As soon as a delivered file contains personal data (identifiable photos of people, a client's contact details in a document, video footage with recognisable faces), the GDPR applies, regardless of the size of the outfit handling it. A solo freelancer is concerned just as much as an agency. If you serve clients in the EU or handle EU residents' data, this is your baseline, and similar principles increasingly apply under equivalent laws elsewhere.
The core principle: minimise and secure
Two habits cover the essentials: only collect and keep the data needed for the job, and protect access to what you deliver (private link, password if sensitive, automatic expiry). Data protection law doesn't ask for perfection, it asks for a reasonable, documented approach.
Hosting matters: where your data lives
If you use a delivery tool, check where the files are hosted and how long they stay accessible after the job. For EU clients, hosting in the European Union keeps things simpler. A tool that automatically expires deliveries helps you respect the storage-limitation principle without thinking about it every time.
The case of photos with faces
Delivering wedding, event or shoot photos often involves identifiable faces: that's personal data. You don't need a complicated contract, but a simple line in your quote or terms (intended use, retention period, right to erasure) covers the essentials.
In short
Minimise what you collect, secure and expire what you deliver, and check where your data is hosted. A freelancer doesn't need a legal department to stay compliant, just a few systematic habits.