Sharing files with external partners in line with the GDPR

Quotes, drawings, contracts, staff lists: hardly any project works without exchanging documents with clients, contractors or partner companies. As soon as personal data is involved, the GDPR applies. If you want to share files externally and stay GDPR-compliant, a quick download link is not enough. This article explains what the law requires, which safeguards work well and where most mistakes happen in practice. Status: October 2026.

What the GDPR requires when you share files

The GDPR has no specific rule on “file sharing”. What matters are general principles and obligations that become very tangible when you work with external parties:

• Integrity and confidentiality (Art. 5(1)(f) GDPR): personal data must be protected by appropriate technical and organisational measures against unauthorised processing, loss and damage.
• Data minimisation (Art. 5(1)(c)): share only what the recipient actually needs for the task.
• Accountability (Art. 5(2)): you must be able to demonstrate compliance. Without a log, it is hard to prove later who received which file.
• Security of processing (Art. 32): the level of security must be appropriate to the risk. The regulation mentions encryption, the ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore data quickly after an incident, and regular testing of the measures.
• Processors (Art. 28): if a cloud service stores the files on your behalf, you need a data processing agreement (DPA) with the provider. What to look for is summarized in “DPA checklist: reviewing data processing agreements for cloud tools” (coming on December 2, 2026).

If something still goes wrong, for example because a file is sent to the wrong person, this may be a personal data breach. Under Art. 33 GDPR it must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the individuals concerned.

Technical safeguards for secure file exchange

Which measures are appropriate depends on the risk. For typical project documents, these building blocks have proven useful:

• Share links with a password and an expiry date: a link that stops working after the project cannot circulate for years. Send the password through a different channel than the link.
• Upload-only links instead of open folders: if external parties only need to deliver something, a link that lets them upload without seeing the folder’s contents is enough.
• Permissions based on need: grant view, comment and edit rights separately, and only for the folder in question. In its IT-Grundschutz module ORP.4, Germany’s Federal Office for Information Security (BSI) sets out the principle of least privilege and requires permissions that are no longer needed to be removed.
• Logging: who created which share and when, and who accessed it? An access counter on the link and an audit log support accountability.
• Versioning and trash: if a partner accidentally overwrites a file, the previous version can be restored. This supports availability under Art. 32.
• Strong sign-in: where external users have accounts, two-factor authentication should be available or required.

Common mistakes when sharing with external parties

Files as email attachments

Attachments are the most convenient option and the hardest to control. Once sent, copies sit in several mailboxes, cannot be recalled and are often forwarded. A typo in the address is enough for a data breach. In its guidance on email encryption, the German Data Protection Conference (DSK) states that mandatory transport encryption is sufficient for normal risks, while high risks generally require end-to-end encryption plus qualified transport encryption. It also mentions a web portal as a possible communication channel.

Private cloud accounts

Quickly sharing a folder from a personal cloud account: your company usually has no DPA with the provider of a private account, the data sits outside your administration, and when the person leaves the company, the access leaves with them.

Links without expiry and catch-all folders

Public links without a password or expiry date are rarely deleted. A large “External” folder that collects documents for different clients is just as risky. Share per project and per recipient.

Forgotten access

When a project ends or your contact at the partner changes, shares and memberships should end too. That only works if you keep an overview of your active shares.

Link, guest access or shared workspace?

Not every kind of collaboration needs the same tool. As a rough guide:

We compare the pros and cons of these models in detail in “Guest access or own account? How to bring in external users” (coming on November 25, 2026).

How nest54 handles sharing with partners

nest54 is built for projects involving several organizations. For file exchange, this means:

• Share links with password, expiry date, file drop (upload-only) and access counter. Under “Shared & favorites”, the “Shared by me” overview lists your shares and links with their access count.
• Shared workspaces with partners: partners work with the account of their own organization, clients join as read-only guests. Depending on the policy, both the invited organization and the invited person confirm (two-step approval). The image above shows such a workspace from the partner company’s perspective, with a label naming the host organization.
• Host principle: data, storage and encryption keys belong to the organization that created the workspace. If a partner leaves, the content stays with the host.
• Rules per workspace, for example no public links or mandatory two-factor authentication, and trust policies per organization: collaborate with everyone, only with partners, or not at all.
• Versions and trash for all files, encryption with a separate key per organization, and operation on servers in Germany.
• Traceability: a hash-chained audit log shows who changed what and when. Administrators manage the platform but cannot see content.
• DPA online: administrators conclude the data processing agreement directly in nest54; the current version is available at app.nest54.com/legal/dpa.

What nest54 cannot do for you: decide which data a partner really needs, and assess the risk. And anyone allowed to download a file can also pass it on. Read more about technology and data protection under Security.

Short checklist

1. Does the file contain personal data, and does the recipient really need it?
2. Does the exchange run through a tool covered by a DPA?
3. Do links have a password and an expiry date?
4. Are permissions limited to the necessary folder and role?
5. Can you trace who had access and when?
6. Do shares and memberships end when the project ends?