How to Send Sensitive Files Compliant with GDPR
By Simon Themiot - freelance cybersecurity consultant. Published May 20, 2026.
Summary
- GDPR Article 32 requires technical and organisational measures appropriate to risk. No service is prohibited by name alone: content, recipients, controls, contract, and transfers must be assessed together.
- Encryption is one of the measures cited by Article 32. For highly sensitive content, E2E can substantially reduce provider exposure; HTTPS remains essential but covers transport only.
- GDPR sanctions for security failures can reach 4% of global turnover or 20 million euros. The cost of a proper tool is negligible in comparison.
Table of contents
1. What GDPR requires for file transfer
GDPR does not directly mention "file transfer". But several articles apply as soon as you send a file containing personal data:
- Article 5(1)(f) - Integrity and confidentiality: Data must be processed in a manner that ensures appropriate security, including protection against unauthorised processing.
- Article 32 - Security of processing: The data controller must implement appropriate technical and organisational measures, including "encryption of personal data" (explicitly cited in paragraph 1a).
- Article 28 - Processor: If you use a third-party tool to transfer files, that tool is a processor under GDPR. You must ensure it offers "sufficient guarantees" of security.
- Articles 44-49 - International transfers: If files pass through a country outside the EU without an adequacy decision, additional safeguards are required (SCCs, BCRs).
CNIL is clear
CNIL security guidance recommends protecting exchanges, controlling access, and selecting proportionate measures. For special category data, do not assume encryption at rest is sufficient: also assess transport, keys, recipients, endpoints, and retention.
2. Which files are concerned?
Any file containing personal data (information that can directly or indirectly identify a person) is covered by Article 32 obligations. Concretely:
- Payslips, employment contracts, HR evaluations
- Invoices, bank details, accounting documents with person names
- Medical records, prescriptions, test results
- Legal documents (complaints, testimonies, proceedings)
- Client files with contact data
- Identity documents (ID card, passport, driving licence)
- CVs and cover letters in a recruitment process
Article 9 special categories (health, biometrics for identification, political opinions, trade-union membership, sexual orientation, racial or ethnic origin, and others) call for stronger assessment. E2E is a possible and often relevant control, not an automatic GDPR requirement for every transfer.
3. Common non-compliant practices
Here are the most common practices that pose GDPR compliance issues:
Sending as email attachment
Classic email (SMTP) is not end-to-end encrypted. Messages travel in plaintext between relay servers. Even with opportunistic TLS (STARTTLS), end-to-end confidentiality is not guaranteed. Furthermore, attachments remain stored indefinitely in mailboxes of all intermediaries.
Using WeTransfer, SwissTransfer, Google Drive without E2E
These services document encryption in transit and at rest, but not an E2E model that withholds the key from the provider. That does not automatically make them insufficient processors: review the DPA, plan controls, subprocessors, locations, legal requests, and supplementary measures required by your risk.
Sharing a public cloud link
An 'anyone with the link' URL makes the file accessible to whoever obtains it. For personal data, that choice must be justified, time-limited, and consistent with expected confidentiality; otherwise it may conflict with security and data-protection-by-default principles.
4. Criteria for a GDPR-compliant transfer tool
For your file transfer tool to meet GDPR requirements, here are the criteria to verify:
- End-to-end encryption: The content key should remain with authorised clients so the provider cannot decrypt stored files.
- Location and transfers: prefer the EEA or an adequate country when suitable, and document entities, subprocessors, remote access, and applicable mechanisms.
- DPA (Data Processing Agreement): The provider must offer a processing agreement compliant with GDPR Article 28.
- Automatic deletion: Files must be automatically deleted after a configurable period (data minimisation principle, Article 5(1)(e)).
- Password protection: Ability to restrict file access with a password transmitted through a separate channel.
- Transparency (open source): Open source code allows independent verification of encryption mechanisms - trust through transparency.
- Access logging: Know who downloaded the file and when, to meet traceability obligations.
5. Practical implementation
Here is a simple workflow to send a sensitive file in GDPR compliance:
- Identify sensitivity level: Regular data (name, email) vs special category data (health, legal). The protection level must be proportional to risk.
- Choose a suitable E2E tool: For sensitive data, assess a service where the content key stays with clients and locations and subprocessors are documented.
- Encrypt and send: Upload the file and enable E2E so encryption happens browser-side, then obtain the sharing link.
- Transmit the link on a secure channel: Send the link via a channel (email, messaging). If the file is particularly sensitive, add a password communicated via a second channel (SMS, phone call).
- Configure expiration: Set an availability period consistent with your need (1 day, 7 days). Do not leave sensitive files accessible indefinitely.
- Document in your register: Note the tool used, protection measures, and legal basis of the transfer in your processing activities register (Article 30).
6. FAQ
Is a password-protected ZIP enough for GDPR?
A 7z/AES-256 archive with a strong, separately transmitted password can be useful. Avoid ZipCrypto and assess suitability against risk, endpoints, and password handling; neither ZIP nor E2E proves compliance by itself.
Does using WeTransfer expose you to GDPR sanctions?
Using WeTransfer is not an infringement by itself. A breach may exist when controls are inappropriate to risk, the processor or transfers are not governed, or access and retention are poorly controlled. Document the choice and add the necessary measures.
Does E2E encryption exempt me from breach notification?
No. Article 34(3)(a) provides an exception to individual communication when measures render data unintelligible to unauthorised persons. Verify that encryption was strong, the key did not leak, and no other high risk remains. Assessment and, where applicable, notification to the authority under Article 33 remain separate.
Related articles
Send your sensitive files in compliance
PrivCloud provides several useful controls: optional AES-256-GCM E2E, temporary hosting in France, automatic deletion, open source code, and an available DPA. Final compliance depends on your processing, configuration, and organisation.
This article is provided for informational purposes and does not constitute legal advice. Consult your DPO or a specialised lawyer for analysis adapted to your situation. Last updated: July 14, 2026.