GDPR Compliant File Sharing: 7 Tools Compared (2026)

Updated October 24, 2026•⏱️ 12 min read

AI Quick Summary (TL;DR)

No file sharing tool is GDPR compliant on its own. Compliance depends on the vendor and on how you set it up. You need a signed DPA (Article 28), a lawful basis for any transfer outside the EU (Chapter V), encryption and access control (Article 32), and logs that tell you what was accessed if something goes wrong (Article 33).

Sharing sensitive files with people outside your company and seeing who read them: SendNow. It is our product, and it is hosted on AWS in the US, so you rely on a transfer mechanism (see below).
Encrypted team storage hosted in Europe: Tresorit.
Already on Microsoft 365: SharePoint with the EU Data Boundary.
Full control on your own servers: Nextcloud.

GDPR compliant file sharing tools header image

Last updated 24 October 2026. What changed: all prices re-checked on vendor sites, a plain answer on US-hosted tools after the 2025 Latombe ruling, a "which transfer rule applies" table, a DPA checklist, corrected German and French notes, and an FAQ built from questions people ask on Reddit's r/gdpr.

Tool	Where data is stored	Main strength	Per-recipient page analytics	NDA gate	Price (checked 24 Oct 2026)
SendNow	AWS, US	External sharing with tracking, NDA, watermarks	Yes	Yes (Pro and up)	$6.25/mo billed yearly ($9 monthly), 1 seat
Tresorit	EU/Swiss, with data residency options	Zero-knowledge encrypted storage	Document analytics on Business Pro	No	Business: at least 3 users; about €16/user/mo yearly (third-party figure)
Proton Drive Professional	Switzerland	End-to-end encrypted storage	No	No	$9.99/user/mo billed monthly
SharePoint (EU Data Boundary)	EU/EFTA	Fits Microsoft 365	No	No	Included in Microsoft 365 business plans
Nextcloud	Wherever you host it	Full data control, open source	No	No	Free self-hosted; Enterprise from €71.29/user/yr (100+ users)
Oodrive	France (SecNumCloud option)	French sovereign cloud	Basic	No	Quote
ShareFile	Choice of storage zones	Client portals and requests	Basic	No	Advanced $16.50/user/mo yearly, 3-user minimum

Sources: SendNow pricing, Tresorit and Office Software Marketplace review, Proton, Microsoft EU Data Boundary, Nextcloud, Oodrive, ShareFile.

Which tool fits which situation

If you need...	Pick	Why
To send decks, proposals or deal files to outsiders and see who read them	SendNow	Per-recipient links, page-level analytics, NDA gate, watermarks
Encrypted team storage in Europe	Tresorit	Zero-knowledge encryption, ISO 27001, data residency options
Swiss encrypted storage for a small team	Proton Drive Professional	End-to-end encryption, simple sharing with passwords and expiry
To stay inside Microsoft 365	SharePoint (EU Data Boundary)	EU/EFTA storage, Purview audit logs
French public sector or regulated work	Oodrive	ANSSI SecNumCloud qualification since 2019
Full control over where data sits	Nextcloud	Self-host, or Nextcloud One hosted in Germany
Client portals and document requests	ShareFile	Structured portals, request lists

Share files with outsiders and know who read them

Email gate, password, expiry and page-level analytics. 24-hour trial, no credit card.

From $6.25/mo after the trial · No card required

Try SendNow

Five things, each tied to the text of the Regulation:

GDPR rule	What it means for file sharing	What to look for in a tool
Article 28: processors	The vendor processes data for you	A signed DPA, a public sub-processor list
Chapter V: transfers	Data leaving the EU/EEA needs a legal basis	EU hosting, or an adequacy decision, or SCCs
Article 32: security	"Appropriate" technical measures	Encryption at rest and in transit, access control, revoke
Article 5(1)(c) and (e): minimisation and storage limits	Collect less, keep it for less time	Expiry dates, auto-delete, only ask for an email
Article 33: breach notice within 72 hours	You must know what was exposed	Per-person access logs you can export

Source: GDPR full text, EUR-Lex.

Yes, if you have a valid transfer basis. The main options:

Your situation	Transfer basis	What to do
Vendor is certified under the EU-US Data Privacy Framework	Adequacy decision (2023)	Check the vendor on the DPF list
Vendor is not DPF-certified	Standard Contractual Clauses	Sign the DPA with SCCs and do a transfer impact assessment
Data stays in the EU/EEA	No transfer	Confirm support staff access also stays in the EU

On 3 September 2025 the EU General Court dismissed Philippe Latombe's challenge and upheld the Data Privacy Framework. Source: EUR-Lex, Case T-553/23 He appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P), and that appeal is still pending. Source: EUR-Lex, Case C-703/25 P The DPF stands today, but its two predecessors (Safe Harbor and Privacy Shield) were both struck down, so many DPOs keep SCCs in the contract as a backup.

Where SendNow stands: SendNow is hosted on AWS in the US, with AES-256 at rest and TLS 1.3 in transit. If your DPO requires data to stay in the EU, use an EU-hosted tool from this list for that data.

1. SendNow

Best for: founders, finance teams and advisors sending sensitive files to people outside the company.

SendNow gives each recipient a tracked link and shows which pages they read and for how long. You can require an email before viewing (Lite), add an NDA gate and screenshot blocker (Pro), and add dynamic watermarks, an allow-list and a custom domain (Business). Every plan has unlimited viewers.

Price: Lite $6.25/mo billed yearly ($9 monthly), 5 docs. Pro $9/mo billed yearly ($17 monthly), 100 docs. Business $20/mo billed yearly ($43 monthly), 300 docs. Microsites Pro $12.40/mo billed yearly ($19 monthly). One seat per plan. Source
GDPR angle: you collect only an email, set expiry, revoke any link, and keep a per-person log for Article 33.
Watch out: hosted on AWS in the US. Not a team storage drive.

Video: How to Share a PDF Securely and Track Who Reads It1:16 video

2. Tresorit

Best for: teams that want encrypted storage and sharing in Europe.

Tresorit is zero-knowledge: "Tresorit can't access your files and keys." It lists ISO 27001 certification and GDPR, TISAX and FINRA compliance, and offers a custom DPA on request. Links can have a password, expiry, open limit and "require email to view". Business Pro adds dynamic watermarks, a custom domain and document analytics. Source: Tresorit

Price: Business needs at least 3 users. Tresorit's page loads prices by region; a 2026 review lists €16/user/mo billed yearly. Source 14-day trial, card required.
Watch out: no NDA gate; page-level analytics only on the top plan.

3. Proton Drive Professional

Best for: small teams that want simple, Swiss, end-to-end encrypted storage.

Proton says "not even Proton can access your data." Shared links can have passwords, expiry dates and can be revoked at any time. Source: Proton

Price: Drive Professional $9.99/user/mo billed monthly, 1 TB per user.
Watch out: no recipient analytics, no NDA gate, no watermark.

4. SharePoint (EU Data Boundary)

Best for: companies already on Microsoft 365.

Microsoft completed the EU Data Boundary on 26 February 2025. The final phase moved support data, including logs and support-case notes, into the EU/EFTA. Source: Microsoft

Price: included in Microsoft 365 business plans.
Watch out: external sharing setup is complex, and guests often need a Microsoft account or a code. No page-level analytics.

5. Nextcloud

Best for: organisations that want full control and have IT staff.

The community edition is free to self-host. Nextcloud Enterprise starts at €71.29/user/year at 100 users. Under 100 users, Nextcloud One is a managed service "hosted in Germany." Source: Nextcloud

Watch out: you are responsible for patching and security. If the server is compromised, files are exposed unless you add encryption.

6. Oodrive

Best for: French public sector and regulated industries.

Oodrive is "SecNumCloud-certified by ANSSI since 2019" and offers a public cloud or a SecNumCloud private cloud. Source: Oodrive

Price: quote only.
Watch out: enterprise sales process; limited document analytics.

7. ShareFile

Best for: accounting and professional services firms that collect files from clients.

Price: Advanced $16.50/user/mo billed yearly ($18.15 monthly), minimum 3 users. Premium $26. Virtual Data Room $69.30/user/mo, minimum 5 users. Source: ShareFile
Watch out: a US-based company, so check the transfer terms even if you pick an EU storage zone.

What to check in a vendor's DPA

Sub-processors: is there a public list, and will they tell you before adding one?
Location: where is data stored, and where can support staff access it from?
Transfer basis: DPF certification, SCCs, or both?
Breach notice: how fast will they tell you? You have 72 hours to tell your regulator.
Deletion: how long until deleted files are really gone, including backups?
Audits: can you see a SOC 2 or ISO 27001 report?

A signed DPA (in Germany often called an AV-Vertrag) with SCCs if data leaves the EU/EEA
You know where the data is stored, or you have a transfer basis
AES-256 at rest and TLS 1.2+ in transit
You can revoke a link instantly if it was sent to the wrong person
Per-person access log with time and date
No open public links for personal data: email check, password or allow-list
Public sub-processor list
Expiry dates, so files don't stay online forever
Dynamic watermarks on the most sensitive files
A privacy policy that explains access, erasure and portability rights

Tick five of these boxes in one place

Revoke any link, set expiry, require an email, and see a per-person log.

From $6.25/mo after the trial · No card required

Try SendNow

Germany-specific notes (DSGVO)

DSGVO (Datenschutz-Grundverordnung) is simply the German name for the GDPR. Germany adds its own Federal Data Protection Act (BDSG). Data protection is enforced by the federal commissioner (BfDI) and by state authorities, which supervise most private companies.

A signed DPA (AV-Vertrag) is required whenever a vendor processes personal data for you.
German buyers often prefer vendors with BSI C5 attestation or German hosting.
If you use a US-hosted tool such as SendNow, record the transfer basis (DPF or SCCs) in your records of processing. See SendNow's security page.

France-specific notes (RGPD)

In France the GDPR is called the RGPD and is enforced by the CNIL. For many public bodies and operators of vital importance, French rules push towards SecNumCloud-qualified hosting from ANSSI, which is designed to protect against non-EU laws such as the US CLOUD Act. Oodrive is a common choice there. For most private companies, a vendor with EU hosting and a solid DPA is enough.

Upload the report and switch on "require email", so you only collect the viewer's email.
Set an expiry date that matches how long the client needs it.
Turn downloads off if the report should not leave the viewer.
When the work ends, revoke the link.

Collecting only what you need and switching access off when you are done are the habits GDPR asks for in practice.

Video: How to Create a Virtual Data Room in Minutes1:52 video

These questions come up again and again on Reddit's r/gdpr, for example in the threads "Secure File Sharing Solutions" and "EU-based, GDPR-compliant third party data sharing service?".

No official GDPR certificate is in wide use for file sharing tools. Treat "GDPR compliant" badges as marketing. Check the DPA, hosting location, transfer basis and security reports instead.

Is it legal to use a US cloud tool for EU personal data?

Yes, with a transfer basis. The EU-US Data Privacy Framework was upheld by the General Court in September 2025, and an appeal is pending. If the vendor is not DPF-certified, use SCCs plus a transfer impact assessment.

It can be used in a compliant way if you sign its DPA and check where your data is stored. Check the current hosting options on your plan with Dropbox. It has no NDA gate or page-level analytics.

Is WeTransfer OK for client personal data?

For low-risk files, maybe. For sensitive personal data, r/gdpr users regularly suggest tools with access control and audit logs instead of open transfer links. Anyone with a public link can open it.

Under Article 83, the top tier is up to €20 million or 4% of global annual turnover, whichever is higher. Security failures under Article 32 fall in the lower tier: up to €10 million or 2%.

Yes, if the vendor processes personal data for you (Article 28). In Germany this is usually called an AV-Vertrag.

For tracked external sharing with an NDA gate and watermarks, SendNow. For EU-hosted encrypted storage, Tresorit or Proton. SendNow is our product and is hosted in the US, so check the table against your DPO's rules.

Does SendNow store data in the EU?

No. SendNow is hosted on AWS in the US. It uses AES-256 at rest and TLS 1.3 in transit.

Try tracked, secure sharing today

24-hour free trial with 2 uploads and 1 Microsite. No credit card.

From $6.25/mo after the trial · No card required

Try SendNow free

Sources

GDPR full text (EUR-Lex)
General Court, Latombe v Commission, T-553/23
Appeal C-703/25 P
Data Privacy Framework list
Microsoft: EU Data Boundary complete
Vendor pricing pages: Tresorit, Proton, Nextcloud, Oodrive, ShareFile

Keep Reading

About the Author: Rifana Hameem

Rifana is the founder of SendNow. She leads the team in building secure, compliant, and analytics-rich document sharing tools for finance and professional teams worldwide.

Connect on LinkedIn