If you're in the EEA, the UK, or you handle data belonging to people who are, "is this tool secure?" isn't actually the question that matters most when you pick something to send files through. Encryption is table stakes. GDPR compliance depends on things most "secure file sharing" marketing pages don't mention at all who's legally responsible for the data, where it physically goes, and what happens to it after you're done with it.
You're probably the controller, not the tool
When you upload a file containing someone else's personal data a client's contract, a candidate's CV, an employee record you're typically the data controller under GDPR, and the file-sharing service is a processor acting on your behalf. That distinction matters because it means you're the one accountable for the service you chose, not just the service itself. Before sending anything personal through a link, it's worth knowing exactly who that processor is, where they're based, and how to reach them not just that the file is "encrypted in transit."
Where does the data actually go?
A tool headquartered outside the EEA isn't automatically non-compliant, but transferring personal data there without safeguards is a real gap. The standard mechanism is Standard Contractual Clauses (SCCs) approved by the European Commission, applied to any sub-processor the service uses. If a provider can't tell you whether SCCs are in place for international transfers, that's a real answer just not a reassuring one.
What happens when the file expires or you delete your account
Link-based sharing is supposed to be temporary by design, but "temporary" only means something if deletion is actually enforced. Worth checking directly: does the file get deleted when the link expires, or does it sit on a server indefinitely? If you delete your account, does uploaded content go with it, or does it linger? A provider that can't give a straight answer to either question is telling you something about how seriously retention is handled.
Can people actually exercise their rights?
GDPR gives individuals the right to access, correct, delete, and export their data, and to object to how it's processed. For a file-sharing tool, this mostly comes down to you: can you export or delete someone's data on request within a reasonable window, using the tool itself, without filing a support ticket and waiting weeks? If erasure requires manual intervention from the provider every time, that's friction you'll feel the first time someone actually asks.
A short checklist before you send personal data through a link
- Named data controller and a real contact (not just a generic "support@") for data requests.
- Documented legal bases for processing — contract, consent, legitimate interest, or legal obligation, not left unstated.
- Safeguards for international transfers, such as SCCs, if the provider isn't based in the EEA.
- Enforced retention and deletion — files removed on link expiry or account deletion, not kept indefinitely "just in case."
- A real path to exercise rights — access, erasure, and portability available without weeks of back-and-forth.
On Letshareit, files are deleted on link expiry or account deletion, whichever comes first, and Standard Contractual Clauses cover transfers to sub-processors outside the EEA. The full breakdown controller details, legal bases, retention periods, and how to submit a data request is on the GDPR rights page. Password protection is available on every plan, including guest uploads, and new accounts get a 14-day Basic trial to try it on real client data before committing.
