Why the DPA comes first
As soon as cloud storage keeps personal data of your clients for you, it is a processor within the meaning of Art. 28 GDPR. You remain the controller and must conclude an agreement with it that has certain minimum contents. This applies regardless of the size of your business – also to sole traders, freelancers and small offices.
In practice it sometimes fails on a detail: some storage services only offer the agreement in business plans with several users. If you work alone, you face a choice between a plan that is too big and an agreement that does not exist for you. So check this point first. This is general guidance, not legal advice.
Contract and proof (points 1 to 4)
- A DPA for individuals too. Is the agreement available in the plan you actually need – or only from a minimum number of users?
- Conclusion without paperwork. Art. 28 (9) GDPR allows electronic conclusion. One click in your account is better than a form you have to print, sign and send.
- Proof for your records. You should be able to download the concluded agreement with date and version. In an audit by the supervisory authority, you need to show what was agreed.
- Wording readable in advance. Read the agreement before you pay. Look for the mandatory contents under Art. 28 (3) GDPR: subject matter, duration, nature and purpose, types of data, instructions, confidentiality, security measures, subprocessors, deletion and proof.
Location and service providers (points 5 and 6)
- Where is the data – and what is not there? A storage location in Germany or the EU spares you the assessment of transfers to third countries under Chapter V GDPR. But ask precisely: payments, email delivery or sign-in services often run through other providers. An honest provider tells you which ones.
- A public list of subprocessors. Which service providers does the provider use, for what and where? Is there a public, dated list? And are changes announced in advance so that you can object?
Everyday security (points 7 to 9)
- Concrete measures instead of buzzwords. The technical and organisational measures under Art. 32 GDPR should be described so that you understand them: encrypted transfer, two-factor sign-in, permission checks, a log of important actions. Be sceptical of promises such as “absolutely secure”.
- Sharing with control. Can you add a password, expiry date and download limit to links and later see what you shared with whom? In everyday work this matters more than almost any other feature.
- No analysis of your content. Does the agreement state that the provider does not analyse file contents for its own purposes – for example to train AI models? For client data you should have this in writing.
Exit and deletion (points 10 and 11)
- Take everything with you. Can you download all files at once, without help from support? A simple export is your insurance if you want to switch providers.
- Clear rules after the contract ends. What happens to the data after cancellation, and when is it deleted? If an account is simply emptied because of a payment arrear, that is a risk for client data.
For professionals bound by secrecy (point 12)
- Confidentiality agreement under Section 203 StGB. If you work as a doctor, lawyer, tax adviser or in another profession bound by secrecy, the provider must also be bound to secrecy (Section 203 (4) StGB). Details are on the page For professionals bound by secrecy.
How SafeDoc answers the checklist
| Point | At SafeDoc | Status |
|---|---|---|
| 1 DPA for individuals | On every paid plan from Plus, including individual accounts. | Built · launches with paid plans |
| 2 Conclusion | One click under Settings → Agreements. | |
| 3 Proof | Version, checksum of the wording, your details and the time are stored; save it as PDF or HTML. | |
| 4 Wording in advance | Readable in every account, including the free one. | |
| 5 Location | Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. Payments and email delivery run through external providers. | |
| 6 Service providers | Public, versioned list; changes announced at least 30 days in advance. | |
| 7 Measures | Encrypted transfer, two-factor sign-in and passkeys, permission check on every access, log of important actions. | |
| 8 Sharing with control | Password, expiry and download limit from Plus; overview under “Shared by me”. | Paid plans · soon |
| 9 No analysis | We do not use the contents of your files to train AI models and do not pass them on to providers of AI services. | |
| 10 Export | Download all files as a data package (ZIP), any time in your account. | |
| 11 After cancellation | The account continues as a free one; files stay available. We do not delete files because of payment arrears. | |
| 12 Section 203 StGB | The confidentiality agreement under Section 203 StGB can be concluded from launch. Before that, we bind everyone involved in our service to confidentiality in text form – only then do we offer it. You can already read the wording in your account under Settings → Agreements. | Built · launches with paid plans |
More on the measures is on the security page, the providers are listed under subprocessors, and everything about the agreement itself is on the data processing agreement page.
What the provider does not do for you
Even with the best agreement, some duties remain with you as the controller:
- Add the cloud storage to your record of processing activities (Art. 30 GDPR), if you have to keep one.
- Tell your clients in your privacy notice which service providers you use (Art. 13 GDPR).
- Use strong passwords and two-factor sign-in for your own account.
- Regularly check which links and shares are still needed.
How to pass on client data safely in everyday work is shown in the article Sharing client data under the GDPR.
Note
This article is general guidance and not legal advice. For your specific case, your professional chamber, association or an adviser can help.