GDPR Consent Management for Secure File Transfers
Master GDPR consent requirements for file transfers including lawful bases, opt-in mechanisms, consent records, and withdrawal procedures.
Consent under GDPR Article 6(1)(a) is often the wrong lawful basis for file transfers. Contracts (6(1)(b)), legal obligations (6(1)(c)), and legitimate interests (6(1)(f)) cover most B2B file-sharing scenarios without asking subjects to opt in. When consent genuinely is the right basis — marketing lists, newsletter signups, voluntary data contributions — Article 7 sets strict rules: freely given, specific, informed, unambiguous, and withdrawable at any time with the same ease as granting it. Get consent wrong and the whole transfer becomes unlawful processing under Article 5(1)(a).
Why consent is rarely the right basis for B2B transfers
A freelancer sending a client a 2 GB project delivery doesn't need the client's consent — the contract of engagement is the lawful basis under 6(1)(b). A law firm sending a signed NDA to the counterparty doesn't need consent either. A clinical trial site transferring pseudonymized data to the sponsor operates under 6(1)(b) or 9(2)(j) for special category data. Defaulting to consent for everything creates fragility: subjects can withdraw at any time under Article 7(3), potentially leaving you unable to complete contractual obligations. Pick the right basis once, document it, stop asking.
The Article 7 consent requirements
Article 7(1) makes you prove consent was given. Article 7(2) says consent requests must be clearly distinguishable, intelligible, and in plain language. Article 7(3) guarantees withdrawal as easy as granting. Article 7(4) invalidates consent where it's conditional on service delivery that doesn't actually require the data. Translated to file transfers: you can't bundle "I agree to receive marketing PDFs" with "I agree to receive my purchase receipt." The first is consent, the second is contractual performance. Separate them or you've violated Article 7(4).
Dark patterns that break consent
A pre-ticked checkbox is invalid (Planet49 C-673/17, October 2019). Cookie walls that refuse service until consent is given are invalid for non-essential cookies (EDPB guidance, May 2020). "Accept all" and "Reject all" buttons must be equally prominent (CNIL fines against Google and Facebook, December 2021, EUR 150M and EUR 60M). For file transfers, the equivalent dark pattern is bundling download access with marketing opt-in: "Download your file" is essential; "Subscribe to our newsletter" is not. Never merge them behind a single button.
Granular consent and file types
If you run a platform where users upload photos, documents, and video, subjects need granular consent for each data type. A newsletter where subscribers also upload vacation photos to a shared gallery needs separate consent for email marketing and for photo hosting. Granularity extends to purposes: consent to "share with partners" without naming the partners fails Article 7's "specific" test. Name the categories of recipients — advertisers, analytics providers, sub-processors — and if you can't, fall back to legitimate interests with a proper balancing test.
Consent records and proof of consent
Article 7(1) places the burden of proof on the controller. A consent record needs five fields at minimum: who consented (subject ID, email, or hashed identifier), when (timestamp, timezone), what they consented to (exact text shown), how (form version, IP, user agent for web captures), and how to withdraw (reference to the mechanism). Tools like OneTrust, Usercentrics, Didomi, and Cookiebot handle web captures; for in-product flows, build your own event log with append-only semantics. Retention matches the validity window of the consent plus the statute of limitations (typically six years in the UK, five in France).
Withdrawal workflows that match the ease of granting
Article 7(3) requires withdrawal to be as easy as consent. If consent was a single checkbox click, withdrawal must be a single click. Hidden preference centers behind three account menus fail. Email-based unsubscribe links work if they resolve the withdrawal on click without requiring the user to log in. For file transfers, withdrawal typically means stopping future transfers and erasing past ones under Article 17(1)(b) where consent was the only basis. Your unsubscribe endpoint should fire both the consent-revocation event and the erasure job.
Children's consent and parental verification
Article 8 sets 16 as the default age below which parental consent is required for information society services, with member states free to lower to 13. France uses 15, Germany 16, Spain 14, Sweden and Portugal 13. Verification methods acceptable to regulators include credit card checks, national ID verification, signed consent forms, and double opt-in with the parent's verified email. If your file transfer platform targets education, under-16 uploaders must obtain parental consent for any data processing based on consent (usually account creation and marketing, sometimes file storage retention).
Consent for international transfers
Article 49(1)(a) allows consent as a derogation for transfers to non-adequate countries, but only for occasional, non-repetitive transfers. The EDPB Guidelines 2/2018 on Article 49 emphasize "explicit consent" — a higher bar than ordinary consent — requiring a written statement or equivalent, and the subject must be informed of the specific risks, including the absence of an adequacy decision and the availability of appropriate safeguards. For routine file transfers to the US or other non-adequate jurisdictions, use SCCs plus a Transfer Impact Assessment instead. Consent is an emergency lever, not a scaling strategy.
Re-consent when the terms change
If you change processing purposes, add new recipients, or extend retention, existing consents may no longer cover the expanded processing. The safest move is fresh consent with updated disclosures. Scaling back is fine without re-consent. The test: would the original consent have been given if the subject had known the new facts? If in doubt, re-consent. Trigger the re-consent flow before the new processing starts, not after, and pause transfers until fresh consent is recorded.
Technical integration patterns
In a file transfer product, the clean pattern is a consent microservice that every upload, download, and notification call checks before proceeding. The consent record carries a UUID referenced in audit logs for every file operation. Withdrawal invalidates future checks and triggers an async erasure job. Services like HexaTransfer avoid the complexity by basing transfers on contractual necessity — the sender initiates, the recipient downloads, both implicit under the transfer contract — and reserve Article 6(1)(a) consent for the optional newsletter signup.
Consent is a tool, not a default. Pick the lawful basis that fits the operation. Try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file