Most copywriters, web designers, virtual assistants and graphic designers make the grievous error of believing that data privacy laws only apply to multinational conglomerates. This could not be further from the truth – data compliance regulations apply to any entity that collects email addresses, maintains customer databases, processes billing information or any other personal identifying information (PII) of their clients. Mishandled data exposes freelancers to crippling litigation costs, reputational damage and immediate termination of contracts – a devastating triad for any professional service provider.
This guide will outline the basics of international data privacy laws, explain your compliance obligations as a data processor and offer actionable best practices for maintaining full regulatory adherence.
Privacy legislation may seem like an impenetrable mass of legalese, but most data protection laws have the same goal: protecting individual rights to their personal data. To make sense of the GDPR, LGPD and countless other long acronyms remember this simple truth – everyone has the right to know how their data is collected, stored and ultimately used. Understanding the nuances of the different data privacy laws is crucial to your compliance success but first, you need to understand your role in this framework. Laws are designed around two basic categories of data handlers:
A Data Controller makes decisions about what personal data to collect and what to do with it. In 95% of cases, your client will be the Data Controller. They make the decisions to collect user data on their website or application and determine what information should be processed.
A Data Processor, on the other hand, is a company or individual that processes data on behalf of a Data Controller. In essence, that makes you the Data Processor as you carry out instructions to collect or store information. Modern data privacy laws impose strict liability on Data Processors, meaning you are fully accountable for any data breaches. Your ability to blame the client for lax security practices is significantly diminished.
To develop your own privacy compliance framework it helps to identify the different stages of the document lifecycle. Every paper trail that goes through your hands as a freelancer goes through four stages:
Each of these phases has specific data security implications that should be taken into account.
Secure File Intake
When collecting documents from clients ensure they arrive at a secure location. Avoid asking clients to send files as plain text documents via social media or personal email. Set up a dedicated encrypted folder for file intake or request that they send them directly to a secure cloud storage service.
Isolated File Storage
Avoid storing multiple clients data in one disorganized folder on your computer. Besides being unprofessional, this exposes you to increased liability. If one client were to use their right to erasure (the right to delete all their information from your systems) it would be much easier to delete just their data without impacting other customers.
File sharing is the single biggest vulnerability in the data security lifecycle of any freelancer. Take a step back and think about how you currently share documents with clients.
If you routinely save them as standard PDFs and attach them to standard email chains you are potentially exposing yourself to massive data security liability. Traditional email is incredibly insecure as email communication is transmitted in standard text format over the internet. This means that anyone who can access the email string can view the attached data – including tax ids, addresses and other sensitive information.
Additionally, if a malicious actor were to hack into your personal email account, they could simply go through your “sent” items and exfiltrate sensitive documents from all your past clients. You need to drastically reduce exposure by limiting the use of standard file sharing practices. Any document containing sensitive, private or financial information must be encrypted when sent to clients.
You do not need to employ expensive cybersecurity experts to transform your freelance practice into a full-fledged enterprise ready for multi-national contracts. By implementing a few simple measures and utilizing the complimentary utilities at AriaToolz you can rapidly develop a comprehensive data security strategy.
For any document shared with a client utilize the AriaToolz Protect PDF tool to secure the file. Set a strong password using a combination of letters, numbers and special characters and ensure the file only be opened by someone with the password. Send the encrypted file to the client and ensure the password is delivered via a separate secure method (ideally an encrypted messaging service).
Do not keep documents indefinitely on your computer or cloud storage services. Set a quarterly reminder for yourself to review the files you are storing and delete any documents that are no longer relevant. If a project has concluded and there is no operational requirement to keep a customer’s data it is best to delete them.
Ensure all software programs, cloud services and email accounts utilized for work have Multi-Factor Authentication enabled. This provides an additional layer of security beyond standard passwords, ensuring that even if someone does guess or discover your password, they will not be able to simply brute-force their way into your accounts.