The General Data Protection Regulation (GDPR) has been in effect since May 2018, yet most businesses still share files using methods that create significant compliance risks. Every time an employee sends a client's passport scan via email or uploads a contract to Google Drive, the business adds another link to a chain of data processors, each with their own obligations and potential for failure.
This article explains what GDPR requires for file transfers, where common tools fall short and how zero-knowledge encryption can simplify compliance.
Article 32 requires data controllers and processors to implement "appropriate technical and organisational measures" to ensure security. It explicitly mentions:
Encryption is the first measure listed. It is not optional for sensitive data transfers. The regulation specifically calls it out as an expected safeguard.
When you use a third-party service to transfer files, that service becomes a "data processor" under GDPR. This triggers a cascade of obligations:
If a data breach occurs, you must notify the supervisory authority within 72 hours. If the breach involves files shared through a cloud service, you depend on that service to detect and report the breach to you in time. This adds another dependency and risk.
| Tool | Is a data processor? | Can read your files? | DPA required? | Breach liability |
|---|---|---|---|---|
| Google Drive | Yes | Yes | Yes | Shared |
| Dropbox | Yes | Yes | Yes | Shared |
| WeTransfer | Yes | Yes | Yes | Shared |
| OneDrive | Yes | Yes | Yes | Shared |
| Email (Gmail, Outlook) | Yes | Yes | Yes | Shared |
| Zero-knowledge sharing | No* | No | Simplified | Minimal |
*A zero-knowledge service stores only encrypted data it cannot access. The GDPR definition of "processing" requires the ability to access personal data. If the service technically cannot access the data, its role as a processor is fundamentally different.
Article 32 asks for "encryption of personal data." Client-side AES-256-GCM encryption — where the key never reaches the server — is the strongest form of encryption you can apply. It goes beyond what the regulation expects.
When files are encrypted before leaving your device, the data in transit and at rest is always protected. Even if the server is compromised, the encrypted data is useless without the key.
If the server cannot access the personal data, the question of whether it qualifies as a "data processor" changes fundamentally. The service never processes personal data in any meaningful sense — it stores opaque bytes it cannot interpret.
This does not eliminate all compliance obligations, but it dramatically simplifies them. You no longer need to:
GDPR's principle of data minimization (Article 5(1)(c)) requires that personal data be "adequate, relevant and limited to what is necessary." With TTL-based file sharing, data is automatically deleted after the configured period. This built-in expiration aligns perfectly with data minimization: the file exists on the server only as long as it is needed and is then permanently removed.
Article 33 requires breach notification within 72 hours. However, Article 34(3)(a) provides an exception: notification to data subjects is not required if "the controller has implemented appropriate technical and organisational protection measures... in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption."
If your files were shared with client-side encryption and the server is breached, the encrypted data is unintelligible to the attacker. This may exempt you from the obligation to notify affected individuals — a significant reduction in breach response burden.
Client confidentiality is paramount. Sharing case documents via Google Drive makes Google a processor of privileged legal communications. Using zero-knowledge links means the document is encrypted before upload. Set a 24-hour TTL or single-use download. The server never sees the contract contents.
Medical records fall under GDPR's "special categories of data" (Article 9), requiring even stricter protection. Sharing test results or referral letters through email exposes them to multiple intermediaries. Client-side encryption ensures the medical data is only readable by the intended recipient.
Hiring processes involve CVs, ID copies, salary information and background check results. Sharing these files via Dropbox creates processor relationships and retention concerns. Zero-knowledge links with short TTLs ensure documents expire automatically after the hiring decision.
Tax documents contain Social Security numbers, income details and bank information. Clients typically email these files. Replacing email attachments with encrypted links removes the email provider from the processing chain and adds automatic expiration.
GDPR Chapter V restricts transfers of personal data outside the European Economic Area (EEA). When you use a US-based service (Google, Dropbox, WeTransfer), your personal data is transferred to US servers, triggering additional requirements (Standard Contractual Clauses, adequacy decisions, etc.).
With zero-knowledge encryption, the international transfer question is simplified. The server stores only encrypted data that it cannot access. Even if the server is in the US, no personal data in the GDPR sense is accessible to the US-based operator. SecureSend, built into UnveilPass, is hosted in France (OVH) within the EEA — but even if it were not, the zero-knowledge architecture means the operator cannot access the transferred data.
For businesses looking to improve their file sharing practices, here is a practical framework:
GDPR compliance for file sharing is not primarily about checking boxes — it is about ensuring that personal data is genuinely protected during transfer. Client-side encryption with zero-knowledge architecture is the most effective technical measure available. It satisfies Article 32's encryption requirement, simplifies the data processor chain, enables automatic data minimization through TTL and can exempt you from certain breach notification obligations.
For any business handling personal data in the European Union, replacing unencrypted file sharing with zero-knowledge alternatives is one of the highest-impact compliance improvements you can make.
Send files with end-to-end encryption. The server never sees your data. No account required to receive.
Get Started Free