I've published a tool on my website, allowing people to submit a CSV file for a transformation into a XML file according to a governmental XSD. I would like to add a functionality that would allow people to get a link for downloading that XML file and share it with their team for instance.

The problem is that the input CSV file contains some sensitive data on employees of the company that uses my tool. For now, I do not ask consent for anything because I do not store the file on disk and there is no data on my server that can identify the user that uses the tool.

The new functionality would allow people to submit a file named 'myEmployees.csv' and to download the XML file on 'https://example.com/download/myemployees.xml'. Thus, anyone could download the file with the URL.

I would like to share a GDPR compliant tool but I'm not sure of the consent I should ask, how I should store the file on disk and how should I allow people to access the file ?

My current knowledge on this subject would make me add consent explaining my intent of storing the file (only for sharing file) and for how long. Maybe I can add a password that the user could set to allow access to the file, it might be more secure but is it really more GDPR compliant ?

Moreover, I read a few thread :
GDPR - User entering other peoples data
Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?

For further information, the tool would not store the file for more than 12h time period.

Thank you for your help

  • I would seriously consider doing the transformation on the client side so the servers never see the sensitive information.
    – phoog
    Apr 18, 2020 at 17:27

2 Answers 2


From your description, it sounds like you will be a Data Processor rather than a Data Controller; you process data under instruction from a controller, but you don't make any decisions about what the processing is.

Processors do not have the same obligations as controllers under the GDPR and do not have to pay a data protection fee. However, if you are a processor, you do have a number of direct obligations of your own under the GDPR.

As a processor you will have to provide assurance to the Data Controllers (i.e. your customers) that you will process the data in accordance with their instructions, keep it properly confidential and so forth. You don't need to worry about the basis under which you are doing the processing; that is for the Data Controller to worry about.

If you are to return a file with the processed data to your client then you will need to make sure that nobody else can access it. For instance you might have a password-protected account, or you might encrypt the file and transmit the key to the customer by some other channel. The details are up to you, but you will be under an obligation to ensure that whatever you do provides effective security.

You will also need to ensure that your processing is accurate. A formal test system would be in order here, with proper version control, recording test runs etc. You obviously can't prove its perfect, but you do need to be able to demonstrate that you took due care.

  • OP may indeed have to be a data processor in order for the clients to be able to use this – but that follows from the client's compliance obligations, not from OP's obligations. Being a processor requires a contract per Art 28. Setting that up might be far more effort than achieving compliance as a controller though. If OP continues to act as a controller, a legitimate interest of the client could be sufficient legal basis.
    – amon
    Apr 18, 2020 at 19:55
  • Thank you both for your help. Based upon your answers, I decided to add an data processing agreement on my app (according to art28 section 3) and if the file need to be shared, some emails should be submitted in the form so I can send the processed file to those mails. Apr 18, 2020 at 20:26

Maybe I can add a password that the user could set to allow access to the file. It might be more secure but is it really more GDPR compliant?

To the extent that it increases compliance with article Article 1(1)(f), yes:

processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Increasing security generally increases GDPR compliance. Whether it is fully compliant is of course another question.

I'm not sure of the consent I should ask, how I should store the file on disk and how I should allow people to access the file.

If you're not sure of these things, you should probably hire a GDPR implementation consultant. In general, consent is only necessary if there is no other basis for lawful processing, but it may be useful to have consent to protect against possible challenges to other bases. As noted above, the method of storage should be reasonably secure; it should probably be stored according to accepted industry standards for the security of such information, the details of which are off topic here. The same may be said of access methods. For example, you will want to be reasonably certain that the person downloading the file is the same person who uploaded the source.

there is no data on my server that can identify the user that uses the tool.

Are you sure? Even IP addresses have been found to be personally identifiable information. If you really want to cover your tracks, you should have a thorough audit of your systems. Of course, you'll also want to investigate the potential consequences of being found in violation, because these will be needed to decide how much money you should spend on the effort to bring your systems into compliance.

  • The OP would be a Data Processor not a Data Controller. As such consent and other bases for processing are not applicable. Apr 18, 2020 at 19:01
  • @PaulJohnson what is the basis for your contention that the OP would not be a data controller in the contemplated circumstances?
    – phoog
    Apr 24, 2020 at 17:02
  • 1
    According to the OP, users with the personal data (i.e. data controllers) will upload data to the OP's service, which will carry out predefined processing on their behalf and then return the results. Looking at ico.org.uk/for-organisations/guide-to-data-protection/… its pretty clear which category this falls into. Apr 24, 2020 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .