GDPR Guide — EU Freelancer Invoicing Compliance — LockMargin

By Vlad (Volodymyr) Shiyan · Published Apr 16, 2026 · Privacy & Compliance · 8 min read

Why a Freelancer Is Also a Data Controller

Most people think: GDPR is Meta, Google, Amazon. I'm not Meta. I just send invoices from my laptop.

But if you have even one client in the EU, you likely fall under GDPR as a Data Controller. Exact jurisdictional nuances depend on your establishment. But the liability is real. I'm not a lawyer, but I've seen how this ends.

Your Google Sheet with client contacts isn't just a spreadsheet. From a legal standpoint, it's a system processing personal data. You created it. You're responsible.

"We Are GDPR Compliant" — What That Actually Means

Cloud services love slapping a "GDPR Compliant" badge in their footer. But compliance is shared. They secure their infrastructure. You secure your access.

If the service or your account is compromised, personal data may become accessible to third parties. And you'll be the one explaining it to your client, not them.

I've helped freelancers respond to breach notifications over the past two years. In every case, the data was sitting in a cloud service the person had forgotten they were using.

Data Minimization: Don't Collect It, Don't Answer For It

Data minimization. Sounds like legal paperwork. In practice, it's your main shield.

Don't store what you don't need. Client tax ID in your task manager? Delete it. Bank details in email drafts? Remove them. If the data isn't there, it can't be stolen.

When I audit setups, I look at where data lives. Move sensitive client fields off third-party servers to local encrypted storage — and an entire category of risk disappears. A server cannot compromise data that was never on it.

Common Mistakes I See

• Client passports in Gmail. A PDF attached to an email is still data processing.
• Dropbox with an open link. Anyone with the link can download. And links leak.
• Shared Google Drive without access control. A colleague left — access remains.
• Old contract copies in Notion. "Just in case" is not a legal basis for retention.
• Bank details "just in case." If the invoice is paid — why do you still need them?

What GDPR Does NOT Require (Stop Worrying About This)

Many freelancers fear GDPR like fire. Often for no reason.

GDPR does not require:

• A legal team. You're a small business, not a corporation.
• ISO 27001 certification. Though having ISO 27001 can significantly simplify corporate client audits.
• Storing data only in the EU. Adequate protection level is sufficient.
• Notifying clients about every minor issue. Only real incidents.

GDPR requires:

• Knowing what data you collect and why.
• Protecting it with reasonable measures.
• Deleting personal data when there is no longer a legal basis for retention, or honoring justified data subject requests in accordance with applicable law.
• In certain cases, notifying the supervisory authority of personal data breaches without undue delay and, where feasible, not later than 72 hours after becoming aware.

This isn't rocket science. It's common sense written into law.

Practical Checklist

• Make a list: where is client data stored (Google, Notion, Dropbox, locally?)
• Remove excess: what are you collecting without necessity?
• Check access: who else can see these files?
• Encrypt local copies.
• Prepare a DPA response template — don't write from scratch every time.

The Bottom Line

I'm not saying cloud is evil. I'm saying: know where your data is, and who answers when something goes wrong. GDPR isn't about paperwork. It's about awareness.

And if you can store invoices locally, encrypted, without someone else's servers — why take the risk?

в†’ Read: How We Test Encryption Without a Security Team

About the Author

Vlad (Volodymyr) Shiyan — Founder & Developer, Kharkiv, Ukraine. Building LockMargin since December 2025. Offline-first invoicing for freelancers who are tired of subscriptions. Standard is $49 one-time. Read more about Vlad →