Sharing client data in line with the GDPR – with links, password and expiry date

The GDPR has no separate article on “sharing files”. It sets principles that apply to every disclosure. The most important are in Art. 5 (1) GDPR:

• Purpose limitation: you only pass data on for the purpose you hold it for – for example to fulfil an order.
• Data minimisation: the recipient only gets what they need for that purpose. Not the whole client file if a quote is enough.
• Storage limitation: data should not stay available longer than necessary. A link that never ends runs against this idea.
• Integrity and confidentiality: unauthorised people must not reach the data. Art. 32 GDPR requires appropriate technical and organisational measures for this.

In addition, every disclosure needs a legal basis under Art. 6 GDPR – for example because it is necessary for a contract with your client. Whether that applies in your case is for you to check; this article is general guidance, not legal advice.

Before you create a link, three questions are worth a minute. They prevent most mistakes:

1. Does this person really need the data? Sometimes a phone call or a summary without names is enough.
2. Which part is enough? An extract, a redacted copy or a single document instead of a whole folder.
3. How long do they need access? For a call-back the same day, a link that expires tomorrow is enough. For months of work together, sharing with an account fits better.

SafeDoc has three ways to share – and a fourth for the opposite case, when clients are meant to send you documents:

With a file request you send a link through which others upload straight into one of your folders – without an account and without seeing what is in it. It expires on a date you set. That is often better than having documents sent by email.

Password, expiry date and download limit for links come with the Plus plan and above Paid plans · soon. Simple links, sharing with people and file requests are included in every plan.

A password only protects if it does not travel together with the link. Three rules are enough:

• Two channels: the link by email, the password by text message, phone or messenger. Anyone who forwards the email then only has half the information.
• A separate password for each link: not the same word for every client. A password generator creates a random one in seconds.
• Long rather than complicated: SafeDoc requires at least 6 characters. For client data, considerably more makes sense – several random words are easy to read out.

Wrong attempts are slowed down on the server, so someone who does not know the password cannot try it out quickly.

• Expiry date: in SafeDoc you choose 1, 7 or 30 days. After that the link leads nowhere – even if someone forwarded it.
• Download limit: you set how often the file may be downloaded. The server counts; even many simultaneous requests do not exceed the limit.
• View only: the recipient can view the file in the browser but not download it. A screenshot is still possible, but copies stay few.

A good default for documents with client data: password, expiry after 7 days and a download limit of 2. If it has to be quicker, use 1 day. The actual download address expires after five minutes anyway; a copied address is useless afterwards.

When you share a folder, the recipient sees that folder and everything in it – but nothing above or beside it. So create a separate folder for each disclosure, for example “Client Meier – quote”. Then you share exactly what you mean and not, by accident, other clients’ documents.

Under “Shared by me” you see all links and shares in one place – and how often a link was downloaded. Make a habit of tidying up there: delete what nobody needs with one click. The link stops working immediately.

You can limit sharing with people to 1, 7, 30 or 90 days. When the project is over, access ends on its own – even if you forget.

1. Delete the link immediately under “Shared by me”. The counter shows whether it was already downloaded.
2. Note the incident with date, time and the data affected. Art. 33 (5) GDPR requires personal data breaches to be documented.
3. Check whether you must report it: if there is a risk to the people concerned, notifying the supervisory authority is usually due within 72 hours (Art. 33 GDPR), and with a high risk the people concerned must be informed too (Art. 34 GDPR).

A password and a short expiry often turn such a mistake into a small one: whoever only has the link cannot reach the file.

If client data is stored with a cloud provider, the provider processes it on your behalf. You need a data processing agreement under Art. 28 GDPR for this – also as a sole trader or freelancer. What it contains and when you need it is explained on the data processing agreement page.

At SafeDoc the DPA is included in every paid plan from Plus, including individual accounts Built · launches with paid plans. Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. We do not use the contents of your files to train AI models and do not pass them on to providers of AI services.

• Only share what the recipient needs for the purpose.
• Create a separate folder for each disclosure.
• Set a password and send it by a second channel.
• Choose an expiry date – if in doubt, 7 days or less.
• Set a download limit if only one person should download.
• Collect documents from clients with a file request instead of email.
• Tidy up “Shared by me” once a month.
• Conclude a DPA with your storage provider.