I've published a tool on my website, allowing people to submit a CSV file for a transformation into a XML file according to a governmental XSD. I would like to add a functionality that would allow people to get a link for downloading that XML file and share it with their team for instance.
The problem is that the input CSV file contains some sensitive data on employees of the company that uses my tool. For now, I do not ask consent for anything because I do not store the file on disk and there is no data on my server that can identify the user that uses the tool.
The new functionality would allow people to submit a file named 'myEmployees.csv' and to download the XML file on 'https://example.com/download/myemployees.xml'. Thus, anyone could download the file with the URL.
I would like to share a GDPR compliant tool but I'm not sure of the consent I should ask, how I should store the file on disk and how should I allow people to access the file ?
My current knowledge on this subject would make me add consent explaining my intent of storing the file (only for sharing file) and for how long. Maybe I can add a password that the user could set to allow access to the file, it might be more secure but is it really more GDPR compliant ?
Moreover, I read a few thread :
GDPR - User entering other peoples data
Gathering data about individuals from a different individual under GDPR - can you give away other peoples personal data?
For further information, the tool would not store the file for more than 12h time period.
Thank you for your help