GDPR for small businesses and freelancers: sharing documents safely
The GDPR applies to every organisation that processes personal data, from multinationals to a freelancer with a laptop. For small business owners that often feels like a lot of rules and too little time. The good news: a few fixed habits get you a long way. This article covers the key points, with a focus on something everyone does every day: sharing documents.
Does the GDPR apply to my small business?
Yes. As soon as you keep data on customers, employees or suppliers, such as names, email addresses, invoices or a personnel file, you are processing personal data and must comply with the GDPR. There are some lighter rules for small organisations, for example around the record of processing activities, but the basic principles apply to everyone. In the UK, the UK GDPR contains the same core principles.
The basics in five points
- Purpose and legal basis: only collect data when you have a good reason, such as a contract or a legal obligation.
- Data minimisation: don't ask for or keep more than you need. No passport copy if a name will do.
- Security: use strong passwords, two-factor authentication and keep software updated.
- Retention periods: delete data once you no longer need it. Tax records usually have to be kept for a fixed number of years, often 6 to 10 depending on the country.
- Data breaches: report a serious breach to your data protection authority within 72 hours.
Where it often goes wrong: sharing documents
Many data breaches at small businesses are not hacks but ordinary mistakes: an email to the wrong John, a sample quote containing a real customer's details, or an HR issue presented to an adviser with full names. Increasingly it happens through AI tools too: someone pastes a customer letter into a chatbot to get a quick reply drafted.
The solution is simple: anonymise documents before sharing them whenever the recipient does not need the personal data. For example:
- a complaint letter you show to a colleague or an AI;
- an employment contract or sickness absence file you discuss with an adviser;
- sample documents for training or templates;
- quotes and invoices you use as an example.
Practical tips for freelancers
As a freelancer you are often your own IT department. Keep it simple: one place for customer data, encrypted backups, and a fixed habit of cleaning sensitive documents before they leave your computer. Do you work with your client's data on their behalf, for example as a bookkeeper or virtual assistant? Then you may be a processor and need a data processing agreement.
Anonymise locally, without uploading. VerumVault removes names, addresses, IBANs, phone numbers and email addresses from a text in seconds. The tool runs entirely in your browser, so your business documents never go to an external server and you don't add a new processor. Detection is currently optimised for Dutch documents.
Useful for HR too
HR handles the most sensitive data in a company: sickness, appraisals and salaries. Anonymise cases before sharing them in a team meeting, with an occupational health service or in a training folder. That way you can learn from situations without harming employees' privacy.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no account · optimised for Dutch documentsFrequently asked questions
Does a sole trader have to comply with the GDPR?
Yes. A sole trader or freelancer who processes data about customers or suppliers falls under the GDPR. Purely personal use falls outside it.
Is sharing a customer letter with an AI chatbot a data breach?
It can be. You are sharing personal data with an external party, often without a legal basis or a data processing agreement. So anonymise the letter first.
What does VerumVault cost?
VerumVault is free to use, without an account. The tool is supported by advertising.