GDPR-compliant file conversion for EU businesses

Who this is for

EU-based businesses, agencies, or freelancers processing files that contain personal data — anything from CVs and signed contracts to invoices with customer names. Under GDPR, the converter you upload to is a processor acting on your behalf, and you (the controller) are responsible for picking one that doesn't blow up your compliance posture.

The five things to check

1. Data residency in the EU

GDPR doesn't strictly forbid international transfers, but it makes them complicated. Standard Contractual Clauses (SCCs) are technically possible, but post-Schrems II and the EU-US Data Privacy Framework, every transfer to the US is challengeable. The simplest path is to avoid the question entirely by picking a processor that hosts in the EU.

What "EU-hosted" should actually mean:

• The application servers run in an EU region (Frankfurt, Dublin, Amsterdam, Paris are the common ones)
• The object storage where files briefly live runs in the same EU region
• Backups (if any) stay in the EU

If a vendor says "we host in Europe" without naming a region, ask which.

2. A signable DPA

Article 28 requires a Data Processing Agreement between you and the converter. The DPA must specify:

• The scope and purpose of processing
• Sub-processors used
• Data residency
• Retention period
• Your right to audit / inspect
• The terms of deletion when you end the contract

Most reputable converters publish a standard DPA you can sign or counter-sign. If the converter doesn't have one — or worse, won't let you sign one — they're either too small for your compliance posture or not GDPR-ready.

3. Retention period named in days, not "as long as needed"

"As long as needed" is not a retention policy. A real retention policy is a number with a unit. "Files are deleted from our storage 24 hours after conversion" is a real policy. Same with "30 days" or "7 days" — what matters is that it's specific.

The shorter the retention, the smaller your blast radius if the converter is ever breached. 24 hours is healthy. Anything over 7 days for a stateless conversion is hard to justify.

4. Sub-processor list

Article 28 also requires you to be informed of every sub-processor handling your data. The privacy policy or DPA should list them: e.g., "AWS Frankfurt (storage), Stripe (payments), Resend (transactional email)". You should be able to assess each sub-processor's compliance posture independently.

If the vendor uses a US sub-processor at any point in the file path, that's a transfer — even if their primary servers are in the EU.

5. Deletion confirmation

When you cancel an account or finish processing a batch, the vendor should be able to confirm deletion within a reasonable window (usually 30 days). If they can't tell you how to verify deletion, they probably can't actually do it.

What bulkconvert does

• EU-hosted by default — Frankfurt region throughout (Vercel functions, Supabase data store, CloudConvert object storage)
• 24-hour retention for converted output, then permanent deletion
• DPA available on request — email hello@bulkconvert.io
• Sub-processors named: CloudConvert (conversion), Supabase (auth + state), Vercel (hosting), Stripe (payments), Resend (email). All have their own DPA and GDPR commitments
• We don't read file contents — no logging of file bodies, no analytics on file content, no AI training

For the API tier, the Bearer token is the only PII tied to your conversions. We don't know what's in the files you convert and don't store the bodies after the 24-hour download window.

What we don't have (yet)

• No ISO 27001 certification — we're a small operation. If formal certification is a hard requirement, you'll need a vendor large enough to amortise the audit cost.
• No SOC 2 — same reason.
• No EU-resident customer support staff under contract — solo founder for now.

If those gaps are blockers for you, the more enterprise-y converters (Smallpdf, Adobe) probably fit better. If you're a small team that just wants a converter that doesn't make GDPR worse, we're a sensible pick.

The pragmatic answer

For most EU SMBs and agencies converting normal business documents (invoices, contracts, presentations), the practical bar is:

• EU hosting (yes)
• Short retention (yes — 24h)
• Real privacy policy and DPA (yes — DPA on request)
• No file-content training (yes)

If you need more than that — formal SOC 2, BAA for HIPAA-adjacent work, named EU support staff — you're in enterprise vendor territory. We're not that.