Yes, as a self-employed professional or freelancer, you must comply with the GDPR as soon as you process personal data belonging to clients, leads, or website users, even if you work alone and have only a few clients. In Spain, the applicable legislation includes Regulation (EU) 2016/679 (GDPR), the LOPDGDD (Organic Law 3/2018), and, if you have a website, the LSSI-CE.
The GDPR applies to you as a freelance designer because storing someone's name, email address, or phone number constitutes the processing of personal data. You probably also have invoices containing client details, a contact form, an appointment scheduling tool, or an email newsletter. All of these involve processing personal data protected by law.
You must comply even if you have no employees. However, self-employed professionals carrying out straightforward data processing have fewer formal obligations than companies handling large volumes of data or sensitive information.
However, you must provide the required information and be able to demonstrate compliance. The GDPR's accountability principle requires you to document the essentials.
The AEPD determines penalties based on factors such as business size, intent, and the harm caused. In practice, self-employed professionals often face much lower fines, frequently for inadequate privacy information, failure to respond to data subject rights requests, or cookies used without consent. However, even a fine of a few thousand euros can have a significant impact on a one-person business.
If your website uses cookies, the LSSI-CE also provides for fines of up to €30,000 for minor infringements, €150,000 for serious infringements, and €600,000 for very serious infringements.
To avoid these problems, it is essential to be able to demonstrate that you provided the required information, had a lawful basis for processing, and responded to data subject rights requests within the applicable deadlines. Learn more in our guide on how to avoid AEPD fines on your website.
Your requirements depend on your activities:
| Situation | Required documents / actions |
|---|---|
| You have clients and issue invoices | Privacy notice in quotes, contracts, and invoices (Article 13 GDPR) |
| Your website has a contact form | Privacy policy, legal notice, and an unticked consent checkbox |
| Your website uses analytics, advertising, or social media | Cookie policy and cookie banner compliant with AEPD guidance |
| You use third-party tools (email marketing platform, CRM, hosting provider, accountant) | Data processing agreement with each provider (Article 28 GDPR) |
| You send newsletters or promotional offers | Prior consent or, for existing customers, legitimate interest where applicable (Article 21 LSSI-CE), plus an unsubscribe option in every message |
| You process health data, children's data, or video surveillance footage | Additional risk assessment and, where applicable, a record of processing activities |
The record of processing activities (Article 30 GDPR) has an exemption for organisations with fewer than 250 employees. However, the exemption does not apply when processing is not occasional, may pose a risk to individuals' rights, or involves special categories of data. Physiotherapists, psychologists, and consulting firms process data regularly, so they will almost always need a record. A designer with only a few business clients often will not.
The AEPD also provides Facilita RGPD, a free tool for low-risk data processing that can be a useful first step.
At Lawwwing, we automatically generate your legal notice, privacy policy, and cookie policy based on information about your business, and update them when regulations change. We also manage your cookie banner with Google Consent Mode v2, and you can integrate it with WordPress, Shopify, Wix, and WooCommerce.
Yes. The obligation depends on whether you process personal data, not on the size of your business. If you store client details, receive messages through a website form, or send emails, you are processing personal data and must comply with the GDPR and the LOPDGDD.
Yes, whenever the website collects personal data, whether through forms, comments, subscriptions, or analytics cookies. The policy must identify the data controller, explain why the data is used, state the lawful basis and retention periods, and describe how individuals can exercise their rights (Article 13 GDPR).
No. Since the GDPR became applicable on 25 May 2018, registration of data files with the AEPD has no longer been required. Instead, the accountability principle requires you to demonstrate compliance through your own documentation.
The GDPR's maximum fines are €10 million or 2% of annual turnover, and €20 million or 4%, depending on the infringement. In practice, penalties are determined by factors such as business size, intent, and harm caused. They are often much lower for self-employed professionals, but higher penalties cannot be ruled out.
Generally, no. A DPO is only mandatory when you process data on a large scale, carry out large-scale systematic monitoring of individuals, or process sensitive data on a large scale (Article 37 GDPR). A self-employed professional with a typical client base will not usually meet these criteria.
It is not recommended. Your legal texts must reflect your actual activities: the data you collect, the tools you use, and the purposes of processing. Copied texts often contain inaccurate information and may constitute a failure to meet your transparency obligations.
