prints a two-page proposal with scope, timeline, terms and a signature block, so what the client signs is where onboarding starts. It doesn't write a contract for you or decide what's binding.
• Our paid Client & Project Tracker by Small Rows (US$12, one-time) keeps the new client with a next follow-up date, the project with start and due dates and budget hours, and each onboarding step (agreement signed, deposit paid, access granted, kickoff held) as a task with a due date; its dashboard shows overdue tasks and follow-ups. It has no built-in onboarding template and no money tracking.
• Our paid Freelance Billing Kit by Small Rows (US$12, one-time) keeps each client's details and payment terms (including a deposit note), gives every invoice a due date, and shows what's paid, part paid, open or overdue.
• All three kits together: the All-Kits Bundle by Small Rows (US$24, one-time).

Where the sources differ

We read the pages under Sources on 2026-10-14 (New York, Illinois and IRS pages for our earlier guides). A few details to watch:

• Written-contract thresholds differ. New York City: $800; Illinois: $500 (both over a 120-day period). We haven't checked freelance written-contract laws in other places.
• EU vs UK GDPR. Both require a written processor contract; the ICO says its UK guidance is under review after the Data (Use and Access) Act, so check the live page.
• Canada asks for "comparable" protection. PIPEDA clause 4.1.3 says "contractual or other means", not a list of clauses like GDPR Article 28.
• Old but current pages. The NCSC password policy page was last reviewed 2018-11-19; its small organisations guide 2026-07-21. Both were current on the check date.
• No official "onboarding" or "SOW" definition on the pages we read; those parts are general practice.

When to get legal advice

• the client sends its own long contract, especially with ownership, liability, non-compete or indemnity clauses;
• you'll handle personal data, or sensitive data of any kind;
• you and the client are in different countries and it's unclear whose law applies;
• the job is large, long or risky for your business;
• the client wants work to start before anything is signed or paid.

Related free resources

• How to write a freelance proposal: the document that usually comes before onboarding.
• Freelance deposits and retainers explained: the first invoice of a new client relationship.
• Invoice payment terms explained: Net terms, due on receipt, milestones and late fees.
• Scope creep and change requests: when the client asks for more after kickoff.
• How to track multiple client projects: a spreadsheet for deadlines, tasks and hours once the work starts.
• Form W-9 for US freelancers: often the first form a US client asks for.
• Getting paid on time as a freelancer in Canada: terms, late fees and reminder emails.
• All free tools.

Sources

Official pages read on 2026-10-14. Check the live page before you rely on it. New York, Illinois and IRS pages were read for our proposal and Form W-9 guides.

• European Union: EUR-Lex: General Data Protection Regulation
• United Kingdom: ICO: Contracts (controllers and processors) · NCSC: Password policy, updating your approach · NCSC: Secure your important online accounts
• Canada: Justice Laws: Personal Information Protection and Electronic Documents Act
• New York and Illinois (written freelance contracts): NYC DCWP: Freelance workers · NY DOL: Freelance Isn't Free Act · Illinois DOL: Freelance Worker Protection Act · Illinois DOL: FAQ
• United States (tax form): IRS: About Form W-9

Found something wrong or out of date? Tell us via Support and we'll fix it and note the change here.