GDPR-compliant file transfer: what the law requires

A GDPR-compliant file transfer is one where personal data is sent only when needed, protected by appropriate security such as encryption, kept no longer than necessary, and handled by a provider bound by a processing contract, with any transfer outside the European Economic Area covered by a legal mechanism. The GDPR does not certify tools: it sets obligations for the organisation that sends the data, and the right service makes them much easier to meet.

This guide maps the articles of Regulation (EU) 2016/679 that apply when you send files containing personal data, such as CVs, payslips, medical reports, photos of people or customer lists, then turns them into a checklist. It is general information as of October 2026, not legal advice; your data protection officer or counsel has the final word for your situation.

When does the GDPR apply to sending files?

Whenever the files contain personal data, meaning any information relating to an identifiable person, and your organisation is established in the EU or offers services to people in the EU. A contract with names and addresses, a spreadsheet of customers, an ID scan, a photo where people can be recognised: all count. Sending them is “processing”, and so is the temporary storage by the transfer service.

The GDPR articles that matter for file transfers

Your provider is a processor: get the contract right

When a transfer service stores files on your behalf, it acts as a processor. Article 28 requires you to use only processors that provide “sufficient guarantees”, and to have a contract (commonly called a data processing agreement, or DPA) that sets out, among other things, that the processor acts only on your documented instructions, keeps the data confidential, secures it, uses sub-processors only with your authorisation, and allows audits. For business use, check that the provider offers such terms and lists its sub-processors.

Is encryption required by the GDPR?

Not in absolute terms: Article 32 asks for security “appropriate to the risk” and cites the pseudonymisation and encryption of personal data as examples. In practice, encryption is the expected baseline for sending personal data over the internet, and it brings a concrete benefit in case of an incident. Under Article 34(3)(a), you do not have to notify affected individuals of a breach if the data was rendered unintelligible to unauthorised people, “such as encryption”.

The European Data Protection Board’s breach guidelines add important nuances: the exemption applies to data that was properly encrypted with a key that was not compromised, and losing the only copy of encrypted data is still an availability breach. End-to-end encryption, where even the provider cannot read the files, is the strongest form; see end-to-end encryption explained.

Storage limitation: why expiring links help

A shared folder that stays open for years conflicts with the principle that personal data is kept no longer than necessary. Transfer links that expire after a few days, and files that are deleted when they expire, apply Article 5(1)(e) and Article 25 “by default”, without anyone having to remember to clean up. Our article on share link expiry and passwords suggests durations by situation.

Sending data outside the EU: what about US providers?

Chapter V of the GDPR (Articles 44 to 49) allows transfers outside the EEA only with a legal basis, such as an adequacy decision or standard contractual clauses. For the United States, the European Commission adopted the EU-US Data Privacy Framework adequacy decision on 10 July 2023; it covers US companies that self-certify under the framework. The EU General Court dismissed a challenge to it on 3 September 2025, and an appeal is pending before the Court of Justice as of October 2026. The framework is valid today, but its history (two earlier arrangements were struck down) is why many organisations prefer providers that keep data in Europe.

Checklist: choosing a GDPR-friendly transfer service

• A clear privacy policy and processing terms (DPA) for business customers, with a list of sub-processors.
• Storage location stated, ideally in the EEA, or a valid transfer mechanism.
• Encryption in transit and at rest, and end-to-end encryption available for sensitive files.
• Expiry dates and automatic deletion, passwords and download limits.
• Access control on the sender side: two-factor authentication, team roles.
• A way to delete a transfer immediately if it went to the wrong person.

Checklist: using it in a GDPR-friendly way

1. 1

   Step 1

   Minimise

   Send only the documents and data the recipient needs; redact the rest.

2. 2

   Step 2

   Protect

   Use a password sent through another channel, and end-to-end encryption for special categories of data (health, for example) or identity documents.

3. 3

   Step 3

   Limit in time

   Choose a short expiry and a download limit matching the number of recipients.

4. 4

   Step 4

   Check the recipient

   Verify the address; misaddressed emails are a classic source of breaches.

5. 5

   Step 5

   Clean up

   Delete local copies and sent attachments you no longer need.

6. 6

   Step 6

   Document

   Record the tool in your register of processing activities and keep your internal rule short and known.

If a file goes to the wrong person

Revoke the link at once, check whether the files were downloaded, and assess the risk to the people concerned. If the breach is likely to result in a risk to their rights and freedoms, Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours. A European Commission proposal (the “Digital Omnibus”, November 2025) would change these rules, including a 96-hour deadline, but it had not been adopted as of October 2026. Our secure file transfer checklist covers prevention.

Common situations