You're a freelancer in Germany. A client sends you a PDF with personal data. You upload it to a free online converter hosted in the US. Did you just create a GDPR problem?
Possibly. And it's more common than most people realize.
What GDPR Covers (Briefly)
The General Data Protection Regulation applies when you process personal data of people in the EU/EEA. "Processing" includes collecting, storing, transmitting, and converting data — not just storing it long-term.
Personal data means anything identifying a person: names, email addresses, ID numbers, photos, health information, financial details.
If your PDF contains a client's name and invoice details, that's personal data.
Why Upload-Based Tools Are Risky Under GDPR
When you upload a file to an online tool:
- You're transmitting personal data to the tool provider
- The provider becomes a data processor (or controller, depending on their role)
- You need a legal basis for that transfer
- Cross-border transfers (EU → US) require additional safeguards
Most free online tools don't offer:
- A Data Processing Agreement (DPA)
- Standard Contractual Clauses for international transfers
- Documented data retention and deletion policies you can rely on
- EU-based data processing
Using them for personal data — even "just to merge two PDFs" — can put you out of compliance.
Who Is Responsible?
You are. As the person uploading the data, you're typically the data controller. You're responsible for choosing processors that meet GDPR requirements.
"It was a free tool" is not a legal defense. "I didn't know they stored it" doesn't help if the privacy policy said they would.
When Browser-Based Tools Help
Client-side processing avoids the transfer problem entirely:
- No personal data leaves your device
- No third-party processor involved in handling the file contents
- No cross-border data transfer of the document itself
- No retention risk on someone else's servers
The tool provider's server delivers the web page and processing code. Your file contents never reach them. From a GDPR perspective, this is fundamentally different from upload-based processing.
This doesn't eliminate all compliance considerations (your device security still matters), but it removes the largest risk category.
Practical Scenarios
Probably fine with upload tools:
- Converting a public domain document
- Processing files containing no personal data
- Using enterprise tools with signed DPAs
Should stay local:
- Client contracts and invoices
- Employee records and HR documents
- Medical or health information
- Financial statements and tax documents
- Any file with names, addresses, or ID numbers
Gray area:
- Marketing materials with team photos (contains personal data — faces are biometric data in some interpretations)
- Academic papers with author names
When in doubt, process locally.
What to Look For in Tool Privacy Policies
If you must use a server-based tool for business data:
- Data Processing Agreement available — required for B2B use
- EU data residency option — data processed within the EEA
- Specific retention period — "deleted within X hours," not "we may retain"
- Subprocessor list — who else sees your data
- Standard Contractual Clauses — for US-based processors
Free consumer tools rarely offer any of this.
For Small Businesses and Freelancers
You don't need a legal team to improve your practices:
- Default to local processing for any document with personal data
- Use tools with clear, auditable privacy architecture — client-side processing helps
- Avoid upload-based tools for client work unless you have a DPA
- Document your choices — "we process client documents locally in the browser" is a defensible policy statement
This Applies Beyond GDPR
Similar principles exist in:
- UK GDPR (post-Brexit UK)
- CCPA/CPRA (California)
- LGPD (Brazil)
- PIPEDA (Canada)
Local processing is the safest default regardless of jurisdiction.
Try It Yourself
BrowserStay processes files entirely in your browser — no uploads, no personal data transmitted to our servers. PDF tools and image tools for client work, contracts, and sensitive documents. No uploads — verifiable in your browser's Network tab.
No comments yet