Can a freelancer show in their portfolio work done for clients that contains personal data?

It depends on the content and the consent. If the work is identifiable (logo, brand, screenshots of the client's website) it can normally be shown with the client's authorisation, since the corporate brand is not personal data. If the work contains personal data of third parties (testimonials with name and photo, screenshots showing real users, end-customer records, subscriber lists, private messages from the client's account, case studies with individualised metrics) you need either explicit consent from the people involved, or effective prior anonymisation that reasonably prevents re-identification. The client's authorisation to display the project is not equivalent to the consent of the third parties appearing in it: they are distinct data subjects. The operational rule is to separate two planes: use of the work (with the client's permission) and use of personal data of third parties (anonymised or with own legal basis).

What does proper anonymisation mean and how is it done in a case study?

Anonymising means transforming data irreversibly so that no natural person is identifiable directly or indirectly, not even by combining the information with other reasonably available sources. It is not the same as pseudonymising (where re-identification remains possible with a separate key): pseudonymised data is still personal data and remains subject to GDPR. In a case study or portfolio screenshot, anonymising means: replacing real names with generic or clearly fictitious labels, blurring faces, masking complete emails (not just the domain), deleting phone numbers, ID numbers, addresses, IPs, unique IDs and internal references that allow locating the person, and reviewing file metadata. Showing 'customer@knownrealcompany.com' with the user crossed out is not anonymisation if the company is small and the recipient deducible. Anonymisation is judged by its result, not by its intent.

Freelancer portfolio with personal data: anonymise, consent, display

Q: Does the freelancer have the right to use work done for a client in their portfolio?

It is a contractual and intellectual property question that intersects with data protection but does not replace it. By default, unless explicitly assigned to the client, the author of the design, code or text retains moral rights and, depending on what is agreed, exploitation rights or attribution. The services contract may assign ownership to the client and, separately, regulate whether the freelancer may display the work in their portfolio: the reasonable and usual approach is to expressly negotiate the portfolio clause, with or without restrictions (with or without visible brand, with or without metrics, with or without a temporary embargo). However, even with client authorisation to display the project, the freelancer cannot show personal data of third parties (the client's end customers) without their own legal basis: they will need effective anonymisation or individual consents. The two layers (authorship/contract with the client and GDPR towards third parties) operate independently.

Q: Can the freelancer publish client testimonials with name and photo?

Yes, but only with explicit, specific, informed and documented consent from the person appearing, not just from the company they work for. The testimonial must clearly identify the holder (person and role), the medium in which it will be published, the period during which it will be maintained, the channels (freelancer's website, social media, commercial presentations) and must include the possibility to withdraw consent. The photo requires additional consent, since the image is personal data and also an autonomous fundamental right (Spain's Organic Law 1/1982). Consent is given by signature or in an equivalent demonstrable manner (form with tick boxes, confirmed email). A mention on LinkedIn does not amount to consent to include the testimonial in the freelancer's portfolio: they are distinct channels. If the person leaves the company, the testimonial must be reviewed: if it loses meaning or the person requests removal, it is deleted.

The portfolio is the most powerful commercial tool of the independent professional. It is also the place where personal data of third parties is most easily displayed unintentionally: screenshots with identifiable end customers, testimonials with name and photo, individualised metrics, real messages, dashboards full of emails and phone numbers. The GDPR (Regulation (EU) 2016/679) and the LOPDGDD (Spain's Organic Law 3/2018) apply to that content with the same demands as to any other processing.

This guide separates what is a question of contract with the client (can I use this work in my portfolio) from what is a question of data protection (can I display these people), and explains how to anonymise effectively without ruining the piece.

Two distinct layers: contract with the client and GDPR towards third parties

Before touching anything, it pays to separate the two planes:

Layer	What it governs	Who decides
Contractual / authorship	Whether you can show the work, with or without brand, with or without metrics.	Client (by contract)
GDPR	Whether you can display personal data of end customers, users or employees appearing in the material.	Each affected person
Image and honour	Whether you can display identifiable photos or videos (Spain's Organic Law 1/1982).	The person depicted
Intellectual property	Who owns the design, code, text or video.	What is agreed in the contract

The client's permission to display the project is not equivalent to the consent of the people who appear within it: they are distinct data subjects.

Effective anonymisation: what counts and what does not

Anonymising means transforming data so that no natural person is reasonably identifiable, directly or indirectly, even by combining information with other available sources. If re-identification is feasible (because the company is small, because the role is unique, because the screenshot retains metadata), there is no real anonymisation and GDPR continues to apply.

Replace real names with clearly fictitious or generic labels ("Customer A", "User 1"), not with initials that still allow identification.
Blur faces effectively (not a moving emoji, not a reversible pixelation).
Mask complete emails (including the domain if the recipient is deducible), phone numbers, ID numbers, addresses, IPs, unique IDs and internal references.
Delete individualised metrics that allow identifying a specific person (a customer who generated X in a small company).
Review metadata of exported files (PDFs and PNGs retain information that may reveal paths, users and projects).
Test the result with reverse check: could I, knowing nothing, identify anyone? If the answer is no, anonymisation is reasonable.

Pseudonymising (replacing one identifier with another while keeping the possibility to reconnect) is not anonymising: pseudonymised data is still personal data and remains subject to GDPR.

Testimonials with name and photo: written consent

The identifiable testimonial (with name, role, company, photo) is one of the most frequent cases of undue exposure in portfolios. Minimum requirements:

Explicit consent from the person, not just from the company they work for.
Specific: for what portfolio (freelancer's website, social media, commercial presentations) and for how long.
Informed: the person knows what is published and where.
Documented: signature, form with ticked boxes or archived confirmation email.
Revocable: clear and easy path to withdraw the testimonial.
Separate image consent: the photo requires additional consent (Spain's Organic Law 1/1982).
Periodic review: if the person leaves the company or changes role, consider whether the testimonial still makes sense.

"The professional portfolio is where freelancers see the most privacy complaints. Not because of the good work done, but because of the screenshots left in with a real name or email. Anonymising a piece well takes ten minutes. Taking it down after an AEPD request costs much more."

Mario P. Talamillo · Managing Partner, Certix®

Typical cases and how to handle them

Screenshot of the client's dashboard with a list of real users: anonymise names and emails before uploading; review metadata.
Case study with real metrics: agree with the client whether to show absolute figures, percentages or ranges. If the company is identifiable and metrics are individualised (a specific customer generated X), anonymise or aggregate.
Video of a working session with in-person clients: consent from each person appearing (not only from the organiser).
Private messages, emails or written feedback: remove signatures, contact details and references to specific people; ask for consent if the content is to be quoted.
Work under NDA: even if the client authorises after the embargo, personal data of third parties still requires anonymisation or their own consent.

The portfolio clause in the client contract

To avoid grey areas, it pays to expressly include in the services contract a section on use of the work for portfolio purposes. Typical elements:

Whether the work can be displayed and at what level of client identification (visible brand, blurred brand, description only).
Whether the client's logo can be used in a "clients I have worked with" section.
Whether there is a temporary embargo (for example, before launch).
Whether metrics can be displayed and in what format.
Commitment by the freelancer to anonymise personal data of third parties before any publication.
Procedure for the client to request removal of specific pieces.

Checklist before publishing a new piece in the portfolio

Do I have contractual authorisation from the client to display it?
Does personal data of third parties appear? If so, is it effectively anonymised or do I have individual consent?
Have I blurred faces, masked complete emails, phone numbers, ID numbers, addresses and IPs?
Have I reviewed the exported file's metadata?
If it is a testimonial with name or photo, do I have explicit, specific and documented consent from the person?
Have I set a clear revocation path?
Could the piece withstand a check if the AEPD asked for it? Could I justify how I obtained it and what legal basis I used?

Frequently asked questions

Can a freelancer show work with personal data in their portfolio?

Yes, but separating two planes. The client's authorisation governs use of the project. The presence of personal data of third parties (end customers, users, employees) requires either effective anonymisation or individual consent from the people affected. The visible corporate brand does not need GDPR basis; identifiable data of natural persons does.

What does proper anonymisation mean?

Transforming data irreversibly so that no person is identifiable directly or indirectly. It is not pseudonymising (replacing an identifier while keeping a key): pseudonymised data is still personal data. Replace names, blur faces, mask complete emails, delete IDs and review metadata.

Does the freelancer have the right to use work done for a client in their portfolio?

It depends on the contract and the intellectual property regime agreed. The reasonable approach is to include an express portfolio clause. Even with the client's authorisation, personal data of third parties requires separate treatment: anonymisation or individual consent.

Can the freelancer publish client testimonials with name and photo?

Only with explicit, specific, informed and documented consent from the person (not just from the company). Image requires additional consent (Spain's Organic Law 1/1982). Specify channels, timeframes and revocation path. A LinkedIn mention is not equivalent to portfolio consent.

This content is informational and educational in nature and does not constitute specialised legal advice. Applying the regulation to a specific case requires individual analysis. Spanish regional and sector-specific rules may extend or modify timeframes and requirements.

Want to review your portfolio before sharing it further?

At Certix we help you audit pieces, draft the portfolio clause in your contracts and prepare testimonial and image consents.

Talk to an expert

Professional portfolio with client data: how to display your work without stepping on the GDPR