GDPR is the law that sets out how businesses must handle personal data — who can collect it, what they can do with it, and how they must keep it safe.
GDPR stands for the General Data Protection Regulation — the set of rules that govern how personal data must be collected, used, stored, and shared.
If you handle information that can identify someone — client emails, newsletter sign-ups, invoices, contact forms, analytics data, or project files — GDPR almost certainly applies to you, whether you're a sole trader or running a limited company.
After Brexit, the UK kept its own version of these rules, usually called UK GDPR, alongside the Data Protection Act 2018. For most freelancers, the practical obligations are much the same as before: treat personal data carefully, be transparent about how you use it, and respond properly when something goes wrong.
The ICO (Information Commissioner's Office) is the regulator that enforces data protection law in the UK.
Personal data is any information that relates to an identifiable individual. For freelancers, that commonly includes:
If you can link the information to a specific person, it is likely personal data.
You do not need to become a data protection expert overnight, but you are expected to:
Many freelancers also need to register with the ICO and pay a data protection fee. If you are unsure, the ICO's self-assessment tool can help you decide.
The Data (Use and Access) Act 2025 updates UK data protection law without replacing GDPR. Some changes take effect from 19 June 2026, including new requirements for handling data protection complaints. See our FAQ on June 2026 data protection changes for what that means in practice.
The ICO publishes plain-language guidance for small businesses and freelancers. That is usually the best place to check whether the rules apply to you and what to do next.
Our free weekly newsletter nudges on the things you need to know, with resources, guides and tools for freelancers.
