Does self-hosted file sharing for GDPR remove transfer risk?
Self-hosting reduces the number of processors and transfer paths, but it does not remove the controller's responsibility. If your organization uses or is considering cloud file sharing, you must still justify where personal data sits and who can reach it. Under Articles 24, 25 and 32, the controller remains accountable for appropriate measures, privacy by design and default settings, and security of processing wherever the processing runs, including on servers in your own data center or cloud account. Moving the platform in-house changes the evidence you need, not the duty.
The useful question is whether a given flow is a transfer at all. The EDPB's Guidelines 05/2021 treat a flow as a transfer when a GDPR-bound exporter discloses or makes personal data available to a separate controller or processor in a third country. Remote access from a third country, even just viewing data for support or administration, counts as a transfer, and so does storage in a cloud outside the EEA offered by a provider. By contrast, an employee who opens the employer's own system while traveling abroad is not a transfer under those guidelines. Map every support account, vendor remote session, backup target and sub-processor against that test before deciding that transfer risk is gone.
The GDPR itself requires no audit, attestation or certificate for file sharing. Article 42 certification is voluntary, is issued for at most three years, and does not reduce the controller's or processor's responsibility. What you must be able to show is documented reasoning: which processors and sub-processors exist, how their guarantees were checked, where keys are held and how encryption and pseudonymisation under Article 32 were chosen. Confirm with your data protection officer and independent assessors which evidence your supervisory authority expects for your sector and scope.
How GDPR obligations map to Nextcloud and Seafile configuration
This table maps each GDPR obligation that touches file sync and share to what the function must do and how Nextcloud or Seafile settings support it. Read each row as a question to answer in your own environment, and confirm vendor-specific capabilities against the version you deploy, because controls such as end-to-end encryption and granular sharing rules differ between editions and releases.
| Requirement | What the function must do | Configuration in Nextcloud or Seafile |
|---|---|---|
| Article 24 accountability | Document purposes, data locations, roles and the measures applied, and be able to show them on request | Keep a configuration baseline and change log for the instance. Record which groups may share externally, retention settings and admin roles. Confirm which audit and logging apps your edition provides. |
| Article 25 default settings | Set privacy-protective defaults so only data needed for each purpose is shared by default | Disable public link creation for most groups, require passwords and expiry on links where supported, and restrict sharing to internal users by default. Confirm default sharing options in your release. |
| Article 28 processor contracts | Hold a contract with every provider that stores or processes data for you, and know every sub-processor | If DeployOpen or a hosting provider operates the platform, the contract and sub-processor list must cover support access and backups. Ask for the sub-processor register and notice terms. Nextcloud Enterprise support terms should be reviewed separately. |
| Article 32(1)(a) pseudonymisation and encryption | Encrypt personal data at rest and in transit, and control who holds keys | Use TLS for all clients and the web interface. Choose server-side encryption for storage you partly trust, or end-to-end encrypted folders where administrators must not read content. Confirm which features each choice breaks, such as search and web editing. |
| Article 32 access and resilience | Restrict access to need-to-know, log access, and keep data available and recoverable | Connect LDAP or Active Directory, OpenID Connect or SAML for sign-in and deprovisioning. Enforce MFA at the identity provider. Apply group-based folder rules and enable audit logging. Run scheduled backups of database, data directory and config, and test restores. |
| Article 33 breach notification support | Detect and document incidents fast enough to meet the 72-hour notification window for the supervisory authority | Forward audit and authentication logs to a central SIEM and keep retention long enough to reconstruct affected files and recipients. Document how external shares are revoked. Confirm log fields your version records. |
| Chapter V transfer controls | Prevent personal data from being disclosed or made available to parties in third countries without a valid transfer basis | Host the instance and backups in EU or EEA locations you control. Disable or restrict federated sharing and external storage connectors to non-EEA targets. Block remote administration or support access from third countries unless covered by a transfer mechanism. Confirm each connector and app's data flows. |
| Upgrade cadence on supported versions | Run a supported release so security fixes are applied and processing controls stay current | Plan one major version at a time, back up before each upgrade, and disable third-party apps until they are confirmed compatible. Check the maintenance schedule for the release you run before setting a calendar. |
When encryption counts as a supplementary measure
Encryption only counts as a supplementary measure when the party receiving the data cannot read it in clear text. Article 32(1)(a) names pseudonymisation and encryption as appropriate security measures, and Article 4(5) defines pseudonymisation as processing that stops data being attributed to a person without additional information, which must be kept separately and protected by technical and organisational measures. The EDPB Recommendations 01/2020 apply the same logic to transfers: if an importer in a third country, or a provider with remote administrative access, can obtain the keys or the plaintext, the encrypted file is still personal data in the clear for transfer purposes. For a self-hosted Nextcloud on infrastructure you control, the first question is therefore not whether the disk is encrypted, but who holds the keys and who can reach the systems that use them.
Two Nextcloud designs lead to very different answers. Server-side encryption with a master key or per-user keys protects data at rest and lets the server index, preview and edit files, but anyone with administrative access to the server or key store can read content, so it supports the argument only when the key store sits inside your boundary and administrators in a third country have no route to it. End-to-end encrypted folders keep keys on the client, so administrators and the hosting team see ciphertext, which is the stronger position against transfer risk. The trade-off is that full-text search, server-side previews and web editing of encrypted content are limited or unavailable, and recovery depends on users keeping their keys, so you must test what happens when a key is lost before you rely on this design. Confirm the current behavior for each feature against the Nextcloud documentation for your release.
Document the decision per data category, not per platform. For each class of personal data, record where keys are generated, who can export or unwrap them, whether remote support sessions can view decrypted content, and how backups are protected, since a backup copy in a non-EEA location is a transfer in its own right. Recheck this record whenever the design changes, and ask any implementation partner to show how key material is separated from the data store and from the administrative accounts. The detailed design choices, including what each option breaks, are covered in the dedicated encryption topic for self-hosted file sharing.
Which self-hosted platforms fit an EU file sharing transfer design
The platform choice sets how much of the processing chain stays under your control, and therefore how many processors, sub-processors and transfer questions you must document. The cards below cover the main file sync and share options, the commercial support tiers that affect the controller's obligations, and the surrounding components that must stay inside the same boundary.
Nextcloud Server under AGPL-3.0
Nextcloud Server is the community edition you install in infrastructure you control, and it is licensed under AGPL-3.0. The current major release is Nextcloud 35 (Hub 26 Summer), released on 16 September 2026, with end of life in September 2027. Under the GDPR the controller stays responsible for Article 32 security wherever it runs, so check that every installed app, and every external storage or federation link, is documented as part of the processing record. Confirm which apps your data flows depend on before you commit to a version.
Nextcloud Enterprise support tiers
Nextcloud Enterprise is a paid offering from Nextcloud GmbH with Standard, Premium and Ultimate tiers. Each tier carries a 100-user minimum on list pricing, and the tiers differ in maintenance lifecycle, support hours and response times. For a transfer design, the support tier decides who can review a security issue on your instance and how long a major version stays patched, which feeds your supplier due diligence under the Article 28 contract. Ask the vendor for the written support terms that apply to your user count rather than relying on the public tier names.
Seafile under GPLv2 with OpenSSL
Seafile is a self-hosted sync and share platform released under GPLv2 with an additional permission to link with OpenSSL. It is an alternative when your team prefers its library-based model or a different admin workflow. The licence terms matter for internal distribution and modification, so have counsel confirm them against your build. Under Article 28, check who operates the server, how its sub-processors are listed, and whether the office editing and identity components you pair with it keep personal data inside the same EU boundary.
Office, identity and backup inside the boundary
A file platform only keeps data in one boundary if the components around it do too. Office editing, search, authentication, antivirus, mail notifications and backups each receive or store personal data, and each can introduce a remote access path or a storage location outside the EEA. Map every component into the processing record, confirm where its logs and backups are held, and confirm whether any vendor support session can view data. Gaps here often matter more than the choice between the two file platforms.
Hosting provider still needs a processor contract
Choosing an EU data center does not remove the processor relationship if the provider operates the environment, manages the hypervisor, applies patches or holds backups. Storage is processing under Article 4(2), so that provider is a processor under Article 4(8) and needs an Article 28 contract and a list of its sub-processors. Check whether the provider's staff can access the data from outside the EEA, because remote access from a third country counts as a transfer even when it is only for support. Ask for the sub-processor list in writing.
Self-operated hosting and key custody
If your own staff operate the Nextcloud or Seafile servers in your own data center or cloud account, the processor chain is shorter, and the main questions shift to who holds administrative and encryption keys. Document which people can reach the database, object storage and backup repositories, and whether they can read plaintext. Check that privileged access is logged, and that any implementation partner's access is limited, time bound and covered by a processor contract before work starts. This design is usually the easiest to explain to a data protection authority.
How hosting location and operator change the transfer analysis
When the organization runs Nextcloud in its own data center in the EEA, using its own staff and its own hardware, the organization is the controller and no separate provider stores or processes the personal data. Self-hosting does not change who is controller: the controller determines purposes and means and remains responsible for Article 24, Article 25 and Article 32 measures wherever the processing runs. Because no external processor is involved, no Article 28 contract is needed for the platform itself, and no Chapter V transfer arises from storage. Transfer questions still appear when a third-country vendor provides software updates, remote support or licence services that involve access to personal data.
- Controller role: the organization decides purposes, means and security measures for every file.
- Article 28 contract: not needed for the platform, but needed for any hosting, colocation or managed service vendor that touches the data.
- Sub-processors: keep an inventory of any support, backup or connectivity providers, and confirm their guarantees under the principle in EDPB Opinion 22/2024.
- Chapter V: usually not triggered by storage; check remote access from a third country, including viewing data during support.
- Encryption and pseudonymisation: Article 32(1)(a) names encryption as a candidate measure, so document key custody.
Confirm with counsel and your data protection officer whether vendor support sessions or software telemetry count as transfers in your setup.
Here the organization deploys Nextcloud into an EU cloud region using an account it owns and administers, with its own operating system images, network rules and keys. The cloud provider supplies infrastructure, so it may be a processor under Article 4(8) for the hosted environment. Whether it is a processor depends on the contract and on whether the provider can access the data, so the organization must read the provider's terms carefully. Storage in an EU region does not by itself create a transfer, but the EDPB's guidance treats storage in a cloud outside the EEA offered by a provider as a transfer, so region selection and provider access paths matter.
- Controller role: the organization remains controller and selects the platform and the cloud region.
- Article 28 contract: the infrastructure provider generally needs a processing agreement with the required Article 28 terms.
- Sub-processors: the provider's sub-processors, support staff and backup locations must be identified and kept current.
- Chapter V: confirm that no support or administrative access, backup replication or log export leaves the EEA.
- Key control: consider keys held outside the provider's reach, and document what the provider can and cannot see.
Confirm with counsel which provider functions are processing and where every administrative access path originates.
In this model a managed service provider operates Nextcloud for the organization, based in the EU and under EU jurisdiction. The provider stores or otherwise processes personal data on the organization's behalf, so it is a processor under Article 4(8). The organization must rely only on processors that give sufficient guarantees, and it needs a written Article 28 contract. Every service removed from the chain removes a contract and its sub-processors, so the number of parties behind the managed service is the main thing to map.
- Controller role: the organization stays controller and instructs the provider.
- Article 28 contract: required, covering instructions, confidentiality, security and sub-processor terms.
- Sub-processors: EDPB Opinion 22/2024 expects the identity of all sub-processors to be available at all times, and verification depth should follow the risk.
- Chapter V: relevant if any sub-processor, including a follow-the-sun support desk or a backup vendor, is outside the EEA.
- Evidence: request the sub-processor list, locations of access and the audit or information rights in the contract.
Confirm with counsel whether the provider's own group companies or parent-level staff can access the data from a third country.
Some services are operated by a company headquartered outside the EEA that stores files in an EU data center. Storage in the EU is only part of the picture, because the operator's staff or group companies in a third country may view data for support, administration or troubleshooting. The EDPB guidelines treat remote access from a third country, even just viewing data, as a transfer. The operator is a processor, so Article 28 applies, and Chapter V must be analysed before the data flows. Adequacy decisions under Article 45, such as the EU-US Data Privacy Framework, may cover some destinations, but the operator's own certification status must be checked and the decision itself is subject to ongoing legal challenge.
- Controller role: the organization remains controller and must assess the operator as a processor.
- Article 28 contract: required, plus transfer terms for any third-country access.
- Chapter V mechanisms: adequacy under Article 45, standard contractual clauses under Article 46, or binding corporate rules under Article 47 may be relevant; derogations under Article 49 are exceptional and should not be the default.
- Sub-processors: the operator's sub-processors and access locations must be listed and verified.
- Supplementary measures: EDPB Recommendations 01/2020 describe technical measures such as encryption where the recipient needs no access to clear text.
Confirm with counsel whether an adequacy decision applies to the specific destination and whether a transfer impact assessment is needed.
What a data protection review asks for from a file sharing deployment
This table lists the evidence a data protection team or supervisory authority typically asks for when reviewing a self-hosted file sync and share deployment, and which component usually produces each item. Read it as a preparation checklist: the GDPR requires no certificate, and Article 42 certification is voluntary and does not reduce the controller's or processor's responsibility. The main takeaway is that the evidence has to come from the deployment itself, so it should be generated as the system runs.
| Evidence item | What it shows | Which component produces it |
|---|---|---|
| Records of processing and transfer inventory | Which personal data sits in the file platform, for which purposes, and whether any flow leaves the EEA, including remote support access from a third country | Controller records, maintained with the platform team; network and access logs confirm actual flows |
| Data flow diagram with trust boundary | Where files are stored, processed, backed up and accessed, and which systems sit inside the organization's control | Architecture documentation from the deployment team, checked against infrastructure inventory |
| Processor contracts and sub-processor list | Every external party that stores or processes personal data on the organization's behalf, with Article 28 terms and current sub-processors | Contract register from procurement and legal; hosting, backup and support vendors named in the chain |
| Encryption design and key custody records | Whether server-side or end-to-end encryption is used, who holds the keys, and how keys are rotated and recovered | Nextcloud encryption settings and key management records; key custodian documentation |
| Access control and SSO configuration exports | Who can log in, through which directory or identity provider, and which sharing and external link rules apply | Directory (LDAP or Active Directory), OpenID Connect or SAML configuration, and Nextcloud sharing policy exports |
| Audit log samples | Who accessed, shared or deleted personal data and when, supporting detection and breach investigation | Nextcloud admin audit log, forwarded to a central log store; directory sign-in logs |
| Backup and restore test records | That backups are protected, can be restored, and that restore tests were run and their results recorded | Backup tool job reports and restore test logs, such as BorgBackup output in Nextcloud All-in-One deployments |
| Upgrade and patch records | That the platform receives security fixes within supported releases and that major upgrades were planned and tested | Change records and Nextcloud maintenance release history; ticket system for each upgrade step |
| DPIA input | The facts an assessor needs to evaluate risk to individuals, including data categories, volumes, recipients and safeguards | Compiled from all rows above by the data protection team with the deployment owner |
What buyers ask before hiring a partner for GDPR file sharing
Does self-hosting Nextcloud remove the need for a data processing agreement?
No. Self-hosting does not change who is the controller. The controller decides purposes and means and remains responsible for Article 24, Article 25 and Article 32 measures wherever the processing runs. A contract is still needed with every external party that processes personal data on your behalf, such as a hosting provider, a managed service firm, a backup vendor or a support partner that can access systems. Under Article 28, each of those processors needs sufficient guarantees and a written contract, and each of their sub-processors must be known to you. If the platform runs only on hardware and accounts you control and no third party touches the data, the processor chain is shorter, but the controller duties stay in place. Ask any partner which parties could ever see the data, including remote support staff, and document each one.
What drives the effort and cost of a GDPR-ready file sharing build?
The main drivers are scope, user count, integration, migration, encryption design and documentation. Scope covers how many sites, tenants and data categories the platform will hold. User count and storage growth affect sizing of the database, object storage and backup targets. Integration with directory services, single sign-on, antivirus and data loss prevention tooling adds design and testing time. Migration from existing cloud drives or file servers requires permission mapping and data cleanup. Encryption design, including whether you choose server-side or end-to-end encryption, changes search, web editing and recovery. Documentation for records of processing, transfer assessments and a data protection impact assessment is substantial and often underestimated. Ask for a quote that lists each of these as separate line items, with the work your team does and the work the partner does.
How long does a self-hosted GDPR file sharing project take?
The duration depends on the scope, the number of integrations, the migration volume and how quickly your legal, data protection and data owner reviews are completed. No single timeline applies across organizations, so this page does not give one. Ask any partner for a written plan that breaks the work into phases, names the decisions you must make in each phase, and states the acceptance criteria for moving to the next one. A credible plan also shows how the platform will be upgraded, because Nextcloud does not allow skipping major releases and requires one major version at a time with a backup before each upgrade. Treat a plan that gives a date without listing the dependencies on your side as a warning sign.
What do we need to provide during a GDPR file sharing engagement?
Your organization carries several inputs that the partner cannot supply. Legal counsel should review the processor contracts, the transfer analysis and the records of processing. Your data protection officer, where you have one, should review the risk assessment, the retention rules and any data protection impact assessment. IT needs to provide access to directory services, network segments, hypervisors or cloud accounts, and change windows. Data owners must decide who may share files externally, which data categories may be stored, how long files are kept and who holds encryption keys. These decisions take time and are the most common source of delay when they are left open. Ask the partner to produce a decision log at the start and to list which decisions each role must sign off.
Can our own team run a GDPR file sharing platform without a partner?
Yes, a skilled internal team can operate Nextcloud if it has the time, the skills and the process. The work includes hardening the server and database, managing identity integration, monitoring, backups with restore testing, security patching and planned major upgrades. Nextcloud publishes a new major version every four months and supports each one for one year through monthly maintenance releases, so the team needs a standing upgrade cadence rather than occasional projects. Check which version your installation runs against the maintenance and release schedule before each planning cycle. Many organizations use a partner for the initial design, documentation and first upgrades, then keep operations in-house. Be realistic about key-person risk, and confirm that someone can respond to a security release within your own policy.
Do the Digital Omnibus or Omnibus IV proposals change the GDPR rules?
As of October 2026, the GDPR text has not been amended, so current obligations apply. Two proposals are pending. The Omnibus IV proposal (COM(2025) 501) has a text agreed in interinstitutional negotiations on 26 June 2026 and is awaiting Parliament's first-reading vote. The Digital Omnibus proposal (COM(2025) 837) is awaiting committee decision. Both can change how obligations are applied, so architecture decisions should not depend on a specific outcome. Build the file sharing platform so that data location, processor lists, encryption and retention can be adjusted without re-platforming. Ask your counsel to review the procedure status in the European Parliament Legislative Observatory at the time of each decision, and record the review date in your compliance file.
What fines can a regulator impose under Article 83 of the GDPR?
Article 83 sets two maximum tiers. For infringements such as those covered by Articles 25 to 39, which include security of processing under Article 32 and breach notification under Articles 33 and 34, the maximum is EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For infringements of the basic principles, lawful basis, data subject rights and transfer rules, the maximum is EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. These are maximums, and supervisory authorities set the actual fine case by case. National authorities have already fined organizations for insufficient technical measures, so the security controls in a file sharing design carry real regulatory weight. Ask any partner how the design maps to Articles 25 and 32 and what evidence it produces.
Does a certification or audit report prove GDPR compliance for our file sharing?
No. The GDPR requires no audit, attestation or certificate. Certification under Article 42 is voluntary, is issued for at most three years by accredited certification bodies or supervisory authorities, and does not reduce the controller's or processor's responsibility. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform those assessments. In practice, a regulator will ask for your records of processing, transfer assessments, processor contracts, encryption and access configuration, logs and tested restore procedures. Ask any partner which of these artifacts they will deliver and who will own each one after the engagement ends.
What Nextcloud configuration alone does not satisfy
Nextcloud can enforce encryption, access control and logging, but the GDPR places duties on the controller that no product setting discharges. The cards below cover the governance, contracts, incident handling and people work that regulators look at alongside the technical configuration.
Legal basis and transparency notices
Self-hosting does not change who is the controller, so the organization still needs a documented lawful basis for each processing purpose and notices that tell staff, clients and partners where their files are stored and who can access them. Check that the notice names the hosting location and any remote support access, and that the purposes listed match what the file platform actually does, such as sharing links, search indexing or antivirus scanning of uploads.
DPIA and records of processing
Large-scale file sharing with personal data usually calls for a data protection impact assessment and an entry in the records of processing. The assessment should describe the data categories, the data subjects, the encryption and key ownership model, retention settings and the list of processors and sub-processors. Keep it current, because each configuration change, new app or hosting move can alter the risk picture.
Article 28 contract and sub-processor verification
Any external provider that hosts, backs up or supports the platform processes personal data on the organization's behalf and needs an Article 28 contract. EDPB Opinion 22/2024 expects the controller to know the identity of every processor and sub-processor at all times and to verify their guarantees, with depth scaled to risk. Ask each provider for its sub-processor list, its change notification process and the locations where data or support sessions can occur.
Breach notification under Articles 33 and 34
The controller must notify the supervisory authority of a personal data breach without undue delay, and where feasible within 72 hours of becoming aware of it, and inform affected individuals when the risk is high. Nextcloud logs and alerts only help if someone owns triage and the decision. Document who reviews audit logs, how a processor reports incidents to the controller and how the team applies the timing and assessment steps in EDPB Guidelines 9/2022.
Vendor support and remote access from third countries
Viewing data during support or administration from a third country counts as a transfer under the EDPB's Guidelines 05/2021, even when nothing is copied. Support engineers working from outside the EEA, or vendor tooling that opens sessions into the server, therefore need the same transfer analysis as storage. Restrict privileged access to named EEA-based staff where possible, require approval and session logging for vendor access, and record each access in the transfer assessment.
Staff training and access reviews
Most file exposure comes from people sharing the wrong link or keeping access after a role change. Train administrators and frequent sharers on link expiry, password requirements and classification, and run periodic reviews of group membership, guest accounts and external shares. The Miljödata fine from the Swedish supervisory authority in October 2026 shows that regulators assess whether technical and organizational measures work in practice, not only whether they exist on paper.
How a GDPR-aligned file sharing rollout is sequenced
The sequence turns a file sharing decision into evidence a controller can show: where personal data flows, who can reach it from where, which processors are bound by contract, how keys are held, and how the platform is restored. Each step closes with a document or check that the next step depends on.
Map data flows and transfers
Start by inventorying what personal data enters the file platform, who uploads and downloads it, which sync clients and external sharing paths exist, and where any copy, backup, log or support session could be accessed from outside the EEA. Your DPO, the business owners of the data and the platform team do this together, with the EDPB Guidelines 05/2021 as the test for what counts as a transfer. The output is a data flow register that marks each path as internal, processor-bound or a transfer, and a list of the people with administrative or remote access. The step is done when every path in the register has an owner and a classification.
Decide hosting boundary and operator
Choose where the platform runs and who operates it: your own data center, a cloud account you administer, or a partner working inside your infrastructure. Each choice determines which parties hold administrative access, which sub-processors exist and whether any operator staff can reach data from a third country. The controller remains responsible for Article 24, 25 and 32 measures wherever the processing runs, so this decision is a governance decision, not only a hosting one. The output is a written hosting boundary statement naming the operator, the locations and the access model. The step is done when the DPO and information security sign it off.
Document processors and contracts
List every processor and sub-processor in the chain, from the platform operator to backup, monitoring, email relay and support providers, and confirm that each has a contract meeting Article 28 requirements. Where a transfer remains after the hosting decision, confirm the transfer mechanism under Chapter V, such as an adequacy decision or standard contractual clauses, and record a transfer impact assessment. EDPB Opinion 22/2024 expects you to keep the identity of all processors and sub-processors available at all times. The output is a processor register with contract references and transfer mechanisms. The step is done when no processor in the register lacks a signed contract.
Design encryption and key custody
Decide how data is protected at rest and in transit, and who holds the keys. Compare server-side encryption with platform-held keys, server-side encryption with keys you manage, and end-to-end encrypted folders, noting what each prevents and what each breaks, such as search, web editing and administrative recovery. Article 32(1)(a) names encryption and pseudonymisation as appropriate measures, so the design should show where pseudonymised data is kept separately from identifiers. The output is a key custody record and an encryption design that states who can decrypt data under which conditions. The step is done when a named key owner accepts that record.
Configure identity and sharing limits
Connect the platform to your directory or single sign-on, enforce multi-factor authentication for administrators and external users, and set rules that restrict external sharing, link expiry, password requirements, download limits from untrusted networks and guest access by group. Nextcloud documents LDAP, OpenID Connect and SAML backends that can be used for this, but the exact configuration depends on your directory and must be confirmed in your environment. The output is a configuration baseline that maps each sharing rule to the data classes in the register. The step is done when test accounts demonstrate that restricted sharing paths are blocked.
Run migration and pilot
Move a limited group of users and a defined set of data first, using the data flow register to decide what is migrated, what is mounted from existing shares and what is retired. Check that permissions survive the move, that sync clients behave on managed devices and that audit logs capture access to personal data. Record issues and the fixes applied before expanding the user base. The output is a pilot report with user, data and access results, and a go or no-go decision for wider rollout. The step is done when the pilot group uses the platform under the agreed rules without open high-severity findings.
Test backup and restore
Test that backups of the file store and database can be restored to a working state, and that restored data keeps its permissions, encryption and retention settings. Confirm where backup copies are held, who can access them, and whether they fall under the same processor contracts and transfer analysis as the live system. Article 32 also expects the ability to restore availability and access to personal data in a timely manner, so restore results should be measured against the recovery targets your organization sets. The output is a restore test record with dates, scope and results. The step is done when a restore has been completed and the record is filed.
Hand over records
Assemble the evidence the controller needs to demonstrate compliance: the data flow register, hosting boundary statement, processor register, transfer assessments, encryption and key custody record, configuration baseline, pilot report, restore test record and an operating procedure for breach notification under Articles 33 and 34. Assign owners for upkeep, including the Nextcloud upgrade cadence, where each major version is upgraded in turn. Note that these records support an assessment but do not constitute an audit or certification. The output is a records package handed to the DPO and the platform owner. The step is done when both parties confirm receipt and the review dates are set.
What changes for a multinational with EU staff and a US support vendor
Consider an illustrative case: an EU company runs Nextcloud on its own EU infrastructure, but its US-based support vendor occasionally opens a session to troubleshoot sync failures. Under the EDPB reading in Guidelines 05/2021, that session matters even though no file is copied. The EDPB treats remote access from a third country, including viewing data for support or administration, as a transfer. The question is therefore not where the servers sit but whether anyone outside the EEA can see personal data in an identifiable form. An employee of the company who opens the same files while traveling abroad is a different case, because the employer's own systems are not disclosed to a separate controller or processor.
The company has three practical options, and each needs a decision owner. The first is to restrict remote access so that vendor engineers cannot reach production data from outside the EEA, for example by requiring named EU-based administrators, time-boxed access approvals, and session recording controlled by the company. The second is to keep the US vendor in the chain under Chapter V, which means confirming whether an adequacy decision covers the vendor, or whether standard contractual clauses under Commission Implementing Decision (EU) 2021/914 and a supplementary measures assessment are needed. The third is in-boundary support, where the vendor works only on systems and data the company controls, inside the EEA. Each option changes the Article 28 contract, the sub-processor list, and the transfer documentation. Confirm with counsel which option fits your data, as this page does not reach a legal conclusion.
Whichever option is chosen, keep the controller's record current. EDPB Opinion 22/2024 expects the identity of every processor and sub-processor to be available at all times, so ask each support provider for its entity names, support locations and any access pathways that cross the boundary. Ask whether the vendor's tooling, ticketing system or log collection sends diagnostic data outside the EEA, since that flow can be a transfer in its own right. The DPIA should record the access model, the approval workflow and the audit logs that show who viewed what. Partners that implement the platform should be asked to demonstrate these controls in your environment, not describe them in a slide deck.
How DeployOpen scopes, delivers and supports GDPR-aligned file sharing
DeployOpen plans, implements, hardens, documents and supports self-hosted file sync and share inside infrastructure you control, including EU data centers and private cloud accounts. We start from a written scope that maps where personal data sits, who can reach it and which transfer paths must be closed or documented.
How we scope
- Map which personal data types enter the file platform, which departments store them and where they are stored today.
- Record every processor, sub-processor and remote support path, including vendor access for upgrades and troubleshooting.
- Agree in writing which hosting location, encryption design and transfer checks are in scope before work starts.
How we build
- Deploy Nextcloud or Seafile in the client's own accounts, data centers or private cloud, with encryption at rest and in transit configured.
- Configure directory login, access controls, external sharing limits and audit logging to support the Article 32 security evidence.
- Test access restrictions, link expiry, backup restores and remote administration paths before the platform goes live.
How we hand over
- Deliver architecture records, data flow diagrams and a processor and sub-processor register the controller can maintain.
- Document configuration baselines, key custody decisions and the evidence needed for a data protection impact assessment.
- Provide runbooks for upgrades, backups and incident response so your own team can operate the platform after handover.
How we support
- Offer ongoing support, upgrades and continuous security testing as a retainer after the initial engagement.
- Plan Nextcloud major version upgrades one step at a time, with backups and third-party app checks before each change.
- Review the transfer and processor register when services, hosting locations or support arrangements change. Confirm the scope of any retainer in writing.
