If you’re a freelancer or sole trader, you might assume cybersecurity advice is aimed at businesses with IT departments and proper office networks. Fair enough — most of the content out there does assume a certain organisational scale. But working for yourself doesn’t reduce your risk; it just means you’re the IT department.

Your data matters. Your clients’ data matters. Your reputation matters. And in the UK, the ICO does not have a minimum company size for GDPR enforcement. So here’s what actually applies to you.

Your Data Is Worth Stealing

The first misconception to get past: “I’m not interesting enough to be hacked.” Freelancers and sole traders are often specifically targeted precisely because they’re perceived as having lower security. You may hold client contact details, contracts, financial records, and access to client systems (if you’re a developer, designer, or consultant). That’s valuable to an attacker.

The most common attacks against sole traders aren’t sophisticated. They’re phishing emails designed to steal your email credentials, invoice fraud targeting your clients or suppliers (impersonating you to redirect payments), and account takeover attempts on services like your accounting software, cloud storage, or email provider.

The Basics, Honestly Assessed

Use a password manager. If you’re still reusing passwords or keeping them in a spreadsheet, this is your first move. 1Password and Bitwarden both have solo plans that cost around £2-3 per month. Every service you use gets a unique, strong password. This alone prevents the majority of credential-based account takeovers.

Turn on two-factor authentication for everything that matters. Your email account is the most critical — if an attacker gets into your email, they can reset every other password you have. Use an authenticator app (Aegis on Android, Raivo on iOS) rather than SMS where possible, since SIM swapping is a real attack that bypasses SMS codes. Gmail, Outlook, and most business email providers support app-based 2FA.

Keep your devices updated. Software updates fix security vulnerabilities. Running macOS or Windows a year behind on updates is the security equivalent of leaving your front door unlocked. Enable automatic updates and actually install them.

Back up your work. Ransomware does hit freelancers. The standard approach is 3-2-1: three copies of important data, on two different media types, with one off-site. In practice for a sole trader this often means your main device, a regularly-synced cloud service (iCloud Drive, OneDrive, Google Drive), and an external hard drive that you update monthly. If ransomware hits your laptop, you should be able to restore from your cloud backup without paying anything.

GDPR: What You Actually Need to Worry About

If you handle personal data about other people in the course of your work — client contact details, details of individuals in your client’s business, customer lists, anything like that — GDPR applies to you. The ICO’s guidance is clear that sole traders processing personal data are data controllers.

The practical implications:

  • You need a lawful basis for holding personal data (legitimate interests or contract performance covers most business data)
  • You should only keep personal data for as long as you actually need it
  • If you use any third-party tools that process personal data (a CRM, your accounting software, a mailing list tool), you should check they have GDPR-compliant data processing terms
  • If you have a website that collects contact form submissions, you need a privacy notice

Does the ICO come after sole traders? Not routinely for minor issues. But if there’s a data breach and you’ve made no effort to secure personal data, and that breach affects someone’s rights, the ICO can and does take action. The more significant risk is reputational — losing a client’s trust because you lost their data is a much more immediate consequence than a fine.

If you process more than minimal personal data, particularly if you work in sectors like healthcare, law, or HR, registering with the ICO (£40-£60/year for small organisations) is required and also signals to clients that you take data handling seriously.

Protecting Client Access

Many freelancers end up with access to client systems: CMS logins, code repositories, cloud infrastructure, social media accounts. When you’re given this access, think about how it’s stored and what happens when the engagement ends.

Use your password manager for client credentials rather than keeping them in a notes file. When a contract ends, ask the client to revoke your access rather than assuming they will (they often don’t, and stale credentials are a security risk on both sides). If you’re using a service like 1Password Teams or Bitwarden for Business, you can share specific vault items with clients securely rather than sending passwords via email.

Be cautious about which personal accounts you use for client work. If you join a client’s Slack workspace with your personal account, and they later have a data incident, your personal account may be in scope. Keeping a separate professional email address for client work creates a cleaner boundary.

Business Email Compromise Targeting Freelancers

Business email compromise (BEC) works in two directions for freelancers. First, attackers impersonate you to your clients — they spoof your email address or compromise your email account and send fraudulent invoice redirect requests. Second, attackers impersonate your clients or suppliers to you.

The protection against the first is making sure your domain (if you have one) has SPF, DKIM, and DMARC records set up properly. This makes it much harder to spoof your email address. Your domain registrar or hosting provider usually has a guide for setting these up. If you just use a Gmail or Outlook personal account for business, consider getting a custom domain — it makes you look more professional and gives you control over these settings.

The protection against the second is being suspicious of any request to change payment details, regardless of who it appears to come from. Call to verify using a number from your own records, not one in the suspicious email.

What You Don’t Need to Spend Money On

To be honest about it: sole traders don’t typically need enterprise security tools. You don’t need a corporate endpoint detection and response platform, a separate corporate network, or a dedicated firewall appliance.

What you do need: a good password manager, 2FA on critical accounts, updated devices, a working backup, and awareness of the social engineering attacks most commonly used against small operators. The NCSC’s Cyber Essentials self-assessment (free to do, around £300-£500 for certification if clients require it) is worth working through even if you don’t certify — it forces you to check the boxes that matter most.

The biggest risk most sole traders face isn’t a sophisticated attack. It’s a phishing email at 11pm when they’re tired, or a password they’re reusing from an old breach. Basics, done consistently, address most of that risk without significant cost or complexity.