Freelancers and Consultants: How to Protect Your Clients' Data Without an IT Department

You take on a new client. Within a week, your laptop holds their financial spreadsheets, a folder of contracts, a few thousand words of strategy notes, some screenshots from their internal tools, and maybe a database export they emailed you "just to save time." You are now, whether you signed up for it or not, the custodian of another company's sensitive data. And unlike them, you have no IT department, no security team, no compliance officer. It is just you and a laptop that goes to cafés.

This is the quiet risk at the center of freelance and consulting work. Clients hand you access because they trust you personally, but the legal and reputational exposure is real. If your laptop is stolen, if a sync folder leaks, if a cloud account gets breached, it is your client's data on the loose and your name attached to the incident. This article is a practical guide to protecting client data when you are a one-person shop. No jargon, no fear-selling, and an honest account of what actually moves the needle versus what just feels productive.

Quick answer

As a freelancer or consultant, you can protect client data to a genuinely professional standard without any IT department by doing four things: encrypt your device with full-disk encryption (FileVault, BitLocker or LUKS), keep working copies of client files inside a client-side encrypted app so the files stay unreadable even if a sync service is breached, use a password manager with unique passwords and two-factor authentication on every account, and delete or hand back client data when the engagement ends. Encryption is your single highest-leverage control, because it turns a lost laptop or a breached cloud account from a reportable data breach into a non-event. It does not, on its own, make you GDPR compliant, that depends on your whole way of working, but it is the foundation everything else sits on.

Why this keeps freelancers up at night

The anxiety is not irrational. A few things make solo consultants uniquely exposed.

You concentrate risk. A salaried employee at your client's company touches one company's data. You might hold data from five clients at once, across industries, on the same machine. A single compromise can spill several clients simultaneously.

You are the whole attack surface. There is no separate work laptop locked in an office, no managed device with enforced policies, no network firewall someone else maintains. Your personal machine, your personal cloud accounts and your habits are the entire perimeter.

You are legally on the hook. Under the GDPR, when a client (the data controller) entrusts you with personal data to process on their behalf, you are typically a data processor. Article 28 requires that arrangement to be governed by a contract, usually a Data Processing Agreement, and Article 32 requires you to implement "appropriate technical and organisational measures" to secure the data. Encryption is named explicitly in Article 32 as an example of such a measure. In plain terms: securing client data is not a nice-to-have you can wave away because you are small. It is a legal obligation that scales down to you.

And the failure mode is brutal for a freelancer. A big company survives a breach headline. A consultant whose reputation is their entire business does not easily survive "the contractor lost our client list."

This article is not legal advice, and it cannot tell you your exact obligations, those depend on your clients, your jurisdiction and the data involved. What it can do is show you the technical controls that consistently reduce your risk, and where the honest limits are.

The four controls that actually matter

Most security advice for small operators is a wall of tips. You do not need forty habits. You need four controls done properly, in roughly this order of leverage.

1. Encrypt the device itself

Start here because it is free, built in, and protects against the single most common incident: a lost or stolen laptop. Full-disk encryption means that if someone steals the machine, the drive is unreadable without your login. Turn on FileVault on macOS, BitLocker on Windows Pro (or device encryption on Home), and use LUKS on Linux. This takes ten minutes and closes off an entire category of "laptop left on a train" disasters.

But understand what full-disk encryption does not do. It protects data when the machine is off. Once you log in, everything is decrypted and readable by any app running as you, and it does nothing for files you sync to the cloud or copy onto a USB stick. It is necessary and nowhere near sufficient. The distinction between disk-level and file-level protection is worth understanding properly, and it is covered well in this walkthrough of full-disk versus client-side encryption for notes and files.

2. Keep client files in a client-side encrypted app

This is the control that separates hobby-grade from professional-grade. Full-disk encryption protects the laptop; client-side encryption protects the files themselves, everywhere they go.

The key idea is that the file is encrypted on your device, with a key only you hold, before it ever touches a sync server. So even if your cloud provider is breached, subpoenaed, or simply careless, what leaks is unreadable ciphertext rather than your client's actual contracts. This is the difference between an embarrassing but harmless incident and a reportable breach. The concrete stakes are laid out plainly in this comparison of what leaks in classic cloud storage versus local encryption during a breach: one scenario spills readable documents, the other spills noise.

There is important vocabulary here that vendors blur on purpose. "Encrypted at rest" often just means the provider encrypts your data with keys the provider holds, which protects against a stolen hard drive in their data center but not against the provider itself, a rogue employee, or a legal demand. "Zero-knowledge" or true end-to-end means the provider structurally cannot read your data because they never have the key. For client data, you want the second kind. If you only read one explainer, make it this breakdown of zero-knowledge versus end-to-end versus encrypted at rest, because most "secure" tools quietly sit in the weakest category.

3. Lock down accounts with a password manager and 2FA

Encryption on the device is undone if an attacker just logs into your accounts. The two habits that matter: a password manager so every account has a unique, strong password, and two-factor authentication on everything that holds or accesses client data, especially your email, because your email is the reset mechanism for everything else. This is unglamorous and it is the highest return on ten minutes of effort you will ever get. A leaked password from some unrelated site should never be able to open your client's project folder.

4. Have an exit plan for data

Data you no longer hold cannot leak. When an engagement ends, delete the client's files or hand them back, and remove their access from any shared systems. Retention is not just tidiness, under the GDPR's data minimisation and storage limitation principles you should not keep personal data longer than you need it. As a processor, your contract with the client should also say what happens to their data at the end. A simple habit, a per-client folder you can encrypt, archive and then wipe cleanly, makes this painless. Keeping each client cleanly separated from day one is far easier than untangling five clients' files out of one big desktop mess later.

Comparing your realistic options

Where should client working files actually live? Here is an honest comparison of the common setups a freelancer reaches for.

Setup	Protects a stolen laptop	Protects against cloud breach	Provider can read files	No-cost floor	Realistic for a solo operator
Plain folders + Dropbox/Drive	No	No	Yes	Free tier	Very easy, but weakest
Full-disk encryption only	Yes (when off)	No	N/A (no sync)	Free	Easy, but no cloud safety
Mainstream cloud "encrypted at rest"	Partly	No	Yes	Varies	Easy, false sense of security
Client-side / zero-knowledge encrypted app	Yes	Yes	No	Often free locally	Easy once set up
Self-hosted server you run	Depends	Depends on your setup	Depends	Server cost + your time	You become the IT department

The row people underestimate is "mainstream cloud encrypted at rest." It sounds secure and it markets itself as secure, but the provider holds the keys, so it fails exactly the scenario you most fear. The self-hosting row is the opposite trap: it can be excellent, but running your own server means you have quietly re-hired the IT department you were trying to avoid, complete with patching, backups and uptime. For most solo consultants, a client-side encrypted app with optional sync is the sweet spot of strong protection and low operational burden.

What this looks like in a normal week

Theory is cheap. Here is the workflow translated into something you would actually do.

When a project starts, create one dedicated space per client so their notes and files never bleed into each other or into your personal stuff. Drop everything for that client in there: the brief, the contracts, the working documents, the screenshots, the scratch notes. Because the whole space is encrypted on your disk, you are not making a security decision file by file, the default is safe.

As you work, link things together instead of hunting through folders. A meeting note references the PDF it came from; a deliverable links back to the source data. This is not just tidiness, it means that six months later you can actually reconstruct why you made a decision, which is its own form of professional protection. If you want to see how connecting notes and documents this way pays off, this guide on organizing notes and files together with a graph walks through it.

When you need to send a client a file, avoid emailing sensitive attachments around, since email is not confidential. Prefer a link where the decryption key never reaches the server, so the host cannot read what you shared. And when the engagement wraps, archive that one client space, deliver what you owe, and wipe your working copy on the agreed schedule.

None of this requires an IT department. It requires picking tools whose safe behavior is the default, so that being secure is the path of least resistance rather than a discipline you have to sustain.

Where Filarr fits, honestly

Filarr is one option for the second control above: a local-first, encrypted workspace where your notes and files live together on your own machine. Every file is encrypted individually with AES-256-GCM, using a per-file key that is itself wrapped by a key derived from your password (PBKDF2-SHA512 at 600,000 iterations, with Argon2id available as an option). It works fully offline with no account required, and cloud sync is optional, when you do sync, files upload already encrypted and the server stores only opaque blobs it cannot read. Recovery runs through a 24-word BIP-39 phrase, so losing your laptop does not mean losing the data. Multiple workspaces let you keep each client cleanly separated. It is free forever for local use, with sync starting at 4 euros per month, and the desktop client is open source under BSL 1.1. If you want the full architecture, the team wrote up how the optional cloud sync stays zero-knowledge.

Now the honest limits, because you should not pick a tool on marketing. Filarr is a young project (2026), the mobile app is still in progress, and its plugin ecosystem is far smaller than something like Obsidian's. More importantly, and this is the part no tool should let you forget: encryption is one control, not compliance. Filarr encrypts your files. It does not sign a Data Processing Agreement for you, it does not make you GDPR compliant on its own, and it is not legal advice. Your compliance depends on your whole way of working, your contracts, your retention habits, how you handle client requests, not on a single app. Treat encryption as the strong foundation it is, and build the rest of your practices on top.

Practical checklist

• Turn on full-disk encryption today (FileVault, BitLocker or LUKS). Ten minutes, zero cost.
• Keep client working files in a client-side encrypted app, not plain folders in mainstream cloud storage.
• Learn the difference between "encrypted at rest" (provider holds keys) and zero-knowledge (only you do), and prefer the latter for client data.
• Use a password manager plus 2FA on every account, especially email.
• Separate each client into its own space from day one.
• Never email sensitive attachments; share via links where the key stays with you.
• Sign a Data Processing Agreement with clients when you process personal data on their behalf, and agree what happens to data at the end.
• Delete or hand back client data when the engagement ends; do not hoard it.
• Remember that encryption reduces risk dramatically but is not, by itself, compliance or legal advice.

FAQ

Do I really have GDPR obligations as a solo freelancer?

Very likely yes, if you handle personal data on behalf of clients. Being small does not exempt you. When a client entrusts you with personal data to process for them, you are generally a processor, which means a Data Processing Agreement under Article 28 and appropriate security measures under Article 32, encryption being a named example. The exact scope depends on your work and jurisdiction, so treat this as a prompt to get specifics, not as legal advice.

Isn't full-disk encryption enough on its own?

No. It is essential and it protects a lost or stolen laptop when the machine is off, but once you log in the data is decrypted, and it does nothing for files you sync to the cloud or copy elsewhere. You need file-level, client-side encryption on top of it to protect data as it travels and syncs.

My cloud provider says my data is encrypted. Am I covered?

Check who holds the keys. "Encrypted at rest" usually means the provider encrypts your data with keys the provider controls, which does not protect you against the provider itself, a rogue insider, or a breach where keys are also exposed. For client data you want zero-knowledge or true end-to-end encryption, where the provider structurally cannot read your files.

How do I send a sensitive file to a client safely?

Avoid email attachments for anything confidential, since email is not a private channel. Use a sharing method where the decryption key stays out of the server's reach, so the host only ever sees encrypted data. Combined with a strong, unique password on both ends, this keeps the file readable only to you and your client.

Should I self-host to be fully in control?

Only if you genuinely want to run and maintain a server, patching, backups, uptime and all. For most solo consultants, self-hosting quietly recreates the IT department you were trying to avoid. A client-side encrypted app with optional zero-knowledge sync gives you most of the ownership benefits with a fraction of the operational burden.