Good GDPR training for freelancers and small businesses covers the essentials of the General Data Protection Regulation, Regulation (EU) 2016/679: what personal data you handle, the legal basis for using it, the principles you have to follow, the rights your clients have and the basic measures that protect you and them. You don't need to be a lawyer. You need to know what to do when a client asks for a copy of their data.
Below you'll find the key concepts, the seven GDPR principles in a table, people's rights, a checklist for your day-to-day work and a comparison of training formats. This is general information, not legal advice.
Does the GDPR apply to you?
It applies to processing personal data by a business established in the European Union. It also reaches businesses outside the EU that offer goods or services to people in the EU, or monitor their behavior there. So a US freelancer with clients in France or Spain may well be covered.
If it applies, it covers the personal data you use for work: client names, emails and phone numbers, invoices, résumés. The GDPR only excludes processing by an individual in the course of a purely personal or household activity, and your client list doesn't qualify. EU countries also add their own national rules on top of the regulation.
Four concepts to get right
- Personal data: any information about an identified or identifiable individual. An email address with a first and last name counts; so does a phone number.
- Processing: almost anything you do with that data: collecting, storing, looking it up, sending it, deleting it.
- Controller: whoever decides why and how the data is processed. If they're your clients, that's you.
- Processor: whoever processes data on the controller's behalf, such as your accountant or your website host. The GDPR requires that relationship to be governed by a contract, often called a data processing agreement.
The 7 GDPR principles (Article 5)
| Principle | What it means | In your daily work |
|---|---|---|
| Lawfulness, fairness and transparency | You have a legal basis and you explain clearly what you do with the data | Your website and forms say who you are and why you collect the data |
| Purpose limitation | You collect data for specific, explicit purposes and don't use it for incompatible ones | The email on an invoice isn't used for marketing without the right legal basis |
| Data minimization | You only ask for what you need | Your contact form doesn't ask for a date of birth |
| Accuracy | Data is kept up to date and corrected when wrong | You update the record when a client moves |
| Storage limitation | You don't keep data longer than necessary | You delete résumés from a hiring round that ended long ago |
| Integrity and confidentiality | You protect data with appropriate security | Strong passwords, two-factor authentication, restricted file access |
| Accountability | You comply and can show that you comply | You keep a record of your decisions, notices and contracts |
The first principle raises a practical question: what's your legal basis for each piece of data? Article 6 lists six: consent, performance of a contract, legal obligation, vital interests, public interest and legitimate interests. Not everything needs consent. To invoice a client, your basis is the contract and your legal obligations.
The rights of data subjects
Your clients, contacts and anyone whose data you process have the right to:
- Clear information about the processing.
- Access their data and get a copy.
- Rectification of inaccurate data.
- Erasure (the "right to be forgotten"), in the cases the regulation sets out.
- Restriction of processing.
- Data portability for data they provided, when processing is based on consent or a contract and carried out by automated means.
- Object to processing, for example to direct marketing.
- Not be subject to decisions based solely on automated processing that significantly affect them, with some exceptions.
You have to respond without undue delay and within one month at the latest. That can be extended by two more months for complex or numerous requests, as long as you tell the person within the first month.
Basic GDPR steps for a freelancer or small business
- Take inventory: what data you hold, whose it is, why you have it, where it lives and who can access it.
- Be transparent: clear privacy notices on your website, forms and contracts.
- Check your vendors: if they process data for you, sign a data processing agreement.
- Lock down access: unique passwords, two-factor authentication, locked devices and backups. More in our guide to cybersecurity training for small business.
- Delete what you no longer need and decide how long you keep each type of data.
- Have a breach plan: if a personal data breach happens, the GDPR requires you to notify the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to people.
- Train whoever handles data: it's one of the most common organizational measures. You and anyone who helps you should know what to do.
A classic slip: emailing a group of clients with every address visible. Use BCC or a mailing tool. It's a level-one mistake, and one click avoids it.
GDPR training formats compared
| Format | What it's good for | Practice | A good fit if… |
|---|---|---|---|
| Free guidance from data protection authorities | Looking up official criteria and templates | Low | You need an answer to a specific question |
| Online video course | Understanding the regulation in a structured way | Low to medium | Well-explained theory is enough for you |
| In-person workshop | Answering questions about your industry | Medium | You can set aside a full day |
| Simulator or training game | Applying the rules to everyday situations | High | You want to turn theory into habits |
| Specialist legal advice | Adapting your business and documents | Not training | You need your specific case reviewed |
Where Game Strategies fits in
Our safe workplace courses include Classified (1 hour 30 minutes). Steve just landed his dream job, and one slip with data could sink the company. Across four modules you cover the basic concepts, principles and who's involved; roles and responsibilities; data subjects and their rights; and the guidelines that keep personal data safe day to day. You work through practical exercises and get feedback right away.
The natural companion is Crypt0 (2 hours), on cybersecurity: phishing, passwords, two-factor authentication, mobile devices and public Wi-Fi. And if you use AI tools with client data, remember that's processing too: our AI courses and our guide to AI literacy training under the EU AI Act give you the context.
All of them are included in the annual license at €299 per user (VAT included): one year of access to all 71 games in the catalog, a one-time payment with no automatic renewal, and a certificate of completion for each course that you can add to LinkedIn. If you have a small team, the admin panel lets you assign courses and track progress. One caveat: Classified trains you, but it doesn't review your documents or replace legal advice.
Frequently asked questions
Is GDPR training mandatory?
The GDPR doesn't prescribe a specific course, but it does require appropriate technical and organizational measures to protect personal data. Training the people who handle that data is one of the most common organizational measures.
Do I need a data protection officer?
Most freelancers don't. The GDPR requires one in specific cases, such as public authorities or large-scale processing of special categories of data, and national laws can add others.
Does the certificate prove my business is GDPR compliant?
No. It's a certificate of completion: it shows you finished the training. Compliance depends on how your business actually handles data.