I was having coffee with a university friend in Islington, London — a professional musician who teaches yoga in her spare time. She is completely solo — no studio of her own, no website, no "business" in the way most people picture one. Her entire client base lives in a Google Sheet, she books people over WhatsApp one-to-one, and she runs a WhatsApp group for class updates. When I mentioned what I do, she said the thing I hear from nearly every solo teacher, trainer and therapist: "But I don't even have a website — so all that data-protection stuff doesn't really apply to me, does it?"
It does. And not in a scary, paperwork way — in a way that is actually about the people who trust her.
The website was never the point
Here is the uncomfortable bit, said gently: the law never cared about the website. UK data-protection law cares about whether you are a business collecting and using people's personal information. The moment you take money to teach, and you keep a list of who your clients are — their names, their numbers, maybe some notes about their health — you are a **data controller**. A website is just one place some businesses happen to publish their privacy information. Not having one does not remove the duty; it just means you have nowhere obvious to put it. (More on that, because it is the neat bit.)
Yes, there is a genuine exemption for purely personal or household activity — your family group chat, your own address book. But the moment it is a paid activity, that exemption stops applying. A spreadsheet of paying clients is not a personal address book. It is business records, and it is yours to look after.
The sensitive bit most wellness pros miss
Wellness work has a wrinkle most solo teachers never clock. If you note that a client is pregnant, recovering from a back injury, managing a heart condition, or nursing a dodgy knee — exactly the kind of thing a good teacher writes down to keep people safe — you are holding health data. Under UK GDPR that is "special category" data: the sensitive tier, with stricter rules.
It is not that you should not hold it — often you should, for safety. It is that you need **explicit consent** to collect it, and you need to look after it more carefully than an ordinary contact list. This is the point where "a bit of admin" quietly becomes "actually protecting your clients."
Where a spreadsheet and WhatsApp start to matter
None of this means your setup is wrong. It means three specific things are worth a look.
1. The WhatsApp group shows everyone's number to everyone. In an ordinary WhatsApp group, members can usually see each other's phone numbers. That is a disclosure of personal data — usually without anyone having agreed to it. It is also, in my experience, the single most likely thing to prompt a complaint: someone joins for class times and is unsettled to find a stranger now has their mobile number.
2. The Google Sheet is a single point of failure. Your whole client list — names, numbers, and those health notes — sits in one account. If that account is weakly protected and someone gets into it, that is a personal-data breach, and because it includes health data, a serious one. Keeping it secure is not optional; UK GDPR calls it the "integrity and confidentiality" duty.
3. There is no privacy notice anywhere. Your clients have a right to a short, plain explanation of what you do with their data and how they can ask about it. Right now there is nowhere for them to read that — because the standard advice, "put it in your website footer," assumes a website you do not have.
The realistic version of the risk
Before this tips into worry: the realistic outcome for a good-faith solo teacher is not a fine. The regulator's instinct with small operators acting in good faith is "put it right," not punishment. The risk that actually matters is more human and more immediate — a client upset that their number got shared, or their health details sitting unprotected in a file anyone with a link could open. Fix those, and you have protected the people who trust you, and your reputation along with them. That was always the real point; the compliance is just the name for it.
The fixes — and the QR code that ties them together
The good news is that the fixes are small, and one neat move handles the biggest gap.
Give people a real privacy notice — by QR code. This is the part built for someone with no website. Dxtra generates a proper, plain-English privacy notice and a consent form for you, and gives you a QR code and a link that point to them. You put that QR code on your intake form, a card at the studio, a class flyer, or your WhatsApp and Instagram bio. A new client scans it, reads the notice, and ticks consent — including the explicit health-data consent — and you have a record that they did. Think of it as the privacy notice for people who do not have a website.
Swap the group for a broadcast list. If you mostly send one-way updates, a WhatsApp **broadcast list** does the same job without exposing everyone's number to each other: each person receives a private copy as an individual message from you, so the numbers stay hidden. Two limits: a broadcast only reaches people who have saved your number in their contacts, and each list holds up to 256 people. If you genuinely want a group chat, just ask people to agree to being in a visible-number group first. One more thing: promotional messages sent by broadcast are still direct marketing. In the UK, the cautious reading is that a WhatsApp broadcast counts as "electronic mail" under PECR (the ICO's definition covers in-app and private direct messages), so get consent or rely on the soft opt-in — our post on a Singapore-based teacher's comeback message covers this in more depth.
Lock the Google account. Turn on two-factor authentication, use a strong password, and change sharing from "anyone with the link" to named people only. Two minutes, and your client list is no longer one leaked link away from a breach.
And yes — register with the ICO. (Since 30 September 2026 the regulator is formally the Information Commission, but it still goes by "ICO".) Most businesses handling personal data need to, and it is a small annual fee. Run the ICO's two-minute self-assessment and set it to renew. Quick admin — genuinely not the point of any of this.
That is the whole list. An afternoon, mostly — and much of it is a one-time setup you never think about again.
The fix fits on a QR code
If you take one thing from this: you do not need a website to do right by your clients. You need a privacy notice they can actually read, proper consent for the sensitive stuff, and a bit of care about where their details live.
Get a privacy notice and consent form you can share with a QR code → Dxtra generates both, hands you the QR code and a link, and you put it wherever your clients already are — your intake form, your studio wall, your booking chat. From £7.50 (US$10) a month, and you review everything before it goes live.
The yoga teacher did not need a lecture on UK GDPR. She needed to know it was a handful of small jobs, not a wall — and that the fix fit on a QR code.
Sources
Current as of 15 October 2026. Figures, fees, platform features and regulator names move; check the linked source before you rely on any of them.
- ICO — What are controllers and processors? — controller definition expressly covers sole traders
- UK GDPR Article 2 (legislation.gov.uk) — purely personal or household activity exemption
- ICO — What is special category data? — health data is special category and gets extra protection
- UK GDPR Article 9 (legislation.gov.uk) — prohibition on health data; explicit consent condition in Art.9(2)(a)
- UK GDPR Article 5 (legislation.gov.uk) — the 'integrity and confidentiality' security principle
- ICO — Right to be informed — privacy information must be concise and in plain language
- ICO — Fines and complaints (small organizations) — ICO's stated approach of helping small organizations put things right
- It's time to reserve your WhatsApp username (WhatsApp Blog) — phone numbers are shared with people you have never met, including in groups
- WhatsApp Help Center — How to use broadcast lists — broadcast messages arrive as individual chats; recipients not exposed to each other
- How to use broadcast lists (WhatsApp Help Center, iPhone) — recipients receive "an individual message from you"; recipients must have "saved your number in their address book"; "up to 256 contacts in each broadcast list"
- Privacy and Electronic Communications Regulations 2003, regulation 22 (legislation.gov.uk) — consent for marketing by electronic mail, and the soft opt-in
- Key concepts for direct marketing using electronic mail (ICO) — "electronic mail" covers private messages stored for a specific recipient, including in-app messages and private direct messages
- ICO — Data protection fee — sole traders must pay the fee unless exempt; tier 1 is £52
- What the ICO's transformation into the Information Commission means for your organisation (Lewis Silkin) — the Information Commission replaced the Information Commissioner's Office on 30 September 2026 and is still known as "the ICO"
- UK: ICO governance reforms take effect (CMS) — same change; existing powers and duties carry over
This article is general information, not legal advice. Privacy rules depend on your circumstances — confirm anything that matters with the Information Commission (ICO, ico.org.uk) or a qualified adviser before you rely on it.