Share Less, Review Better: A Calm GDPR Workflow for Client Design Feedback

Client review is where good design work often goes to die in a 47-message email chain. It is also where personal data quietly leaks: a screenshot of a customer database, a staff photo in a mock-up, a research clip with someone's face and voice, or a public link that gets forwarded beyond the people who needed it.

You do not need a legal team to fix this. You need a repeatable workflow that is boring enough to maintain and strict enough to keep you out of trouble. This is a practical guide, not legal advice, but it is built around UK GDPR and the Data Protection Act 2018.

Why email threads are the wrong default

Email feels convenient because everyone has it. In practice, attachments multiply, permissions are invisible, and nobody is entirely sure which version was approved. A shared review space gives you one link, a clear version history and a deletion point you can actually find later. It also stops personal data being scattered across inboxes, phones and downloads.

Step 1: Work out what personal data is actually in the work

Before you upload anything, look at the files with a suspicious eye. Personal data can include customer names, email addresses, staff photos, testimonials, CRM screenshots, user research clips and any document that identifies a living person.

Ask a simple question: does the client need to see this real data to give useful feedback? Often the answer is no. Use placeholder names, dummy email addresses and stock avatars. If a screenshot is essential, crop or redact the parts that are not relevant. Less data shared is less data to protect.

Step 2: Agree the data roles before the first upload

In most client projects, the client is the controller of their customer data and you are the processor. That means you handle it on their instructions, keep it secure and do not use it for your own purposes. A short data processing agreement is sensible for regular clients, especially if you are handling research footage or customer lists.

Consent is not a universal fix. For most client work, the lawful basis is contract or legitimate interests rather than a vague tick box. If you want to publish the work in your portfolio, that is a separate purpose, so ask specifically and keep a record of the answer. Do not bury portfolio permission in a general project email.

Step 3: Choose a review tool with the boring safeguards

You do not need the fanciest platform. You need one that lets you control access. Look for UK or EU hosting or a region selector, named user accounts, link expiry, download controls, watermarking, an audit log and straightforward deletion.

Tools such as Dropbox Replay, Frame.io, Filestage, ReviewStudio or even Google Drive comments can work for a small studio, depending on the client and the file type. Check where the data is stored, who the subprocessors are, and whether the supplier has a data processing agreement you can rely on. Avoid WhatsApp groups and public file-transfer links for anything containing personal data. They are fast, but they are also hard to control and almost impossible to audit cleanly.

Step 4: Build one review room per project

Set up a single folder or review space for each project. Use a clear naming convention such as ClientName_Project_Review_v03. Keep only the files the client needs to review. Do not upload the whole job archive, old versions and unrelated invoices into the same space.

Keep personal data out of file names and folder titles. A file called 'complaints-list-final' tells anyone who sees it more than it should. Use neutral project codes and keep the key in your own project notes.

Step 5: Invite the smallest sensible group

Named reviewers are better than a public link. Ask the client who needs to comment and limit access to those people. Two approvers is usually enough. If a wider team needs to see the work, use guest access with an expiry date rather than a link that lives forever.

Set a feedback deadline and ask the client to consolidate comments before sending them back. This is not just a data-protection measure; it makes the review faster and stops three people giving you three conflicting directions.

Step 6: Run feedback as a log, not a chat

Use one comment per issue, with a status column for open, agreed or done. Keep decisions in the review tool or in a simple feedback log. Export a PDF at sign-off so you have a fixed record of what was approved. This reduces the chance of a client saying 'we never agreed to that' three weeks later.

Step 7: Retain on purpose, delete on schedule

Decide how long each type of file needs to stay. A sensible default for review links might be 30 days after sign-off. Project files should follow your client contract and insurance requirements. Financial records usually need to be kept longer, but that is no reason to keep every marked-up screenshot forever.

Put deletion dates in your calendar. When the time comes, remove the files from the review tool, empty the trash and delete local copies. Send a short confirmation to the client if the project involved sensitive data. A retention policy nobody follows is worse than no policy at all because it creates false confidence.

Step 8: Have a small incident plan

If a link goes to the wrong person or a file is shared too widely, revoke access immediately, check the access log and tell the client. Keep a one-page record of what happened, what you did and when. As a processor, you should tell the controller without undue delay. The controller then decides whether the breach needs to be reported to the Information Commissioner's Office. You do not need a dramatic incident-response suite; you need a clear phone number and a calm checklist.

The lightweight version for a studio of one

One review tool, one data processing agreement template, one retention calendar and one feedback log. That is maintainable. The point is not to turn every design review into a compliance ceremony. It is to share less, control access and know when to delete. Clients notice the difference: fewer confusing emails, clearer approvals and a studio that looks organised rather than chaotic.