Notes on clients and contacts: what GDPR actually allows

You meet Thomas at a conference. He mentions his daughter just graduated and he's thinking about changing jobs. You jot it down — for the next conversation. Is that actually allowed?

Short answer: in most cases, yes. The moment you take notes on people in a professional context, GDPR applies — but it doesn't forbid this, it just regulates how you do it. The right legal basis is called 'legitimate interest' (Article 6(1)(f) GDPR), and maintaining professional relationships qualifies.

Why the personal-use exemption doesn't apply here. GDPR doesn't apply to 'purely personal or household activity' — a private address book on your phone falls under that. But the moment you note down contacts from your job, professional and personal mix, and the exemption disappears. That applies to a paper notebook just as much as to an app.

The question isn't whether you're allowed to keep notes on people. It's which notes — and how carefully you handle them.

Legitimate interest means weighing, not hoarding. You may record what's relevant to the relationship — role, last conversation, open items, even personal details like family or hobbies if they make the contact human. What doesn't belong: information unrelated to the relationship, and anything you'd be better off not knowing.

Be careful with sensitive topics. Health, religion, political opinions, sexual orientation — these are 'special categories' under Article 9 GDPR, with much stricter rules. Only note them if truly necessary, and never pass them on unprompted.

What you owe your contacts. Anyone you keep notes on has the right to know what's stored about them (right of access), have it deleted (right to erasure), and object to the processing. In practice: be honest if asked, delete on request, and keep only what you actually need.

Five rules for everyday use: only write down what's professionally relevant. Skip health, religious or political details unless they're explicitly part of the conversation and relevant. Never pass notes on to third parties who have nothing to do with them. Delete on request, immediately. And keep your notes somewhere nobody else can read them.

How MyBrivio takes this seriously. Your notes are encrypted with a key unique to your account, stored in Frankfurt. For AI processing we use Google Gemini's paid API, not the free version — according to Google, that data isn't used to train AI models. You can delete your account and all its data yourself, any time. Details are in our privacy policy at app.mybrivio.com/privacy.

This article is guidance, not legal advice. For a binding assessment of your specific situation — for example in a regulated industry like pharma, finance or healthcare — talk to a data protection professional.