GDPR and File Sharing: A Practical Guide for European Businesses

Ask a room of office workers how they send an employment contract to a new hire and you'll hear the same answer every time: email. Ask how long that contract stays in their mailbox, and the room goes quiet.

That quiet is where most GDPR risk in file sharing lives. Not in hacking, not in obscure legal edge cases, but in the copies of personal data that pile up in inboxes, chat threads and forgotten drive links because nobody thought to remove them.

This guide covers what GDPR actually asks of you when your business shares files, in plain language, and what to look for in secure file sharing for business use. It's general information, not legal advice; for decisions about your own processing, talk to your data protection officer or a lawyer.

The four parts of GDPR that matter for file sharing

GDPR is long, but only a handful of provisions come up again and again when you share files.

Keep only what you need, only as long as you need it

Article 5 sets out the principles. Two of them are the heart of the file sharing problem:

• Data minimisation: process only the personal data you need for the purpose. Send the ten customer records the vendor needs, not the whole export.
• Storage limitation: don't keep personal data in identifiable form longer than necessary.

Storage limitation is the one email quietly breaks. When you send a payslip as an attachment, you've created copies in at least two mailboxes and their backups, with no end date. The payslip had a purpose: getting to the employee. That purpose was served the moment it arrived. The copies stay anyway.

Protect it in a way that fits the risk

Article 32 requires "appropriate technical and organisational measures" for security. It's deliberately risk-based: it doesn't mandate a specific tool or algorithm, but it does name encryption as an example of an appropriate measure.

In practice, the more sensitive the data, the more a regulator will expect. A payslip, an ID scan or health information calls for more than a lunch menu does. Sending special category data (health, for example, under Article 9) as a plain email attachment is hard to describe as appropriate.

Be able to show what you did

Article 5(2), the accountability principle, says you must be able to demonstrate compliance, not just achieve it. Article 30 requires a record of processing activities (often called a RoPA) describing what you process, why, who receives it and how it's protected.

Article 30 doesn't require a log of every individual share. But your RoPA should describe file sharing as an activity: what kinds of data you share, with which kinds of recipients, through which tools, and with which security measures. A tool that records who created each share helps you back that up.

Use processors that sign up to the rules

Any service that handles personal data on your behalf is a processor, and under Article 28 you need a data processing agreement (DPA) with it. That includes your file sharing service. If a provider won't give you one, that's your answer.

If the service involves transfers outside the EU/EEA (storage, support, sub-processors), those need a valid basis under Chapter V, such as an adequacy decision or standard contractual clauses. GDPR doesn't require personal data to be stored in the EU, but EU storage makes this part simpler.

Why encryption changes the breach picture

Article 33 requires you to notify your supervisory authority within 72 hours of becoming aware of a personal data breach, unless it's unlikely to result in a risk to people. Article 34 requires you to tell affected individuals when the risk is high, but Article 34(3)(a) specifically says this isn't needed if the data was made unintelligible to unauthorised people, for example through encryption.

That's a strong practical argument for encryption where the provider doesn't hold the key. If files are encrypted on your device before upload, a breach of the sharing service exposes ciphertext the attacker can't read. Whether that removes your notification duties in a particular case depends on the facts, so assess it properly if it ever happens. But it's a very different conversation from a leaked mailbox full of readable attachments.

How common sharing methods hold up

None of these is "GDPR compliant" or "non-compliant" in itself. Compliance depends on what you share, with whom and why. But some tools make the right behaviour the default, and others make it something you have to remember.

A checklist for choosing secure file sharing for business

When you evaluate a tool, these are the questions to ask:

• Is there a DPA, and what does it cover? Look for the Article 28(3) clauses, a list of sub-processors, and a description of technical and organisational measures.
• Where is data stored and processed? Ask about the application, the database and the file storage separately, and about content delivery and support.
• Who holds the encryption keys? If the provider can decrypt, a breach on their side is a breach of your data.
• What gets deleted, and when? Ask about the live file, the link and backups. "Deleted" should come with a number of days.
• What does it log? You want enough to show who shared what. You don't want the tool collecting more personal data about recipients than you need.
• Can external recipients use it without an account? If not, people will fall back to email.

How Konfidant fits

To be concrete, here's how Konfidant answers those questions:

• DPA: the Data Processing Agreement is part of the Terms for every customer, with technical measures and sub-processors listed in its annexes.
• Location: the service is hosted in Germany. On Premium and Enterprise you can choose EU or US storage for encrypted files; the free plan stores files in the US, so for personal data of EU residents, a paid plan with EU storage is the sensible choice. Delivery runs over Cloudflare's global network.
• Keys: files and texts are encrypted in the sender's browser (or SDK) with AES-256-GCM. The key is placed in the link fragment, which browsers don't send to servers. Konfidant can't decrypt what you share.
• Deletion: encrypted files are deleted from storage right after the recipient opens them, or at expiry. Short text secrets are kept in a vault whose encrypted backups are retained for 7 days.
• Logs: paid plans include audit logs of who on your team created shares. Enterprise adds verified burn, which records when each share was opened. Konfidant doesn't link shares to recipients' IP addresses; like any website, server and CDN logs are kept for up to 14 days.

What it doesn't do: replace your document management or HR system. The original document should still live where your retention rules say it should. Konfidant removes the copies created along the way.

Three common workflows

Sending a payslip or contract to an employee. The legal basis is usually the employment contract (Article 6(1)(b)). Upload the document, set an expiry of a few days, and send the one-time link to the employee directly. The employee downloads it; the copy on Konfidant is deleted. Your HR system keeps the original. See the HR use case for more.

Sending documents to a client or counterparty. Share only the document they need, not the whole file. Send a one-time link with an expiry that matches the deadline. If they're outside the EU, check whether your own transfer obligations apply to sending the document at all; that's independent of the tool. The legal use case covers this in more detail.

Sending a data export to a processor. Before anything else, make sure you have a DPA with the recipient. Export only the fields they need, send the file as a one-time link with a short expiry, and agree when they'll delete their copy.

Questions people ask

Does using an encrypted sharing tool make us GDPR compliant?

No tool does that on its own. Compliance is about what you process, why and how. A good tool makes the security and storage-limitation parts much easier, and gives you something concrete to describe in your records and DPAs.

Can we use US-based services?

Often yes, provided there's a valid transfer mechanism (such as the EU-US Data Privacy Framework for certified companies, or standard contractual clauses) and you've assessed the risk. EU storage simply removes one step.

What if someone already emailed personal data they shouldn't have?

Assess whether it's a personal data breach (for example, sent to the wrong recipient). If it is, document it and decide on notification under Articles 33 and 34 within 72 hours. Either way, it's a good prompt to agree on a better way to share that kind of document.

How long should we keep records of shares?

There's no fixed GDPR period. Keep them as long as you need them to demonstrate accountability, and say so in your retention policy. Konfidant's audit logs record who created a share and when, not the contents.

---

If you want to see how it works in practice, create a free account and switch to a paid plan with EU storage before sharing real personal data. For the underlying cryptography, read how end-to-end encrypted file transfer works.