GDPR and client data: what the self-employed need to know

You are the controller

Under GDPR your business is the controller: you decide what data you keep and why. Your diary or booking software is the processor: it stores the data for you and may not use it for anything else. For every tool, check where the data is stored. Within the European Union is simplest.

What can you keep?

Anything you reasonably need for the appointment to go ahead: name, contact details, the service, the time. Also practical notes that improve your work, like an allergy or a preference. Don't ask for more than you need. You don't need a date of birth for a haircut; if you want it for a birthday offer, make the field optional and say what it's for.

Health data: extra care

Physiotherapists, osteopaths, dietitians and psychologists work with health data, which falls into a stricter category. Keep medical reports in the records software made for that purpose, and only put in your diary what you need to plan the appointment. Follow your profession's rules too.

Promotions: separate consent

A confirmation or reminder about an appointment the client made is part of the service: you can send it. Promotions, newsletters and offers are different. Ask explicit consent for those, with a box that isn't pre-ticked, and offer an easy way to opt out in every message. Record each client's choice. When in doubt: just ask.

How long do you keep data?

No longer than necessary. For a regular, a history is useful. A client who hasn't come in for years is better tidied away. Invoices and bookkeeping have their own legal retention periods; check them with your accountant. Set yourself a simple rule and stick to it.

What can your clients ask?

• Access: what data you hold about them.
• Rectification: having a mistake corrected.
• Erasure: having their data deleted, unless you're legally required to keep it.
• Objection to promotions: then you stop straight away.

Security and data breaches

Use a strong password and two-step verification, don't share your login and sign out of devices that aren't yours. If something does leak, for example a stolen laptop with a client list, you generally have to report it to the Belgian Data Protection Authority within 72 hours. Their website explains how.

How mijnklant.vip helps

• Data in a secure database in the EU (Frankfurt); mijnklant.vip is the processor.
• Two-step verification is required for every account.
• Marketing consent per client; mailings only go to those who said yes.
• You can ask for birthdays, but never required unless you choose so.
• A backup of all your data in one click.