The General Data Protection Regulation (GDPR) is a data protection law enacted by the European Union (EU) that went into effect on May 25, 2018. It governs the processing of personal data within its scope, including collection, use, storage, disclosure, and transfer.

GDPR applies to processing in the context of an organization's EU establishment, even when the processing takes place elsewhere. It can also apply to an organization outside the EU when it offers goods or services to people in the EU or monitors their behavior there. Company size and the location of a storage server do not, on their own, determine whether GDPR applies. The European Commission's applicability guidance explains these criteria.

For a Files.com workflow, identify the personal data, the purposes for processing it, and the organizations deciding those purposes or processing on their behalf. Customer, employee, and business-contact records can all raise data protection obligations. Your role and activities determine the responsibilities to evaluate; choosing an EU storage region addresses one aspect of the data flow.

Main Requirements

GDPR introduced strict requirements around:

Data subject rights (e.g., right to access, rectify, erase, or port personal data)
Lawful bases for processing data
Data minimization and retention policies
Transparency and accountability
Security of processing
Restrictions on international data transfers

Organizations processing personal data within GDPR's scope have responsibilities according to their role, including whether they act as a Data Controller or a Data Processor.

Files.com as a Data Processor

Files.com complies with the General Data Protection Regulation (GDPR) and provides the tools, controls, and contractual agreements that customers handling EU personal data need to meet their own obligations.

Files.com typically acts as a Data Processor under GDPR, processing data on behalf of customers who are the Data Controllers.

GDPR-related capabilities in Files.com include:

Role-based access control and user provisioning
Activity logging and audit trails
Configurable data retention and file expiration policies
Encryption in transit and at rest
Regional storage options, including the ability to store data in the EU
Support for customer-initiated deletion or export of user data

Data Protection Agreement (DPA)

Files.com offers a pre-written, pre-approved Data Protection Agreement (DPA) that incorporates GDPR-compliant language and outlines our responsibilities as a Data Processor.

This DPA covers:

Subprocessor disclosures
Data breach notification obligations
Data subject request support
Data transfer safeguards (including Standard Contractual Clauses, where applicable)
Technical and organizational security measures

Customers storing or transferring personal data covered by GDPR need to sign our DPA. We will execute it for any customer requiring it under GDPR. Contact your Account Executive or Support to obtain a copy for review and signature.

Subprocessors

Files.com uses Amazon Web Services (AWS) for platform hosting. AI Assistant and AI Tasks can also process customer information through AWS, Anthropic, and OpenAI, as described in AI data handling. Review the services enabled for your workflow alongside the DPA's subprocessor disclosures; a hosting-provider answer alone does not describe feature-specific AI processing.

We notify customers who have signed a DPA of changes to our subprocessors. The signed agreement governs the applicable processing terms and notification obligations.

Data Storage and International Transfers

Files.com offers EU-based storage regions for customer file contents. The selected file-storage region does not confine every related record or processing operation to the EU. Logs are stored in the United States, online document editing uses temporary United States processing, and enabled AI features can use provider-operated environments. Data Location & Processing explains the distinctions and the controls for transfer routing and connected systems.

International Transfer Safeguards and Certifications

Our Data Processing Agreement incorporates the 2021 EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. These provide contractual safeguards for the transfers they cover. Review the signed agreement, the relevant data flows, and the responsibilities of each party together.

Action Verb LLC d/b/a Files.com is certified to the EU–U.S. Data Privacy Framework (DPF). The certification covers the EU–U.S. framework; it does not include the UK Extension or the Swiss–U.S. DPF. UK transfers use the UK Addendum in our DPA, and Swiss transfers use the SCCs. Review our entry in the Department of Commerce's Data Privacy Framework List for the covered entities and data scope.

DPF participation and the contractual safeguards are separate bases for covered transfers. Files.com's SCC-based commitments operate independently of DPF participation. References to our former Privacy Shield participation describe the predecessor program, rather than an additional current transfer mechanism.

Shared Responsibility

GDPR compliance using Files.com is a shared responsibility. Files.com provides the platform, tools, and legal agreements that support GDPR requirements. You are responsible for how you collect, use, and manage personal data on the platform, and for confirming that your usage aligns with the principles of GDPR.

We recommend working with your organization's legal counsel or data protection officer to determine how Files.com fits into your overall GDPR compliance program.

Records of Processing Activity

Work with your legal counsel to determine whether you need records of processing activities for personal data stored or transferred through Files.com. Files.com does not know what data you store on the platform; understanding that data and governing its use remain your responsibility. The Shared Responsibility Model and Privacy Policy provide related context.