Data protection and website legal notices for your freelance business

Key rules

• Privacy information: Give people privacy information when you collect their data, with a short notice at each form and a full policy page.
• Legal notice: A business website must permanently show who runs it and two ways to contact them.
• Cookies: Non-essential cookies need consent before they are set; exempt cookies alone need no banner.
• Banner design: Accept and Reject must look equally prominent, and scrolling is not consent.
• Data protection officer: Most sole traders do not need one, but keep a simple record of your data uses.

Do these rules apply to you?

Yes, if you collect personal data or your website is part of your business. A contact form, newsletter, customer account, order or analytics tool all count as collecting personal data. A site that sells or promotes your services, or earns advertising income, needs a legal notice. A purely personal site does not.

Three duties follow: privacy information, a legal notice and, where you use non-essential cookies, cookie consent. The checklist, documents list and warnings below give the step-by-step detail. This page explains what each duty means.

Privacy information (GDPR)

You are the "data controller" for the personal data you handle. You must tell people what you do with their data at the moment you collect it.

Use two layers. Put a short notice next to each form, then link to a full privacy policy page. The policy must cover:

• who you are and how to contact you
• why you use the data and your legal basis
• who receives it, including transfers outside the EU
• how long you keep it
• the rights of access, rectification, erasure, objection, restriction and portability
• the right to withdraw consent
• the right to complain to the AEPD, Spain's data protection authority
• where the data came from, if you did not get it from the person

Where consent is your legal basis, leave the consent box unticked.

Legal notice (aviso legal)

If you run a business website from Spain, show these details permanently, in an easy, direct and free way: your name or business name, your address, your email and a second way to reach you, such as a phone number or contact form. Your tax ID (NIF) also goes here.

Add more only if it applies to you: registry details if you are in a public registry, professional college details for a regulated profession, authorisation details if your activity needs one, and prices including tax and delivery costs if you show prices. The documents list below spells these out.

Cookies

Cookies that are not strictly necessary need the visitor's consent before they are set. That covers analytics, advertising, personalisation and social media plugins.

Cookies needed to deliver something the visitor asked for are exempt. Examples are session, shopping basket, login, security, load-balancing and language cookies.

If you use non-essential cookies, your banner must:

• explain who you are, what the cookies are for and whether third parties are involved, with a link to the full cookie policy
• offer Accept and Reject buttons of equal prominence, plus settings by category
• use no pre-ticked boxes and set no cookies before consent
• not treat scrolling or continued browsing as consent
• make it easy to withdraw consent

Renew the choice periodically. The AEPD guidance suggests about every 24 months.

If you use only exempt cookies, you need no banner. Mention them in your privacy or cookie policy.

Record of data uses and data protection officer

Keep a simple record of your data uses, such as customers, invoicing and any employees. Small businesses are exempt only for occasional processing, and regular client data is not occasional, so the AEPD advises keeping one.

Most sole traders do not need a data protection officer. That is only required for public bodies, large-scale monitoring, or large-scale sensitive data.

Enforcement

The AEPD enforces these rules, and fines can apply for cookie and website notice failures.

Choosing between options

Does your website need a cookie banner?

• Add a cookie banner: Your site uses any cookie that is not strictly necessary, such as analytics, advertising, personalisation or social media plugins.

• No banner, just a mention in your policy: Your site uses only strictly necessary cookies, such as session, login, shopping-basket, security, load-balancing or language cookies.

If any one cookie is not strictly needed to deliver what the visitor asked for, you need prior consent and a banner.

Timeline and deadlines

• Set up your cookie banner and block non-essential cookies: before your site is live and before any cookie is set

• Ask visitors for their cookie choice again: about every 24 months

Documents you need

• Legal notice (aviso legal) on your website: your name or business name, address, email, a second contact means such as a phone number or contact form, and your tax ID (NIF). You write and publish it yourself, and it must be permanently, easily and freely visible.

• Registry details in the legal notice, only if you are registered in a public registry such as the Registro Mercantil.

• Professional details in the legal notice, only for a regulated profession: your professional college number, title, the state that issued it and the professional rules that apply, with how to read them.

• Authorisation details in the legal notice, only if your activity needs administrative authorisation: the name of the body that authorised you.

• Clear prices in the legal notice or on the page, only if you show prices: they must include tax and delivery costs.

Checklist

• Publish a privacy policy page that names you and your contact details, why you use the data, the legal basis, who receives it, how long you keep it and where it goes abroad.

• List the rights of access, rectification, erasure, objection, restriction and portability, the right to withdraw consent and the right to complain to the AEPD, Spain's data protection agency.

• Put a short notice next to every form that collects data, with a link to the full policy.

• List the cookies on your site and mark which are strictly necessary and which are not.

• Add a cookie banner with Accept and Reject buttons of equal prominence, a settings option by category and a link to your cookie policy.

What to watch out for

• Cookies set before consent: Analytics, advertising or social media cookies that load before the visitor agrees break the rules, and scrolling or continuing to browse does not count as consent. The AEPD can fine you. Block every non-essential cookie until the visitor clicks Accept, and make withdrawing consent as easy as giving it.

• A banner that pushes people to accept: A banner with a bigger Accept button, pre-ticked boxes or no clear Reject option is not valid consent. Show Accept and Reject with equal prominence and leave all category boxes unticked.

• Skipping the record of data uses: Using client data regularly means the exemption for small businesses usually does not apply to you, so a missing record can cause problems in an inspection. Keep a short record of customers, invoicing and employees, if you have any.

Frequently asked questions

Do I need a cookie banner if my site only uses a session or language cookie?

No, a site that uses only strictly necessary cookies, such as session, login, shopping-basket, security or language cookies, does not need a cookie banner. You should still mention those cookies in your privacy or cookie policy.

How often do I have to ask visitors for cookie consent again?

You should renew the cookie choice periodically, and the AEPD guide suggests about 24 months. Visitors must also be able to withdraw their consent as easily as they gave it.

Do I need a data protection officer as a sole trader?

No, most sole traders do not need a data protection officer. One is only required for public authorities, large-scale monitoring of people, or large-scale use of health or criminal data, plus a few listed entities such as schools, insurers and financial institutions.

Does my website need a legal notice if I only promote my services?

Yes, a website that promotes your services or earns advertising income needs a legal notice if you are established in Spain. Only purely personal sites are excluded.