Freelancers and creatives: How to protect client data in everyday email use

Logo designs, unpublished campaigns, briefings and invoices: as a self-employed person in the creative industry, you send sensitive content by email every day. By the time you have your first client at the latest, you also bear responsibility for other people's data, and many are not even aware of this.

What obligations result from this, and how can your daily email routine become more secure and more professional at the same time?

What data protection obligations do you have as a self-employed person?

The General Data Protection Regulation applies to the one-person design studio just as it does to a large corporation. According to Article 32 GDPR, anyone who processes personal data must ensure a level of protection appropriate to the risk. As one of the possible measures, the law explicitly mentions encryption, and that also affects your email correspondence.

Personal data is not just customer lists for newsletters and mailings. The contact details of your contact persons and the photos of employees for the new website also fall under it.

A simple and effective measure is an address with a provider of encrypted mail. Such an address also comes across as significantly more professional than the old, free address from your school days.

On top of that, there are often confidentiality agreements. Agencies and larger clients have it assured in writing that drafts and campaigns will not leak out before launch. If these files go back and forth unprotected by email, the risk increases that a data leak occurs with you, of all people, as the service provider. In the worst case, a contractual penalty follows, which can quickly push a young business to its limits. Whether insurance will cover it depends on the individual contract. Therefore, read your policy carefully before you rely on it.

What does encryption actually protect?

That depends on the type of encryption. Most mailboxes today use transport encryption, which protects the route between your email program and the server. According to the Federal Office for Information Security (BSI), the message is nevertheless present in plain text at the email provider and at the junctions of the delivery route.

The BSI considers transport encryption better than none at all. With end-to-end encryption, on the other hand, the message itself is encrypted, so that even the email providers involved cannot read it. For sensitive and personal content, the BSI therefore recommends this approach.

Why does a professional appearance begin with the sender?

With a well-thought-out corporate design, a clean invoice and an appealing presentation, you convince clients. You shouldn't skimp on the sender then: an address like "designmaus87@…" doesn't fit the standard of a professional service.

Better is an address with your name or your own domain. This includes a consistent signature that matches the rest of your appearance. If you are registered in the commercial register as a merchant, the mandatory information for business letters, such as the registry court and registration number, also belongs there. Letterhead, quotes and invoices are best made all of a piece.

Which building blocks work together here is shown in our overview of the most important elements of corporate design.

If you are just starting out as self-employed, set up the address correctly right from the start. A later change means switching over every client, every portal and every online account individually. The additional effort is enormous, and in our experience, something always slips through.

How do you send drafts and files securely?

With a few simple rules that make your everyday work much more secure.

Password protection for attachments

Sensitive files do not belong openly in the attachment. Password protection or an encrypted download link with an expiration date is the better choice. The password is never in the same email, but is sent to the recipient by phone or messenger, for example.

How to secure a document in Word with a password is shown in the lesson Encrypting a document with a password in the Word course.

Logins do not belong in plain text

Login credentials for the content management system, the hosting account or the client's social media profile have no place in an unencrypted email. If you do have to send them by email, use a provider with end-to-end encryption.

Be careful with fake inquiries

Criminals have long since discovered freelancers as a target group. Behind a supposed project inquiry with "briefing attached" there is sometimes malware. If you don't know the sender, don't open attachments without checking them. A short phone call or a follow-up question via another channel usually clears up quickly whether the inquiry is genuine.

Clean up your mailbox regularly

Many freelancers hoard old project emails including attachments for years. What you no longer need and what is not subject to a retention obligation you should delete. Invoices and business correspondence, on the other hand, you archive properly: under the Value Added Tax Act you must keep invoices for eight years, and for received and sent business letters the Fiscal Code names six years.

What this means for you

For creatives, trust is the most important capital. Secure communication therefore belongs to the service just as much as good design, and with a few steps you are on the safe side:

• Set up a business address with your own name or your own domain, ideally with a provider offering end-to-end encryption.
• Send drafts before launch only with a password or via a protected link, and share the password through a second channel.
• Check your contracts with agencies for confidentiality clauses and contractual penalties so that you know what you are liable for.
• Clean up your mailbox once a year and archive invoices separately from old project mail.

How to properly organize digital documents and emails as a freelancer from the very beginning is shown in the lesson on handling digital documents in the course on starting a business.