File sharing for EU data sovereignty

A file platform inside the EU can still make transfers outside it, so the first task is mapping every place personal data moves, not just where the primary storage sits. EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when the person only views data on a screen for support or administration. Work through five triggers: primary storage location, backups replicated to a site or cloud region abroad, vendor support sessions where an engineer outside the EEA opens a database view or log file, DNS and telemetry paths, and sync clients that reach servers outside the EEA, including mobile clients using a relay or push service. For a Nextcloud deployment, check the trusted_domains and overwrite.cli.url settings, any update or app store calls, and whether the Nextcloud client or mobile app makes calls to endpoints you do not operate. Confirm each of these against your own network captures and vendor contracts rather than assuming them.

The EDPB's Example 12 separates two situations that architects often blur. Using an EU processor that is subject to third-country law with extraterritorial effect is not, on its own, a transfer. However, if that processor would have to comply with a request from a third-country authority, that compliance would be a transfer. The reach of the US CLOUD Act provision at 18 U.S.C. 2713 is one reason controllers assess this exposure before signing, and the Article 48 limit on enforcing third-country disclosure orders is another. Ask each candidate for the legal basis it would rely on to refuse or challenge an order, which entity holds the keys, and where support staff are located. This is a question to put to counsel and the processor, not a conclusion this page can reach. Document the answers in your transfer assessment so the reasoning survives a supervisory authority's review.

Hosting in an EU data center does not settle who can read the files. If the hosting provider, a managed service vendor or a support engineer can reach the decryption keys or hold administrative access to the database, the data can still be exposed to parties and jurisdictions you did not plan for. For a self-hosted Nextcloud or Seafile deployment, the questions to settle first are where the master keys live, who can export them, and whether a vendor's remote administration path can read data in the clear. Those answers belong in the data protection impact assessment, not only in the architecture diagram.

Server-side encryption keeps the sync and share features working. The server encrypts files, so search, previews, web editing and sharing function normally, and the key material can be held in a hardware security module or a key vault that your own team controls. The trade-off is that the server process must be able to read plaintext while it works, so the protection depends on who can administer the keys and the host. End-to-end encrypted folders remove the server from the trust chain: even administrators cannot read the content. The cost is that server-side search, web-based office editing and some sharing and recovery paths stop working for those folders, and losing the client-held key means losing the data.

Before you choose a mode, confirm with the vendor which encryption modes your target Nextcloud or Seafile version supports, which key storage options are available and how key recovery is handled for lost credentials and departed staff. Ask whether a support session can expose plaintext, and document the answer for your assessment. The Nextcloud server repository is the natural starting point for checking current encryption behavior, but the decision should rest on a test in your own environment with your own key custody rules.

A data protection impact assessment for a self-hosted file sharing platform should describe the processing in enough detail that a reviewer can test each risk against a control you actually operate. Start with the processing purpose and the categories of personal data and data subjects, such as employee HR folders, customer contracts or partner correspondence, because the volume and sensitivity of what lands in Nextcloud drive every later decision. List the recipients, meaning internal groups, external guest accounts, sync clients and any support organization that can reach the systems, including remote administrators in a third country. Confirm with your data protection officer how the assessment is structured and which template or threshold your organization uses, since DPIA requirements are set by your own governance and supervisory expectations.

The transfer analysis is where a self-hosted design changes the argument most. Record the physical location of the application servers, database, object storage, backup targets and any disaster recovery site, and document every path by which a non-EU party could view data, including remote support sessions and log exports. Under EDPB Guidelines 05/2021, remote access from a third country, even only displaying data on a screen, counts as a transfer, so your access matrix belongs in the assessment. Record also whether any hosting or support provider is subject to third-country law with extraterritorial reach, and what you would do if that provider received a government request. The security of processing measures should name the server-side or end-to-end encryption choice, who holds the keys, the LDAP, OpenID Connect or SAML authentication source, the access control rules and the audit logs you retain. Finally, set out retention and deletion rules for files, versions, trash and backups, and close with the residual risk you accept and who signed off on it.

Self-hosting moves the risk analysis from reliance on a provider's contractual and technical assurances to your own operational controls. The assessment therefore has to show who administers the platform, how privileged access is granted and reviewed, how upgrades are tested, and how restores are proven. Nextcloud's own documentation requires one major version upgrade at a time, a backup before every upgrade and third-party apps disabled until confirmed compatible, so those steps belong in the change process you describe. Where the design relies on a commercial support tier, record which support arrangement you rely on, because a supplier's patch timeline is part of your residual risk. Treat the document as a living record: revisit it when the hosting location, the key model or the set of external recipients changes.

Start by asking the partner to map every copy of the data, not just the primary store. Ask where the Nextcloud data directory, the PostgreSQL or MariaDB database, Redis or APCu caches, preview and thumbnail files, search indexes, office editing sessions, and BorgBackup repositories physically sit, and which of them could be copied off-site by a managed service. Ask for the same answer on logs: where the web server, PHP and Nextcloud audit logs are written, how long they are kept, and whether any log shipping agent sends them to a third-country SIEM. Ask who holds the key to each backup repository. A partner that cannot draw this map from memory should produce it in writing before the DPIA draft starts, and every location should be a line in the record of processing.

Then ask about keys and privileged access, because these decide whether a third-country authority can compel the data in practice. Ask how server-side encryption keys are generated, where the master key is stored, who can read it, and how rotation is done without re-encrypting the whole store in an uncontrolled way. Ask whether the partner's engineers ever need root or database access, through which bastion or jump host, under which named accounts, and whether each session is recorded and reviewed. For vendor support, ask whether Nextcloud GmbH or any other supplier can reach the instance remotely, how that access is approved, and whether a support session that displays data on screen from outside the EEA would count as a transfer under EDPB Guidelines 05/2021. Require written answers for each.

Finally, ask how the partner builds the DPIA evidence pack, how it schedules upgrades, and how it tests an exit. The pack should list data flows, processors and sub-processors, transfer assessments, key custody records, access logs, and the decision record on any third-country exposure in the partner's own tooling, such as ticketing, monitoring or CI services that touch client data. Ask for the upgrade calendar against the Nextcloud maintenance and release schedule, and confirm that each major step is taken one version at a time with a backup before it. Ask for a documented exit test: a full export to another platform or on-premises infrastructure, with checksums and permission mapping, and a record of how long it took. The Data Act gives customers a switching right, so a tested exit path is also a contractual requirement to verify, not just a plan.