GDPR for Contractors: What Customer Data You Can Keep

What personal data may you retain?

• Contact details (name, address, phone, email) – needed for quotes, invoices and communication.
• VAT number – required for invoicing under Belgian VAT rules.
• Bank details – only when they are genuinely needed for the contract, payment or refund process.
• Project photos – useful for documentation of the work performed.

Only keep data that is necessary for fulfilling a contract or meeting a legal obligation.

Retention periods you need to respect

• Invoices and VAT accounting documents – FPS Finance states a ten-year retention period. Keep the documents and personal data needed to meet that obligation, and document why: accounting and invoicing guidance.
• Other client details – keep only while a legitimate purpose exists (e.g., a justified interest to contact the client for future work).
• Deletion requests – if a client asks for erasure and no legal or contractual reason exists to retain the information, you must comply.

What you must avoid

• Sharing client lists with third parties for marketing or other commercial purposes without a lawful basis.
• Using data for a purpose other than the one for which it was collected, unless you obtain explicit consent.
• Storing information that is not needed for the contract (e.g., a client’s birthdate for a renovation project).

Step‑by‑step compliance workflow

1. Map the data you hold

• List all categories of personal data (clients, employees, suppliers).
• Record where each type is stored (Excel file, accounting software, physical folder).
• Note who has access to each storage location.

2. Secure the data appropriately

• Avoid unprotected files on shared computers.
• Use password‑protected files or software with individual user logins.
• Store physical documents in a locked cabinet.

3. Provide a clear privacy notice

• Publish a short statement on your website or in your terms and conditions.
• Include: what data you collect, why you collect it, how long you keep it, and how clients can contact you about their data.

4. Handle data‑subject requests

• Be ready to show a client the personal data you hold about them.
• Delete the data promptly when there is no legal basis to retain it.

Daily checklist for data hygiene

• Is this piece of information required for a current contract or legal obligation?
• Is the storage method protected (password, access control, locked cabinet)?
• Have I documented the retention period for this data?
• Have I informed the client about the purpose and duration of storage?
• Do I have a process to delete data on request?

Bottom line

For Belgian construction SMEs, GDPR compliance centres on collecting only what is needed, protecting it, applying documented retention rules and handling valid requests. The Belgian Data Protection Authority provides a current GDPR toolbox for professionals and SMEs.