[Updated August 2026]
Our goal with this article is to help you, as a self-employed professional, understand what you need to do to comply with the GDPR (Regulation (EU) 2016/679 of 27 April 2016). But before that, let us share some advice we think is worth knowing.
Content
1. Companies that sell you GDPR compliance “at zero cost”
The Spanish Data Protection Agency (AEPD) itself warns about this kind of offer on its website. Hiring this type of company can lead to several problems:
- Zero cost usually means the service is financed with funds earmarked for subsidised training — a setup that can trigger a penalty from the Labour Inspectorate.
- Because these companies are VAT-exempt for their training activity, they often fail to apply the correct 21% VAT to compliance services, which can lead to tax penalties.
- GDPR compliance isn’t a one-size-fits-all procedure. The same generic dossier can’t apply to every client — you need a review that fits your company’s specific data processing.
- Because this is still a relatively unfamiliar subject for many, some companies take advantage of that and “sell” you services you don’t actually need under the regulation — such as appointing a Data Protection Officer (DPO) when it isn’t required.
The DPO is one of the key figures under the GDPR and a guarantor of compliance within organisations. According to Article 34 of Organic Law 3/2018 (verified current as of 2026), the following entities — among others — must appoint a DPO: professional associations, educational centres, insurance companies, providers of electronic communications networks, electricity and natural gas distributors and retailers, health centres, and private security companies.
If your business isn’t on the list in Article 34, you don’t have to appoint a DPO.
2. What do you actually have to do to adapt your business to the GDPR?
The AEPD offers a tool called FACILITA RGPD, now in its updated 2.0 version, which I find easy and intuitive to use — though you’ll need some patience to get through the whole process.
This tool is designed for businesses and self-employed people who handle low-risk personal data, such as basic information about clients, suppliers, or staff.
The AEPD is clear that this tool must not be used for processing that carries a high risk to people’s rights and freedoms, such as health data or large-scale data processing.
3. Advantages of FACILITA RGPD
If you answer the questionnaire truthfully, it helps you assess your actual situation regarding personal data processing.
That way, you’ll know whether you can adapt your policy using the tool, or whether you need a full risk analysis instead. In the latter case, I’d recommend putting your GDPR compliance in the hands of a data protection professional so it’s implemented with all the right guarantees.
4. Documents generated by FACILITA RGPD
After answering the questionnaire and filling in a form with your business details (which the AEPD deletes after you finish), the tool generates several editable documents adapted to your company:
- Information clauses to include in your personal data collection forms.
- Contractual clauses to attach to your data-processing contracts.
- The record of processing activities.
- An annex with minimum indicative security measures.
5. Walking through the tool
Here’s a quick summary of what to expect when you run FACILITA RGPD:
- With three questions, it determines whether you fall among entities that process low-risk personal information.
- If you answer these three questions negatively, the tool considers your organisation to involve a low level of risk, and you can proceed to generate the documents.
- You fill in a form with your details, which the tool uses to generate documents adapted to your company.
- It then asks about the personal data you process: information on clients, potential clients, employees, candidates, and suppliers.
- If you capture images through video surveillance for security purposes, you’ll indicate that too.
- Finally, you’ll list the companies you’ve contracted for services such as website maintenance, software development, hosting, email, cleaning, or video surveillance.
6. What the AEPD expects you to do next
- Include the information clauses in your data collection forms — whether on paper or on your website.
- Implement the technical and organisational measures indicated in the corresponding document.
- Review your existing contracts and add the contractual clauses, signing the last page.
- Draft any contracts you don’t yet have, including and signing the contractual clauses.
- Keep all documents safe and up to date.
- Remember: you don’t need to send anything to the AEPD proactively — only if they request it.
7. A note on AI tools and personal data
If you use AI tools in your business that process personal data — for example, an AI assistant handling customer enquiries or CVs — keep in mind that the EU’s AI Regulation adds a further layer of obligations on top of the GDPR for certain uses. This wasn’t a consideration when this article was first published, but it’s increasingly relevant for freelancers using AI in their day-to-day operations.
Frequently Asked Questions (FAQs)
Do I need a DPO as a freelancer?
Only if your activity falls within the entities listed in Article 34 of Organic Law 3/2018 — most freelancers and small businesses don’t need one.
Is FACILITA RGPD still free?
Yes, it remains a free tool provided directly by the AEPD.What happens if I don’t comply with the GDPR as a self-employed professional? You can face fines from the AEPD, which vary depending on the severity of the infringement — it’s worth taking basic compliance seriously even as a small operation.
Related articles
The Minimum Contribution Base Of The Self-employed In Spain