Data protection
for digital freelancers

Yes. The GDPR has no minimum thresholds. A digital freelancer who manages social media, builds websites or does marketing for their clients processes personal data (followers, leads, website users) and in many cases acts as a data processor for the client. From the very first contract, there is an obligation to comply with the GDPR and to have the processing agreement formally executed.

In many cases, yes. A freelancer who manages a client's CRM, newsletter, social media, website or lead data is processing personal data on behalf of that client, which as a general rule places the relationship within the scope of the data processor role under art. 28 GDPR. The exact legal status depends on the degree of autonomy and the contractual conditions of each case; it is advisable to analyse and document it using the instruments provided for in art. 28 GDPR.

Yes, if their website collects contact data, has a quote request form, live chat, a blog with comments or uses analytics cookies. The freelancer's website is their professional calling card and must comply with the same obligations as any other website: privacy policy, legal notice, cookie policy and a consent banner if non-technical cookies are used.

Yes, but they must formalise the relationship with the cloud service provider (Google, Dropbox, etc.) using the instruments under art. 28 GDPR and, if the data belongs to a client, inform that client that their data is stored in that service. The use of cloud services from US-based companies may involve an international data transfer. The legality of such a transfer is typically based on the provider's adherence to the EU-US Data Privacy Framework (DPF) or on the adequate safeguards under art. 46 GDPR; the specific mechanism of each provider should be verified.

As a general rule, yes. A community manager who manages a company's social media accounts accesses data belonging to followers, direct messages and audience analytics on behalf of that company. This activity as a general rule places the relationship within the scope of the data processor role under art. 28 GDPR. The exact legal status depends on the degree of autonomy and actual access to data; it is advisable to formalise it contractually with each client.

Only with adequate safeguards. Showing screenshots of analytics dashboards containing user data, campaign emails with contact data or databases with real client data in a portfolio may constitute a GDPR infringement. The freelancer must anonymise the data or obtain express authorisation from the client before using any work that includes personal data in their portfolio.