Guide · Any country · Running the business

Data protection for freelancers: handling client personal data (UK, Canada, US)

You hold names, emails and notes about your clients, and sometimes whole customer lists from a client's files. What do you actually have to do about it as a one-person business? Here's a plain answer, with what the UK's ICO, Canada's privacy commissioner and the US Federal Trade Commission actually say.

General information, not legal advice. Not written or reviewed by a lawyer. The tables of client data and the data map, and all the wording to copy, are ours; the official items come from the UK, Canadian and US pages linked below. They are general rules and guidance for businesses of any size, and none of them is a freelance law. The EU and other countries were not checked. Official pages were read on 2026-10-16.

The short answer

If you work with information about people (client contacts, a client's customer list), data protection law very likely applies to you, however small you are.
Work out your role: for your own clients' details you usually decide what happens to the data; for people in a client's files you usually act on the client's instructions. The duties differ.
UK: unless an exemption applies, you pay the ICO an annual data protection fee, and you tell people what you do with their data in a privacy notice.
Everywhere: know what you hold, keep only what you need, protect it, and delete it when you're done.
If data is lost or exposed, act fast: the UK expects a report to the ICO within 72 hours when one is needed; Canada expects a report to its privacy commissioner as soon as feasible when there's a real risk of significant harm; in the US, state breach-notification laws may apply. If it's a client's data, tell the client straight away.
Keep a short record of every incident, even ones you don't have to report.

1. Does data protection law apply to you?
2. Controller or processor: whose data is it?
3. UK: the ICO data protection fee
4. Tell people what you do with their data
5. Keep it safe
6. Keep only what you need, then delete it
7. When someone asks for their data
8. If something goes wrong: data breaches
9. Make a simple data map
10. Wording to copy
11. Checklist
Free tools and kits
Where the sources differ
When to get legal advice
Related
Sources

1. Does data protection law apply to you?

Where	What the official page says
United Kingdom (UK GDPR, ICO)	"The law applies from when personal data is collected, and covers companies of all sizes from sole traders and people who work for themselves through to large global corporations." "Personal data is information that relates to or identifies an individual." Exempt, among others: "information that you use for purely personal, family or household purposes, rather than for your business or services." The ICO's tip: "It’s a good idea to keep any information that is to do with your business separate from personal files such as birthday reminders, family celebrations and personal finances." (ICO: Data protection advice on common topics, no page date shown).
Canada (PIPEDA, OPC)	"PIPEDA applies to private-sector organizations across Canada that collect, use, or disclose personal information in the course of a commercial activity." Provinces: "Organizations that are subject to a substantially similar provincial privacy law are generally exempt from PIPEDA with respect to the collection, use, or disclosure of personal information that occurs within that province." Across borders: "All businesses that operate in Canada and handle personal information that crosses provincial or national borders in the course of commercial activities are subject to PIPEDA, regardless of the province or territory in which they are based (including provinces with substantially similar legislation)." (OPC: PIPEDA requirements in brief, page date 2024-05-01). Which provincial laws apply to you, including Quebec's, we did not check.
United States (FTC)	We did not check US federal or state privacy laws for this page. The FTC's business guide is guidance, not a law: "Regardless of the size—or nature—of your business, the principles in this brochure will go a long way toward helping you keep data secure." (FTC: Protecting Personal Information, A Guide for Business, no page date shown).
Elsewhere	We have not checked other countries, including the EU GDPR's own rules for freelancers based in the EU.

The client data a freelancer typically holds (our examples, not an official list):

Kind	Examples	Where it tends to sit
Your own clients’ details	Names, emails, phone numbers, billing addresses of sole-trader clients, notes from calls.	Email, your client tracker or spreadsheet, invoices, your phone’s contacts.
People in your clients’ files	A client’s customer list, newsletter subscribers, staff records, form responses, photos of people.	Shared drives, exports on your laptop, tools the client gave you access to.
Payment and tax details	Bank details on invoices, a client’s tax form, receipts that name people.	Your accounting files, downloads folder, email attachments.
Enquiries and leads	Contact-form messages, people who asked for a quote and never hired you.	Website form inbox, email, notes.

2. Controller or processor: whose data is it?

The ICO's small-business glossary puts it like this (ICO: Data protection principles, definitions and key terms, no page date shown):

Controller: "You’re a data controller if you’re the main decision-maker when it comes to how people’s personal information is handled, and how it’s kept safe." "Controllers can be a limited company, an organisation, charity, association, club, volunteer group or business of any size – including sole traders and people who work for themselves."
Processor: "You’re a processor if you’re only acting on behalf of the instructions of a controller – if a business has hired you to process their mail, for example." "However, you do have responsibilities to protect the personal data that you’ve been trusted with and to use it appropriately in-line with your contract with the controller."

For most freelancers that means: your own clients' contact and billing details are yours to look after as a controller; a client's customer list that you work on for them is usually the client's, with you as processor. In Canada, the OPC says that when information is handed to a processor, "Therefore in this context, we find it reasonable to interpret the principal organization as having control of the personal information and therefore responsibility for breach reporting in respect of a breach that occurs with the third party processor." (OPC: mandatory reporting of breaches of security safeguards).

If you'll handle a client's personal data as its processor, the client may need a written contract with you. The official wording (EU GDPR, ICO, PIPEDA) is in our client onboarding guide, section on personal data, and the clause belongs in your contract or statement of work.

3. UK: the ICO data protection fee

"You must pay a data protection fee to the Information Commissioner’s Office (ICO) if you’re a business, organisation or sole trader processing personal data, unless you’re exempt." "The annual fee depends on your size and turnover. It’s £52 or £78 for most organisations, including charities and small and medium-sized businesses." (GOV.UK: Pay the data protection fee, page date 2018-06-01).
The rule comes from the Data Protection (Charges and Information) Regulations 2018: "Under the Data Protection (Charges and Information) Regulations 2018, organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt." The ICO's fee self-assessment tells you whether you need to pay and how much (no page date shown).
"Not all controllers must pay a fee. Many can rely on an exemption." (ICO: Guide to the data protection fee, no page date shown). "Generally speaking, you have to pay a fee if you are processing personal data as a controller." "You don’t need to pay a fee if you are processing personal data only for one (or more) of the following purposes:"
- Staff administration.
- Advertising, marketing and public relations.
- Accounts and records.
- Not-for-profit purposes.
- Personal, family or household affairs.
- Maintaining a public register.
- Judicial functions.
- Processing personal information without an automated system such as a computer.
The list also covers members of the House of Lords and elected representatives. "But even if you are exempt from paying a fee, you still need to comply with your other data protection obligations." (ICO: Exemptions, no page date shown).
Not paying when you should: "If you need to pay and don’t pay, you could be fined." (ICO: Data protection fee, what you need to do, no page date shown). "The maximum penalty is a £4,350 fine." (ICO: Penalties, no page date shown).
Working from home: "Information including your organisation’s name and address will appear on the data protection public register." "If you run your business from home and do not want your home address to appear on the public register, provide a PO box or alternative address instead." (GOV.UK).
"Aside from the data protection fee, there aren’t any other set costs for compliance." (ICO: common topics).

The exemptions cover processing only for the listed purposes. Whether all of your work fits them depends on what you do with the data, so take the self-assessment rather than assuming you're exempt. Canada and the US have no equivalent fee on the pages we read.

4. Tell people what you do with their data

UK: "You need to let people know what you're doing with their data. The easiest way to do this is to have a privacy notice available, either in a hard copy or on your website (if you have one)." Using a ready-made one? "If you choose this route over making your own, be aware that you still need to know what it says." (ICO: Data protection when it’s just you, tips for sole traders, no page date shown).
UK, why you hold it: "Whenever you collect or use personal information, you must have a valid reason for doing so. This reason is known as a ‘lawful basis’." The ICO lists the lawful bases as: consent, contract, legal obligation, vital interests, public task, legitimate interests (ICO: key terms). Our reading, not the ICO's wording: for client work, contract and legal obligation (tax records) are the usual starting points; marketing emails to people who aren't clients need more care, which we did not check.
Canada: "Businesses that are subject to the Act must follow these 10 fair information principles to protect personal information, which are set out in Schedule 1 of PIPEDA." The principles are: Accountability; Identifying purposes; Consent; Limiting collection; Limiting use, disclosure, and retention; Accuracy; Safeguards; Openness; Individual access; Challenging compliance (OPC: PIPEDA requirements in brief). Openness and identifying purposes are the closest to a privacy notice.
US: we did not check whether any law requires a privacy notice for your business.

A short notice to adapt is in the wording to copy below. Put it on your website, or send it with your first quote.

5. Keep it safe

UK: "You have to protect people’s data from getting lost or falling into the wrong hands." The ICO's simple measures for sole traders:
- storing paperwork in a locked cabinet or container
- making sure your door and window locks are working and used
- never leaving anything in a vehicle unattended
- putting strong passwords on all of your devices
- keeping your system’s anti-virus software up-to-date
- separating your business email account from your personal email account, rather than using the same one
- being extra vigilant when sending or receiving emails – to help prevent sophisticated phishing attempts and scams
"If you use, store or share lots of data, or particularly sensitive personal data like health or political information, then you need to take some extra steps to keep it safe." (ICO: tips for sole traders). Its security checklist: "By law you must keep personal data secure." "What’s appropriate depends on the risk to people if something goes wrong. The bigger the risk, the more you need to do to protect the data." "You should keep back-up copies of electronic information and systems." (ICO: How secure is your personal data?, no page date shown).
Canada: Schedule 1, clause 4.7: "Personal information shall be protected by security safeguards appropriate to the sensitivity of the information." Clause 4.7.3: methods should include
- physical measures, for example, locked filing cabinets and restricted access to offices;
- organizational measures, for example, security clearances and limiting access on a “need-to-know” basis; and
- technological measures, for example, the use of passwords and encryption.
(Justice Laws: Personal Information Protection and Electronic Documents Act, page date current to 2026-09-21, last amended on 2025-03-04).
US (FTC guidance): the FTC's five principles:
- TAKE STOCK. Know what personal information you have in your files and on your computers.
- SCALE DOWN. Keep only what you need for your business.
- LOCK IT. Protect the information that you keep.
- PITCH IT. Properly dispose of what you no longer need.
- PLAN AHEAD. Create a plan to respond to security incidents.
On subcontractors and tools: "Put your security expectations in writing in contracts with service providers." (FTC: Protecting Personal Information).

Logins to a client's systems: use your own account, not a shared password, with two-step sign-in; see client onboarding, access.

6. Keep only what you need, then delete it

UK: "Data minimisation – limit the amount of personal data you collect to what you need." "Storage limitation – only keep personal data for as long as you need it. When you no longer need it, it should be securely destroyed or deleted." (ICO: key terms).
Canada: clause 4.5.3: "Personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous." (Justice Laws: PIPEDA).
US (FTC guidance): "If you don’t have a legitimate business need for sensitive personally identifying information, don’t keep it. In fact, don’t even collect it." (FTC: Protecting Personal Information).

Tax rules can make you keep invoices and records for years; that is a reason to keep those records, not everything else. See how long to keep records. At the end of a project, return or delete the client's files and confirm it: wrap-up, access and what to archive.

7. When someone asks for their data

UK: "As a small business or SME, the four main rights you’re likely to come across are the right of access, the right to object, the right to be informed, and the right to erasure." "The right of access is when someone asks you for a copy of the data you have on them. This is also known as a subject access request - or SAR – and you have one month to deal with a SAR." (ICO: key terms).
Canada: section 8(3): "An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request." (Justice Laws: PIPEDA). We did not check the extensions and exceptions in the rest of that section.
US: not checked; some state laws give access rights, and we did not check which apply to small businesses.
If the data is a client's (you're its processor), pass the request to the client quickly rather than answering it yourself, unless your contract says otherwise.

8. If something goes wrong: data breaches

A lost laptop, an email to the wrong person, a hacked account. First contain it, then work out whether it has to be reported. What each official page says:

Where	What the official page says
United Kingdom (ICO)	"By law, you've got to report a personal data breach to the ICO without undue delay (if it meets the threshold for reporting) and within 72 hours." "You might end up not needing to report it, but start a log anyway, to record what happened, who is involved and what you’re doing about it." Telling the people affected: "If you think there’s a high risk, then by law you have to tell them without undue delay." (ICO: How to respond to a personal data breach, for small organisations, no page date shown). The full guide: "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it." "You must also keep a record of any personal data breaches, regardless of whether you are required to notify." Processors: "If your organisation uses a data processor, and this processor suffers a breach, then under Article 33(2) it must inform you without undue delay as soon as it becomes aware." (ICO: Personal data breaches, a guide, page date 20 August 2025).
Canada (PIPEDA, OPC)	Section 10.1(1): "An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual." Section 10.3(1): "An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control." (Justice Laws: PIPEDA). Breach of Security Safeguards Regulations, section 6(1): "For the purposes of subsection 10.3(1) of the Act, an organization must maintain a record of every breach of security safeguards for 24 months after the day on which the organization determines that the breach has occurred." (Justice Laws: Breach of Security Safeguards Regulations, page date current to 2026-09-21, last amended on 2018-11-01). The OPC: "Yes. Large and small business will be subject to PIPEDA requirements to report and notify breaches of security safeguards that pose a real risk of significant harm, and to keep records of all breaches of security safeguards." "The law requires that notification to individuals be given as soon as feasible after you have determined that a breach of security safeguards involving a real risk of significant harm has occurred." "The law requires you to keep breach records of all breaches of security safeguards for two years." "As a starting point, we would expect at minimum a record to include:" date or estimated date of the breach general description of the circumstances of the breach nature of information involved in the breach whether or not the breach was reported to the Privacy Commissioner of Canada/individuals were notified (OPC: mandatory reporting of breaches of security safeguards, page date 2025-08-11).
United States (FTC)	"All states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information." "Check state and federal laws or regulations for any specific requirements for your business." (FTC: Data Breach Response, A Guide for Business, no page date shown). We did not check any state's law.
Elsewhere	Not checked.

If the data is a client's, the client usually decides whether to report and whom to tell: the ICO page above says a processor must inform the controller under Article 33(2), and the OPC treats the principal organization as responsible for reporting. Tell the client at once (an email to copy is below) and keep your notes. PIPEDA section 10.1(3) covers notifying the people affected; we quote the OPC's summary of it rather than the section itself.

9. Make a simple data map

The ICO's first tip for sole traders: "Even if you don’t think you use or keep a lot of data, you still need to know what personal data you have, so make a quick list of it if you haven’t already." (ICO: tips for sole traders). The FTC's is "take stock". Our suggested columns, one row per kind of data (general practice, not an official template):

Column	What to write
What it is	For example: client contact details, a client’s customer list, invoices.
Whose data, and your role	Your own clients (you decide what happens to it) or people in a client’s files (the client decides, you act on its instructions).
Why you have it	Doing the work, sending invoices, keeping tax records.
Where it is	Every place: laptop, phone, email, cloud drive, backups, paper.
Who else can see it	Any tool, subcontractor or helper that can open it.
How long you keep it	Until the project ends, until the client asks, or as long as your tax records rule says; then delete it.
How it is protected	Device password and encryption, two-step sign-in, a locked drawer for paper.

A tab in the spreadsheet you already use is enough; see tracking client projects in a spreadsheet.

10. Wording to copy

Replace everything in [brackets]. This is ours, not from any regulator, and it's not legal advice. Check it against your regulator's own guidance before you use it, especially if you use data for marketing or hold sensitive data.

Short privacy notice for your own clients

How I use your personal information

I'm [your name], trading as [business name], [town and country]. I'm responsible for the personal information I collect about you as a client or enquirer.

What I collect: your name and contact details, what we discuss about the work, and the billing details I need for invoices.

Why: to reply to your enquiry, do the work we agree, send invoices and keep the business and tax records I'm required to keep.

Who sees it: only me, and the services I use to run the business ([email provider], [cloud storage], [accounting or invoicing tool]).

How long I keep it: enquiries that don't go ahead, until [when you delete them]; client records, for as long as my tax records rules require, then I delete them.

Your rights: you can ask for a copy of what I hold about you, ask me to correct it, or ask me to delete it. Email [your email]. If you're not happy with my answer, you can complain to [your data protection regulator].

Last updated: [date, with the month written as a word]

Email to a client after a possible breach of its data

Subject: Possible problem with [client name]'s data, [date]

Hi [name],

I'm writing straight away because something has happened that may affect personal data you shared with me for [project name].

What happened: [short, factual description, for example a laptop stolen or a file sent to the wrong person]
When I found out: [date and time]
What data may be involved: [kind of data, for example customer names and emails, and roughly how many people]
What I've done so far: [for example changed passwords, asked the recipient to delete the file, wiped the device remotely]

You decide whether this needs to be reported or whether people need to be told. I'll answer any questions, share my notes, and help however I can.

[Your name]
[phone number]

11. Checklist

Listed the personal data you hold, where it is and why (a data map).
Know which data you control and which you process for clients.
UK: took the ICO fee self-assessment, and paid the fee if it says so.
Privacy notice on your website or sent with quotes.
Devices locked with a password and encrypted, two-step sign-in on email and cloud storage, backups.
Business email separate from personal email.
Processor terms agreed with clients whose data you handle.
Old enquiries and finished clients' files deleted when no longer needed.
Know what to do if data is lost: contain it, tell the client if it's theirs, keep a log, check whether to report.

Free tools and kits

Our free invoice generator runs in your browser; nothing you type is sent or saved.
Our paid Client & Project Tracker by Small Rows (US$12, one-time) gives you one place for client contact details, which makes a data map and deletion easier. It isn't encrypted, its sheet protection has no password and isn't a security measure, and it has no retention or deletion dates, so keep the file on a device with a password and encryption and delete rows you no longer need.
All three kits together: the All-Kits Bundle by Small Rows (US$24, one-time).

Where the sources differ

Reporting a breach: the UK sets a time limit (72 hours after becoming aware) when a report is needed; Canada says "as soon as feasible" with a "real risk of significant harm" test; the FTC page points to state laws.
Records of breaches: both the UK and Canada want a record of every breach, reportable or not; Canada sets how long to keep it.
Fees: only the UK has an annual fee on the pages we read, with exemptions.
Guidance under review: several ICO pages quoted here say: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change." Check the live page before relying on it.
What we did not check: US federal and state privacy and breach laws (including state consumer privacy laws and sector rules such as health data); the EU GDPR for freelancers based in the EU; Canadian provincial laws, including Quebec, Alberta and British Columbia; UK rules on marketing emails and cookies; international transfers of personal data; the extensions and exceptions to access requests; how the Data (Use and Access) Act changes the guidance; other countries.

When to get legal advice

you handle sensitive data (health, finances, children, criminal records) or large customer lists;
a client asks you to sign data-processing terms you don't understand;
data has been lost or exposed and you're not sure whether to report it;
you send marketing emails to people who aren't clients, or use tracking on your website;
you store or send client data to another country;
someone complains to a regulator about you.

Contact your data protection regulator's advice line or a lawyer where you work. This page is general information only.

Sources

United Kingdom: ICO: Data protection advice on common topics (no page date shown) · ICO: principles, definitions and key terms (no page date shown) · ICO: tips for sole traders (no page date shown) · ICO: How secure is your personal data? (no page date shown) · ICO: responding to a personal data breach (no page date shown) · ICO: Personal data breaches, a guide (page date 20 August 2025) · ICO: Guide to the data protection fee (no page date shown) · ICO: fee exemptions (no page date shown) · ICO: fee penalties (no page date shown) · ICO: fee self-assessment (no page date shown) · ICO: fee, what you need to do (no page date shown) · GOV.UK: Pay the data protection fee (page date 2018-06-01)
Canada: OPC: PIPEDA requirements in brief (page date 2024-05-01) · OPC: mandatory reporting of breaches of security safeguards (page date 2025-08-11) · Justice Laws: Personal Information Protection and Electronic Documents Act (page date current to 2026-09-21, last amended on 2025-03-04) · Justice Laws: Breach of Security Safeguards Regulations (page date current to 2026-09-21, last amended on 2018-11-01)
United States: FTC: Protecting Personal Information, A Guide for Business (no page date shown) · FTC: Data Breach Response, A Guide for Business (no page date shown)

Checked 2026-10-16. Found a mistake? Tell us via Support.