Client files and GDPR: a simple guide for self-employed professionals

Name, phone number, email, date of the last appointment, a few notes: as soon as you keep this information, you have a client file. And a GDPR-compliant client file isn't just a concern for large companies: the European data protection regulation also applies to the hairdresser who notes clients' preferences, the coach who sends a back-to-school offer or the tradesperson who keeps their quotes. The good news: for a small business, the essentials come down to a few simple habits.

This guide is based on documents published by the CNIL, the French data protection authority. It gives you a six-step method, the retention periods to know, the rules for sending offers by email or SMS, and templates to copy. It doesn't replace legal advice: for a specific case, check with the CNIL or a legal professional.

Does the GDPR apply to your client file?

Yes, as soon as it contains information about identifiable people: a name, a phone number, an email address, an appointment history. The format doesn't matter. A paper notebook, a spreadsheet, the contacts on your phone or booking software are all covered in the same way.

The GDPR doesn't forbid you from keeping this information. It asks you to know why you keep it, to keep only what's useful, to let your clients know, to respect their rights and to protect the file. In its practical guide for very small, small and medium-sized businesses, published with Bpifrance in 2018, the CNIL sums up the approach in four steps: list your files, sort through your data, respect people's rights and secure your data.

Step 1: list your files and their purpose

The CNIL offers a checklist for small businesses that starts right there: identify all of the business's files, then note the purpose of each one. For a self-employed professional, the list is often short:

• Clients: booking appointments, tracking services, invoicing.
• Prospects: people who asked for a quote or information without buying.
• Loyalty: sending offers, news, follow-ups.
• Accounting: invoices and accounting documents.

This short inventory is the basis of the "record of processing activities." The CNIL guide recommends noting, for each activity, the purpose, the categories of data, who has access to it and how long it is kept. For a small business, a one-page table is often enough, and the CNIL provides a template.

Step 2: keep only the information you really need

This is the point the CNIL checklist puts most clearly: for each file, list the information recorded and check that all of it is essential to your purpose. If not, delete it and stop asking for it.

In practice, to book an appointment, the name, a way to get in touch and the service are often enough. Date of birth, postal address or occupation are only useful if you have a real reason to ask for them (a home visit, for example).

Watch out for "free-form" notes

Comments on a client record are handy, but they are data like any other. The CNIL's reference framework on managing commercial activities points out that some information is considered sensitive: origin, political, religious or philosophical opinions, union membership, sex life or sexual orientation, health. It must not be collected without the person's consent. Write factual notes, useful for the service, that you would be comfortable showing the client.

If you are a health professional or wellness practitioner, health data deserves special attention: look into the rules specific to your field with the CNIL and your professional body or organization.

Step 3: inform your clients when you collect their data

Your clients need to know what you do with their data. According to the CNIL guide for small and medium-sized businesses, the information must notably specify the purpose of the collection, the legal basis (contract, consent, legal obligation or legitimate interest), who has access to the data, how long you keep it, how to exercise their rights, and whether any data is transferred outside the European Union.

Adapt the brackets to your situation, and check the final text against the CNIL's resources if you have any doubts.

Step 4: ask for consent before sending offers

This is the rule that trips up the most self-employed professionals. According to the CNIL, sending advertising by email, SMS or fax to an individual in principle requires their prior consent, and that consent must be freely given, specific, informed and unambiguous. Accepting your terms and conditions does not count as consent to receive offers. The CNIL recommends a checkbox, unchecked by default.

There is a useful exception for local businesses: if the person is already a client and you offer them products or services similar to the ones they have already bought, consent isn't required. But two conditions still apply: they must be able to refuse easily and free of charge when you collect their contact details, and then at any time, in particular in every message.

These rules cover marketing, meaning advertising and promotions. An appointment reminder, on the other hand, serves the service the client asked for. To follow up with your clients by the rules and without wearing them out, our guide on how to follow up with a client offers suitable messages and schedules.

Step 5: set a retention period and stick to it

The CNIL checklist is blunt about it: identify how long you need to keep each type of information, and don't keep it any longer. For marketing, the CNIL's reference framework on managing commercial activities gives specific benchmarks.

• Clients: data can be used for marketing during the business relationship, then for 3 years after it ends (for example, from the last purchase).
• Prospects who aren't clients: 3 years from collection or from the last contact initiated by the person. Simply opening an email doesn't count as contact; clicking a link does.
• After 3 years: you can ask the person whether they want to keep receiving your messages. Without a clear yes, the data is deleted or archived.

Invoices and accounting documents follow their own retention obligations: check them with your accountant. The simplest approach is to schedule a yearly cleanup, for example every January, to sort through inactive contacts.

Step 6: protect access to the file

A client file that is lost or viewed by a third party is a real problem, for your clients and for you. The CNIL's reference framework lists many security measures; here are the ones that matter most for a self-employed professional:

• a strong password, unique to each tool, never shared on a sticky note;
• automatic screen locking on your phone and computer;
• access limited to the people who need it, removed as soon as a team member leaves;
• regular backups, stored somewhere other than the main device;
• no client file sent as an unprotected attachment.

In the event of a breach likely to pose a risk to people, the CNIL guide states that it must be reported to the CNIL within 72 hours, and that the people affected must be notified if the risk is high.

What to do when a client asks to see or delete their data

Your clients have rights: access, rectification, objection, erasure, portability and restriction. The CNIL guide asks you to respond quickly, within one month at most. Set up an email address for these requests and a simple way to find all of a person's information.

Examples by profession

Beautician: keep information useful for the treatment (an allergy the client mentioned, for example) only with her consent, and offer your loyalty deals to existing clients with an unsubscribe link. Personal trainer: separate contacts who came to a trial session (clients) from those who only asked for a price (prospects). Lawyer: professional secrecy comes on top of the GDPR; limit access to case files and the calendar. Tradesperson: an unsigned quote creates a prospect, not a client: count three years from the last exchange. To turn a clean file into loyal clients, our guide on how to build client loyalty gives concrete methods.

How Calendrio helps you keep a clean client file

In Calendrio, each client has a record with their appointment history and your private notes: everything is in one place, which makes an access or correction request easier to handle. You can sort your clients by category and mark a contact as "personal" to exclude them from campaigns.

Every email or SMS campaign sent from Calendrio automatically includes a link to stop receiving messages; an unsubscribed client is flagged on their record and no longer receives your campaigns. Plans are presented on the Pricing page, with a one-month free trial, no credit card and no commitment.