GDPR and Invoicing in the UK: A Practical Guide

Yes, UK GDPR applies to your invoices whenever they name an individual, which covers most invoices sent to sole traders, freelancers and the contacts at your client companies. The good news is that compliance is mostly routine: collect only what you need, rely on the right lawful basis, keep invoices secure, delete them when you no longer need them, and make sure your invoicing software is bound by a proper processor contract. This guide walks through each step in plain terms for UK freelancers, consultants, agencies and small businesses.

TL;DR

• An invoice is personal data if it relates to an identifiable person, such as a sole trader’s name, a contact’s email or a home address.
• For invoicing, the contract lawful basis normally fits, so you rarely need consent to send or store an invoice.
• Keep only the details the invoice needs, store them securely, and keep records for as long as tax law requires, then delete them.
• Your invoicing provider acts as a processor, so you need a processor contract covering the points the ICO lists.
• If an invoice goes to the wrong person, treat it as a possible personal data breach and record it straight away.

Table of Contents

• Does UK GDPR apply to invoices?
• What personal data can an invoice contain?
• Which lawful basis covers invoicing?
• How to store and secure invoices
• How long should you keep invoices?
• Choosing an invoicing provider: the processor checklist
• Our perspective on invoicing and data protection
• Wrong recipient? Handling an invoice breach
• A short GDPR checklist for your invoicing
• Invoicing without the data sprawl
• FAQ
• Sources

Does UK GDPR apply to invoices?

After Brexit the EU regulation was retained in UK law as the UK GDPR, and it sits alongside the Data Protection Act 2018. Business.gov.uk explains that these two make up UK data protection law and that the Information Commissioner’s Office (ICO) enforces them.

The question is whether your invoice contains personal data. The ICO says personal data is information relating to an identified or identifiable individual, and that it can include names, identification numbers, location data or online identifiers. The UK GDPR covers personal data processed wholly or partly by automated means, or held in a filing system. A PDF invoice stored in a cloud folder, or an invoice record in an online platform, clearly falls inside that.

When an invoice is not personal data

An invoice addressed purely to a limited company, with a generic billing address such as accounts@company.co.uk, carries little personal data. Many invoices are not that clean, though. A named contact, a direct email address, a mobile number or a sole trader’s trading name and home address all relate to an individual. If you invoice freelancers, sole traders, partnerships or consumers, assume the data is personal and handle it accordingly.

Why it matters to a small business

You are the controller of the personal data on your invoices: you decide why and how it is used. That brings duties around lawful basis, security, retention and breach handling, even if you are a one-person business. Size does not remove the obligations, but it does keep them proportionate.

What personal data can an invoice contain?

Typical personal details on a UK invoice include:

• The client’s name and the name of the person you deal with
• Billing and delivery addresses, which can be a home address for sole traders
• Email address and phone number
• Purchase order or customer reference numbers that link to an individual
• Bank details, if you are paid by transfer and the payer is an individual
• Descriptions of work that reveal something about the person, such as a health-related service or a legal matter

Your own details count too. If you are a sole trader, your name and address on the invoice are your personal data, though you are choosing to share them.

What an invoice should include, and what to leave off

The rule of thumb is data minimisation: put on the invoice what the law, the contract or getting paid requires, and nothing more. For a VAT-registered business, that means the fields HMRC expects, and we set these out in our guide to the mandatory fields on a UK VAT invoice. Beyond those, the practical list is short: your business name and address, the client’s name and address, an invoice number, the date, a description of the work, amounts, payment terms and how to pay.

Leave off anything that does not help the client pay or help you meet a legal duty:

• Personal mobile numbers when a business email will do
• Dates of birth, national insurance numbers or ID document details
• Notes about the client’s circumstances, health or finances in the line descriptions
• Full bank details of the client, which you never need on your own invoice
• Internal comments such as “slow payer, chase twice”

If you want a consistent set of fields and payment wording, our invoice payment terms examples show how to keep the document short and clear.

Which lawful basis covers invoicing?

Every use of personal data needs a lawful basis. For invoicing, the one that usually applies is contract. The ICO’s lawful basis guidance says the contract basis can apply when you need to process personal data to meet contractual obligations or process payment details, or to take a step the person requested before a contract exists, such as providing a quote.

There is a limit. The same ICO tool says the processing must be necessary for the contract, targeted and proportionate, and the basis will not apply where there is another reasonable and less invasive way to do the job. ICAEW’s helpsheet makes the same point: you can rely on contract if the processing is needed to perform it, but not if you could reasonably deliver without the personal data.

What this means in practice

The last row is the common trap. Using the email address from an invoice to send newsletters is a different purpose, and the contract basis does not stretch to cover it. Keep invoicing contacts and marketing contacts separate unless the person has agreed.

Telling clients what you do

You should explain in a privacy notice what you do with client data, including invoicing, who you share it with (your invoicing software, your accountant, a payment provider) and how long you keep it. A short page on your website or a paragraph in your terms of business is enough for most small businesses. Our billing and invoicing guide for freelancers and small businesses covers the wider paperwork around client onboarding.

How to store and secure invoices

Business.gov.uk’s guidance tells businesses to store personal data securely and protect it against loss, theft or misuse, and to delete or destroy it when it is no longer needed. The ICO’s accountability guidance adds that organisations must put appropriate security measures in place and record and, where necessary, report personal data breaches.

For invoices, that translates into habits rather than expensive tools:

1. Keep one home for invoices. Scattered copies in email attachments, downloads folders and USB sticks are the usual source of leaks.
2. Use strong, unique passwords and two-step verification on your email, cloud storage and invoicing accounts.
3. Limit access. If a bookkeeper or team member only needs to see invoice totals, do not give them the whole client list.
4. Send invoices to the right address. Check the recipient before pressing send, especially for repeat clients whose contacts change.
5. Watch for fake invoices. Phishing emails often imitate invoices to harvest credentials, and our guide to invoice phishing scams shows what to look for.
6. Keep a record of processing. The ICO explains that Article 30 requires most organisations to maintain a record of processing activities, including purposes, data sharing and retention. For a small business, a one-page table is a sensible start.

If you track what clients owe in a spreadsheet, the same discipline applies to that file. An accounts receivable tracker template is only as safe as the folder, password and sharing settings around it.

How long should you keep invoices?

Data protection law does not set a retention period. The ICO says there are no set time limits: keep personal data only as long as you need it, have a policy explaining how long and why where possible, and keep records for a set period if another law requires it. When you no longer need the data, delete or anonymise it securely.

So the answer comes from tax and accounting law. As a guide, VAT-registered businesses typically keep records for at least six years, and sole traders for at least five years after the 31 January self assessment deadline. Late returns or an HMRC enquiry can extend this, so confirm your own position on the official HMRC pages or with your accountant.

A simple retention policy

Write down three lines and follow them:

• Issued invoices: keep for the tax retention period that applies to you, then delete.
• Quotes that never became work: delete after a short, stated period, for example when the enquiry closes.
• Contact details used only for marketing: keep separately and remove when the person opts out.

The tension between keeping invoices for tax and deleting personal data under GDPR is real but manageable: the legal duty to keep records is the reason you may hold the data, and the end of that period is the trigger to delete. For a deeper look at how consent, expiry and retention interact, see this piece on consent and data retention rules.

Choosing an invoicing provider: the processor checklist

When you use online invoicing software, the provider handles your clients’ personal data on your behalf. In GDPR terms, you are the controller and the provider is a processor, and the law requires a written contract between you. The ICO says a processor contract must cover documented instructions, confidentiality, security measures, sub-processors, data subjects’ rights, assistance, end-of-contract provisions, and audits and inspections. It must also set out the subject matter and duration, the nature and purpose of the processing, the type of personal data and the categories of people concerned.

Use that list as your checklist when you pick any tool:

A payment provider such as Stripe is a separate step in the chain, so your privacy notice should mention that card payments are handled by a payment provider.

Our perspective on invoicing and data protection

We built InvoiceLabs for people who want to send a professional invoice quickly, and we think data protection belongs in that same workflow rather than in a separate chore.

The way we see it, good GDPR practice for invoicing comes down to three things: fewer places where client data lives, clear status on what has been sent and to whom, and a written processor agreement you can point to. A single platform where you create, deliver and track invoices gives you all three. You are not hunting through email threads to find which version went where.

Our platform is designed with bank-grade security, and we publish a Data Processing Agreement so you can see how we handle your clients’ data as your processor. Accountless quick invoice creation, instant delivery and live status tracking are there to help you send the right invoice to the right person and know it arrived.

We also think minimal invoices are better invoices. Templates tailored by profession, with only the fields that profession needs, make data minimisation the default rather than something you have to remember.

Black Flame Digital

Wrong recipient? Handling an invoice breach

Sending an invoice to the wrong person is more common than most people think, and it counts. The ICO’s guide says personal data breaches can include sending personal data to an incorrect recipient. The UK GDPR introduces a duty to report certain breaches to the ICO within 72 hours of becoming aware of them, where feasible, and to tell the individuals affected without undue delay where the breach is likely to result in a high risk. Whether or not you report, you must keep a record of every breach.

A sensible response looks like this:

1. Contain it. Ask the wrong recipient in writing to delete the email and attachment and to confirm they have done so.
2. Assess the risk. An invoice with a company name and a total is low risk. One that shows a home address and a description of sensitive work is higher.
3. Record it. Note what happened, what data was involved, who received it and what you did.
4. Decide whether to report. If the breach is likely to put people at risk, report it to the ICO. When you do, the ICO requires a description of the breach, a contact point, the likely consequences and the measures taken or proposed.
5. Fix the cause. Check saved contacts, turn off autocomplete for client emails, or use delivery tracking so you can see where each invoice went.

If you are unsure whether a particular incident reaches the reporting threshold, use the ICO’s own breach guidance or speak to a data protection adviser before the 72 hours run out.

A short GDPR checklist for your invoicing

• You know which invoices contain personal data.
• Your invoice templates carry only the fields you need.
• Your privacy notice mentions invoicing, your software and your accountant.
• Invoices live in a small number of secure places.
• You have a retention rule tied to tax record-keeping, and you delete when it ends.
• You have a processor contract with each tool that handles invoice data.
• You have a breach log, even if it is empty.

Invoicing without the data sprawl

If you want to move from scattered documents to one place for creating, sending and tracking invoices, InvoiceLabs lets you build a branded invoice in under 30 seconds, with real-time tax and discount calculations, instant delivery and status tracking. Our plans run from Free at £0 per month, through Starter at £9, Professional at £19 and Business at £49 per month, and card payments on invoices carry a 1% fee.

You can try the free invoice generator without creating an account, or compare plans on the InvoiceLabs plans page.

FAQ

Do I need consent to send an invoice?

No. Sending an invoice is normally covered by the contract lawful basis, because you need the client’s details to bill for work they asked for. Consent is only needed for separate purposes such as marketing emails.

Do sole traders need to worry about GDPR on invoices?

Yes, if you handle other people’s personal data. A sole trader’s name, address and email on an invoice are personal data, so the same principles apply: minimise, secure, retain only as long as needed and keep a breach record. The effort is small when the setup is simple.

How long can I keep an invoice that contains personal data?

Keep it for as long as tax or accounting law requires, then delete or anonymise it. Data protection law sets no fixed period, so the ICO expects you to justify your own retention period. Confirm the period for your business with HMRC guidance or your accountant.

Is my invoicing software responsible for GDPR compliance?

Responsibility is shared. You remain the controller of your clients’ data, and the software provider acts as your processor under a written contract. Check that the contract covers the points the ICO lists, and keep your own privacy notice and retention rules up to date.

Sources

• What is personal information: a guide, ICO
• Data protection in your business, Business.gov.uk
• Lawful basis interactive guidance tool, ICO
• UK GDPR lawful basis for processing, ICAEW
• Guide to accountability and governance, ICO
• Data storage advice, ICO
• How long do you need to keep business records, 360 Accountants
• What needs to be included in the contract, ICO
• Personal data breaches: a guide, ICO
• Consent expiry and data retention, AccountCraft
• Accounts receivable Excel tracker, Frac CFO

Recommended

• 12 Mandatory Fields Every UK VAT Invoice Must Show
• Convert Pro Forma to a Compliant VAT Invoice in 30 Days (UK)
• Avoid VAT Audits: 5-Step Proforma to Invoice Checklist for SMEs
• Billing & Invoicing Guide for Freelancers and Small Businesses