How to Handle GDPR Data Requests as a Solo Consultant

You just got an email: “Under GDPR Article 15, I request access to all personal data you hold about me.” Your stomach drops. You’re a solo consultant—you don’t have a legal team or a compliance department. What do you do?

Here’s the reality: GDPR applies to you if you have even ONE client in the EU. But handling data requests doesn’t require a law degree or expensive software. Here’s exactly what to do.

Understanding GDPR Data Subject Rights

What Clients Can Request

Under GDPR, individuals (data subjects) have eight rights:

1. Right to Access (Most Common)

• Request copy of all personal data you hold
• Ask what data you’re processing and why
• Know who you’re sharing it with
• You have 30 days to respond

2. Right to Rectification

• Request correction of inaccurate data
• Ask you to complete incomplete data
• You have 30 days to respond

3. Right to Erasure (“Right to be Forgotten”)

• Request deletion of their personal data
• Only in specific circumstances (not absolute)
• You have 30 days to respond

4. Right to Restriction

• Request you stop processing their data (but don’t delete it)
• Used when accuracy is disputed or processing is challenged
• You have 30 days to respond

5. Right to Data Portability

• Receive their data in machine-readable format
• Request transfer to another controller
• You have 30 days to respond

6. Right to Object

• Object to processing based on legitimate interests
• Absolute right to object to marketing
• You must respond immediately for marketing, otherwise 30 days

7. Right Not to Be Subject to Automated Decision-Making

• Not relevant for most solo consultants

8. Right to Withdraw Consent

• If processing is based on consent, they can withdraw anytime
• Must be acted upon immediately

What Counts as Personal Data

Personal data is broader than you think:

Obviously Personal Data

• Name
• Email address
• Phone number
• Physical address
• IP addresses
• Social security numbers
• Photos of the person

Less Obviously Personal Data

• Project files with their company name
• Emails from them
• Calendar entries with their name
• Contract drafts with their signature
• Invoice history
• Payment information
• Notes from meetings mentioning them
• Feedback or testimonials they provided

Rule of thumb: If you can identify a specific person from the data, it’s personal data.

Handling a Data Access Request (SAR)

Step 1: Verify the Request Is Legitimate

Check for:

• Request in writing (email counts)
• From the actual data subject (or authorized representative)
• Clear identification of what they’re requesting
• Confirmation of their identity (ask for verification if needed)

Example verification email:

Subject: Re: GDPR Data Access Request - Identity Verification

Dear [Name],

I've received your request for access to personal data under GDPR Article 15.

To protect your privacy, please confirm your identity by:
1. Replying from the email address you used when engaging our services: [email]
2. Providing the last 4 digits of the invoice number from our last transaction
3. Confirming the approximate date of our last interaction

Once verified, I'll provide your requested information within 30 days.

Best regards,
[Your Name]

Step 2: Search for All Personal Data

Where to look:

Step 3: Compile the Data

Create a structured package:

[Client Name] - GDPR Access Request Response/
├── 1. Summary Letter
├── 2. Personal Information/
│   ├── Contact Details.pdf
│   ├── Contract and Agreements.pdf
│   └── Payment Records.pdf
├── 3. Communications/
│   ├── Email Correspondence (Redacted).pdf
│   └── Meeting Notes.pdf
├── 4. Project Files/
│   ├── [Project Name] Files/
│   └── Deliverables.pdf
└── 5. Processing Information/
    └── How We Use Your Data.pdf

Summary Letter Template:

Subject: Response to GDPR Data Access Request

Dear [Name],

This letter responds to your data access request received on [DATE] under GDPR Article 15.

PERSONAL DATA WE HOLD:

1. Contact Information
   - Name, email, phone, business address
   - Stored in: [CRM/Email/File system]
   - Retention period: [Duration]

2. Contractual Data
   - Service agreements, SOWs, NDAs
   - Stored in: [Location]
   - Retention period: 7 years (legal requirement)

3. Financial Data
   - Invoice history, payment records
   - Stored in: [Accounting software]
   - Retention period: 7 years (tax requirement)

4. Project Data
   - Project files, deliverables, communications
   - Stored in: [Project management system/Drive]
   - Retention period: [Duration]

PURPOSE OF PROCESSING:
We process your personal data to:
- Fulfill our contractual obligations
- Communicate about project delivery
- Manage invoicing and payments
- Comply with legal obligations (tax, contract law)

WHO WE SHARE DATA WITH:
- [Payment processor] (for invoicing)
- [Cloud storage provider] (for file storage)
- [Accounting software] (for financial records)
- No data is sold or shared for marketing purposes

YOUR RIGHTS:
You have the right to:
- Request correction of inaccurate data
- Request deletion (subject to legal retention requirements)
- Object to processing
- Lodge a complaint with your supervisory authority

Attached are all personal data files we hold about you.

If you have questions, please contact me at [email].

Best regards,
[Your Name]
[Business Name]

Step 4: Redact Third-Party Personal Data

Important: You cannot disclose other people’s personal data when responding to a request.

Example: Email thread with client and two other people:

• Include the requester’s messages fully
• Redact names, email addresses, and content from others
• Note: “Third-party personal data redacted under GDPR Article 15(4)“

Step 5: Deliver the Response Securely

DO NOT email unencrypted files containing personal data.

Secure delivery options:

1. Encrypted email service

   • ProtonMail, Virtru, Hushmail
   • Password-protected ZIP (password sent separately)

2. Secure file transfer

   • Tresorit Send
   • Dropbox Transfer with password
   • Your client portal if they have access

3. Physical mail (for very sensitive data)

   • Registered mail requiring signature
   • Include USB drive with encrypted files

4. In-person (if local)

   • Verify identity in person
   • Hand over physical copy or USB

Handling a Deletion Request (Right to Erasure)

Step 1: Determine If You Must Comply

You CAN refuse deletion if:

• You need the data to fulfill a contract
• You have legal obligation to retain (e.g., tax records)
• The data is needed for legal claims
• You have compelling legitimate grounds that override their rights

Common legitimate refusal reasons for consultants:

Dear [Name],

I've received your request for deletion under GDPR Article 17.

I must respectfully decline your request for the following reasons:

1. Contractual Necessity: We need to retain your contract, SOW, and project deliverables for potential warranty claims and liability defense.

2. Legal Obligation: Tax law requires us to retain invoices and payment records for 7 years. Financial data cannot be deleted until [DATE].

3. Legal Claims: Given the dispute over [project/payment], we must retain all related communications and project files until resolution.

However, I can:
- Restrict processing to storage only (no active use)
- Delete marketing communications and contact lists
- Remove you from any future marketing
- Delete project files after [legal retention period]

If you wish to proceed with restricted processing, please confirm.

Best regards,
[Your Name]

Step 2: If You Must Comply, Delete Thoroughly

What to delete:

• Active files and databases
• Email archives
• Backup systems (or mark for deletion at next backup cycle)
• Third-party processors (notify them to delete)
• Physical files (shred)
• Cached data

Documentation to keep (even after deletion):

• Log that request was made
• Log that deletion was completed
• Basic record showing you fulfilled your obligation
• (These should not contain the full personal data)

Deletion confirmation template:

Subject: Confirmation of Data Deletion - GDPR Article 17

Dear [Name],

I confirm that your personal data has been deleted from our systems as requested under GDPR Article 17.

DATA DELETED:
- Contact information from CRM
- Project files and communications
- Email archives
- Marketing lists
- Cloud storage backups

DATA RETAINED (Legal Requirement):
- Invoices and payment records (7-year tax retention requirement)
- Minimal contract metadata for accounting audit trail

All retained data is restricted to storage only and will be deleted on [DATE] when legal retention periods expire.

This completes your deletion request.

Best regards,
[Your Name]

Handling Other Request Types

Rectification Request

"The email address on file is incorrect. Please update to [new email]."

Response:

1. Verify identity
2. Update all systems
3. Confirm in writing

Template:

Dear [Name],

Your rectification request has been completed. We've updated your email address from [old] to [new] in:
- Our CRM system
- Email contacts
- Invoicing software
- Client portal

If you identify any other inaccuracies, please let us know.

Best regards,
[Your Name]

Restriction Request

"I dispute the accuracy of the meeting notes from [date]. Restrict processing until we resolve this."

Response:

1. Stop using the disputed data
2. Mark it as “restricted” in your systems
3. Store but don’t process
4. Resolve the dispute
5. Lift restriction or delete

Portability Request

"I want all my project files in a format I can give to my new consultant."

Response:

1. Provide structured data in common formats (CSV, JSON, PDF)
2. Use machine-readable formats where possible
3. Include explanatory documentation

Prevention: Reduce Request Complexity

Good Data Hygiene Prevents Headaches

1. Centralize Client Data

• Use one CRM/client portal
• Don’t scatter data across 10 tools
• Makes searching much easier

2. Regular Data Purging

• Delete old data you don’t need
• If you don’t have it, you don’t have to produce it
• Keep only what’s necessary

3. Clear Retention Policies

• Document how long you keep different data types
• Automate deletion where possible
• Review annually

4. Tag and Organize

• Tag files with client names
• Use consistent naming conventions
• Makes searching faster

5. Privacy by Design

• Only collect data you actually need
• Don’t ask for unnecessary personal information
• Minimize data in contracts and forms

GDPR Request Handling Checklist

When you receive a request:

• Acknowledge receipt within 48 hours
• Verify requester’s identity
• Note 30-day deadline on calendar (with 7-day warning)
• Search all systems for personal data
• Compile data into organized package
• Redact third-party personal data
• Write response letter explaining data held
• Deliver via secure method
• Document the request and response in compliance log
• Consider if changes to data practices needed

Tools to Make This Easier

For Solo Consultants

Basic Setup (Low Cost):

• Google Workspace - Centralized email and files ($6-12/mo)
• Notion or Airtable - Simple CRM ($0-10/mo)
• Wave or FreshBooks - Invoicing ($0-15/mo)
• ProtonMail - Secure delivery ($5/mo)

Total: $20-40/month

Better Setup (More Automated):

• HubSpot CRM - Free, good search
• Practice Ignition or Dubsado - Client management ($20-40/mo)
• Xero or QuickBooks - Accounting ($15-30/mo)
• Persay - Client portal with data organization ($varies)

When You Need Legal Help

Consider consulting a privacy lawyer if:

• Request is contentious or from someone threatening legal action
• You’re unsure if you can refuse deletion
• Request involves multiple jurisdictions
• You discover you may have had a data breach
• You’re processing sensitive personal data (health, financial, children)

Cost: $200-500 for consultation on single request

Worth it when: Refusing might lead to complaint or fine

Common Mistakes to Avoid

1. Ignoring the Request

Never ignore a GDPR request. Even if you think it’s invalid, respond explaining why.

2. Taking Too Long

30 days flies by faster than you think. Set reminders. Start immediately.

3. Incomplete Searches

Don’t just check the obvious places. Backups, old emails, and forgotten cloud drives count.

4. Providing Too Much

Don’t include other people’s personal data in your response.

5. Insecure Delivery

Emailing unencrypted personal data is a GDPR violation in itself.

6. Not Documenting

Keep records of every request, your response, and what data you provided/deleted.

What If You Make a Mistake?

If you realize you:

• Missed some data in your response
• Sent it insecurely
• Didn’t delete everything you should have
• Took too long

Do this:

1. Correct immediately - Send supplement, re-delete, apologize
2. Document the error and correction
3. Assess if it’s reportable (Usually not for minor process errors)
4. Improve your process so it doesn’t happen again

Most errors are not fines if you correct them promptly and in good faith.

Conclusion

GDPR data requests seem intimidating, but the process is straightforward:

1. Verify the request is legitimate
2. Search all your systems
3. Compile data into organized package
4. Deliver securely
5. Document everything

You don’t need expensive software or a legal team. You need:

• Organized data storage
• 30 days to respond
• Secure delivery method
• Good record-keeping

Handle your first request carefully, document your process, and each subsequent request gets easier.

The best defense is good data hygiene: collect less, organize better, delete regularly. The less personal data you hold, the easier requests become.

Stay organized. Stay compliant. Stay calm.