GDPR and File Transfer: What the CNIL Really Requires in 2026

By Simon Thémiot, cybersecurity consultant. Published April 27, 2026. This article does not constitute legal advice. When in doubt, consult your DPO or a specialist lawyer.

1. The applicable legal framework for file sharing

GDPR applies as soon as personal data is processed, meaning any information relating to an identified or identifiable natural person. The threshold is very low: a name in a Word document, an email address in an Excel file, an ID photo in a PDF. All fall under the regulation.

When you send a file via WeTransfer or an equivalent service, you perform processing (within the meaning of Article 4): transmission, temporary storage, access. You are the data controller, and the service used becomes a processor. This chain of responsibility is the basis of any GDPR analysis of file sharing.

In addition to GDPR, certain sectors have extra obligations: HDS hosting for health data, ACPR rules for the banking sector, professional secrecy for lawyers and notaries. These regimes do not replace GDPR - they add to it.

2. GDPR Article 32 and the notion of appropriate measure

Article 32 of the GDPR requires both the data controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The text explicitly mentions:

• The pseudonymisation and encryption of personal data.
• The ability to ensure ongoing confidentiality, integrity, availability and resilience of systems.
• The ability to restore availability after an incident.
• A process for regularly testing the measures.

The CNIL has published several guides detailing what it expects concretely. The "Guide to the security of personal data" (2024 edition) recommends for file sharing: encryption in transit (TLS 1.2+), encryption at rest (AES-128 or higher), strong authentication, and limited retention. For sensitive data, end-to-end encryption is mentioned as best practice.

The key word is "appropriate". Sharing a guest list for a public meeting does not carry the same requirements as transferring payslips. Proportionality is part of the analysis. In case of an audit, you must be able to justify your choices.

How to encrypt and share files in practice?

Encrypting files before sharing does not always require advanced technical skills. Several methods exist depending on the required level of protection and user profiles. A sharing service can provide an E2E option that encrypts content client-side before upload. The recipient then decrypts it in the browser through the received link, with no installation required.

For large files or complete folders, tools like 7-Zip (AES-256 encryption with password), Cryptomator (folder encryption on cloud storage) or VeraCrypt (encrypted volumes) allow encryption before storage or sharing. The encryption key - in practice the password - must be transmitted to the recipient via a separate channel (different e-mail, SMS, phone call). Never send the password in the same e-mail as the link to the encrypted files.

• Online E2E service (symmetric encryption) (e.g. PrivCloud): AES-256-GCM client-side encryption. A 256-bit symmetric key is generated in the sender's browser, used to encrypt files, then shared with the recipient via the URL fragment (#key=...) - this part of the URL is never sent to servers by HTTP design. The same key is used for both encryption and decryption (that is the definition of symmetric encryption). The server only receives an unreadable blob.
• 7-Zip + password: use the 7z format with AES-256 and a strong password; avoid legacy ZipCrypto. Communicate the password to the recipient through a separate channel.
• Cryptomator: AES symmetric encryption of files and filenames in folders stored in the cloud (Dropbox, OneDrive, etc.). The master key stays local. Allows protecting files on a cloud storage service without native E2E encryption.
• PGP/GPG: hybrid encryption - asymmetric for key exchange (RSA or ECDH), symmetric for content (AES). The fundamental difference from E2E services with a key in the URL: the sender encrypts the session key with the recipient's public key, without ever having to share a secret via an external link. Only the recipient's private key can decrypt. Recommended for advanced users and very sensitive exchanges (lawyers, doctors, CISOs), but requires public key management (keyring, WKD, etc.).

Whatever tool is chosen for file sharing, the important thing is to define a clear internal policy: which files must be encrypted, how to transmit keys or passwords to recipients, and what retention period to apply to sharing links. Without a written policy, users will make inconsistent choices and risks will remain high.

3. The processor status and the DPA obligation

Any provider that processes personal data on your behalf is a data processor under Article 28. This includes file sharing services, email providers, and cloud hosts. With each of them, you must sign a Data Processing Agreement (DPA) specifying:

• The subject matter, duration, nature and purpose of the processing.
• The types of data and categories of data subjects.
• The processor's obligations (confidentiality, security, sub-processing, assistance, deletion at end of contract).
• The right of audit by the data controller.

In practice, major online services publish a standard DPA. WeTransfer, Dropbox, Google and the like offer one, signable online. For a company, reading and archiving this document is the bare minimum. If the DPA is not suitable, negotiate or change provider. Many CISOs discover during a CNIL audit that they have never signed the DPA for their main tool.

4. Cross-border transfers since Schrems II

The Schrems II ruling (July 2020) invalidated the Privacy Shield that governed EU-US transfers. The Data Privacy Framework of July 2023 partially restored a framework, but it is still subject to legal challenges. The prudent position is to avoid cross-border transfers when possible, and to document them strictly when unavoidable.

In practice, storage in a non-EEA region or access from a third country may constitute a transfer. Depending on the country and entity, verify an adequacy decision or implement appropriate safeguards, then assess any necessary supplementary measures.

A service hosted in France or the EEA with a documented subprocessor chain simplifies the assessment. SwissTransfer is hosted in Switzerland, a country covered by an adequacy decision. In every case, review the DPA, remote access, subprocessors, and actual processing locations.

5. The activity register and documentation

Article 30 requires any organisation of more than 250 people, and any smaller organisation processing sensitive data or doing so on a non-occasional basis, to maintain a record of processing activities. For file sharing, this record must include:

• The purpose (transmission of commercial, HR, or legal documents, etc.).
• The categories of data subjects and data types.
• The recipients or categories of recipients.
• Any cross-border transfers and associated safeguards.
• The planned retention period.
• A general description of security measures.

The CNIL provides a free template. The classic mistake is to fill it out once and forget it. The register must be kept up to date. If you switch file sharing tools during the year, you must trace the change.

6. Breach notification within 72 hours

In case of a data breach (a leaked WeTransfer link, a file left publicly accessible, a compromised account), Article 33 requires notification to the CNIL within 72 hours, unless the breach is unlikely to result in a risk to individuals. This is where end-to-end encryption becomes strategic.

If exposed files were protected by strong encryption and the key was not compromised, that measure weighs heavily in the risk assessment. Notification to the authority is required only when the breach is likely to result in risk; individual communication falls under Article 34 for high risk, including an exception where data was rendered unintelligible to unauthorised persons.

Encryption therefore does not automatically make a breach a legal non-event: document scope, algorithms, key management, exposed metadata, and other consequences. It can nevertheless substantially reduce content-related risk.

A link shared without access control, a compromised account, or misconfigured storage can expose SMEs and large organisations alike. For HR, legal, or financial information, combine a risk-appropriate tool, short expiry, controlled recipients, strong authentication, and, where the threat model warrants it, E2E encryption.

7. Compliance checklist for SMEs

Here is a checklist for structuring a quick SME audit. Ticking these boxes does not prove compliance by itself, but provides a solid baseline for file sharing.

• The file sharing service is identified, documented and entered in the activity register.
• The provider's DPA (data processing agreement) is read, signed and archived. The provider is confirmed as a processor under Article 28 GDPR.
• File hosting is in the EU, or a documented transfer framework (standard contractual clauses, adequacy decision) exists for non-EU servers.
• Sharing links have a configured expiration date. No permanent sharing link exists for sensitive files or personal data.
• Sensitive files (HR documents, contracts, medical data, banking information) are encrypted before sending, and protected by password or end-to-end encryption.
• Passwords for file sharing links are transmitted to recipients via a separate channel - never in the same e-mail as the link.
• Users have received clear written guidance: which tools to use, for which types of files and data, and how to access shared files securely.
• Access to shared folders and files is limited to identified recipients. Generic links accessible to anyone with the link are reserved for non-sensitive files.
• Strong authentication (two-factor) is enabled on all accounts with access to file sharing and storage tools.
• An inventory of shared file types is up to date. Sensitive data (health data, personal information, confidential files) is identified and their sharing is subject to strict, documented rules.
• A data breach notification procedure exists, is documented and has been tested (simulating a sensitive file leak scenario).
• An annual review of sharing tools, access policies and associated risks is scheduled.

None of these points requires a significant budget. Most are organisational decisions. The budget then goes towards choosing the right tool, but without this documentary foundation, even the best tool in the world will not protect you during an audit.

8. Encrypted file sharing: concrete best practices

Beyond the regulatory framework, secure file sharing in a business relies on simple and systematic practices. Here are the features and methods to prioritise for protecting your files and users' data.

9. FAQ - Secure file sharing and encryption

Last updated: July 14, 2026. Regulations change regularly. Verify official sources before any strategic decision. This article is for informational purposes only and does not replace personalised legal advice.