← Back to ContractPilot

GDPR-Compliant Freelance Contract Checklist

If you work with clients in the EU — or handle any EU resident's personal data — GDPR applies to you. Violations can result in fines up to €20 million or 4% of annual global turnover. As a freelancer, you probably won't face those maximums, but even a €5,000 fine can be devastating.

The good news: GDPR compliance for freelancers is simpler than you think, and most of it comes down to having the right clauses in your contract. This checklist covers everything you need.

Do You Need GDPR Clauses?

Scenario	GDPR Applies?	Clauses Needed
You build a website that collects EU visitor emails	Yes	Data Processing Agreement (DPA)
You manage social media for an EU company	Yes	DPA + Data Access clause
You design a logo (no personal data involved)	No	Standard contract is fine
You write blog content (no personal data)	No	Standard contract is fine
You run email campaigns for an EU client	Yes	DPA + Consent verification
You're a non-EU freelancer working with EU clients	Yes	All applicable clauses

The Complete GDPR Freelance Contract Checklist

Essential Clauses

• Data Processing Agreement (DPA) — Required by Article 28 whenever you process personal data on behalf of a client. Defines what data you'll access, why, and how long you'll keep it
• Purpose Limitation — You can only use personal data for the specific purpose defined in the contract. No using client's customer emails for your own marketing
• Data Minimization — Only collect/access the minimum data necessary to complete the work. If you don't need names, don't request them
• Security Measures — Specify how you'll protect the data: encrypted storage, password-protected files, 2FA on all accounts, VPN usage
• Data Breach Notification — You must notify the client within 72 hours of discovering a data breach. Include this exact timeline in your contract
• Data Return/Deletion — After the project ends, specify whether you'll return all data to the client, delete it, or both. Include the timeframe (usually 30 days)
• Sub-processor List — If you use third-party tools (Mailchimp, Google Analytics, etc.) to process client data, list them. The client must approve each one

Recommended Additions

• Data Subject Access Request (DSAR) Handling — If an EU resident asks to see/delete their data, who handles it? Usually the client, but you must cooperate
• Cross-Border Transfer Clause — If you're outside the EU, state how you'll ensure data protection (Standard Contractual Clauses or adequacy decision)
• Audit Rights — Allow the client to verify your compliance. This is often required by enterprise clients

Sample DPA Clause for Freelancers

The Contractor shall process Personal Data only on documented instructions from the Client. The Contractor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of personal data, regular security assessments, and access controls. The Contractor shall notify the Client without undue delay (and no later than 72 hours) upon becoming aware of a personal data breach. Upon termination of the Agreement, the Contractor shall delete all Personal Data within 30 days unless retention is required by applicable law.

Common GDPR Mistakes Freelancers Make

1. Assuming you're too small for GDPR — GDPR applies regardless of company size. A solo freelancer in Vietnam handling one EU client's data must comply
2. Not listing your sub-processors — Using Notion to store client data? That's a sub-processor. Using Gmail? Also a sub-processor. List everything
3. Keeping data after the project ends — Delete client data within 30 days of project completion unless you have a legal reason to retain it
4. No breach notification plan — 72 hours is not a lot of time. Have a template ready
5. Mixing client data with personal data — Use separate accounts/folders for each client's data

GDPR Tools for Freelancers

• Contract generation: ContractPilot — generates contracts with GDPR clauses built in
• Encrypted file sharing: Tresorit, Proton Drive
• Password management: 1Password, Bitwarden
• Email encryption: Proton Mail

Related Reading

• Freelance Contract IP Clause Guide
• The Complete Guide to Freelance Contracts
• Cross-Border Freelance Contracts: Legal Guide
• Track your freelance income: FreelanceFlow