Right to Erasure and File Sharing: What You Must Know
How the GDPR right to erasure affects file sharing platforms, including automatic deletion, data retention limits, and user deletion requests.
GDPR Article 17 (right to erasure) forces file sharing services and their customers to delete personal data on request within one month, including copies held by sub-processors and in backups, unless a specific exemption applies. For file transfers, this means you need a deletion mechanism that reaches every storage tier — hot object storage, CDN caches, cold backups, and downstream recipients who downloaded the file. Services with auto-expiry of 7-30 days handle most erasure requests by default; services that retain files indefinitely need a documented, testable deletion workflow.
What Article 17(1) actually requires
Article 17(1) lists six grounds that trigger erasure: data is no longer necessary for the original purpose (a), the subject withdraws consent (b), the subject objects under Article 21 and no overriding legitimate ground exists (c), data was unlawfully processed (d), legal obligation to erase (e), and children's data collected under Article 8(1) (f). For file sharing, (a) and (b) dominate. The default "necessary for the purpose" window for a client deliverable is the project duration plus a short tail for dispute resolution — rarely more than 12 months.
The one-month response clock
Article 12(3) gives controllers one month to respond to a subject request, extendable by two months for complex cases with notice to the subject. That's the response clock, not a technical deletion clock. But if you're still deleting files manually via JIRA tickets three weeks after receipt, you're cutting it close. Services with API-driven deletion — DELETE /transfers/{id} returning 204 — let you meet the timeline without overtime. Build the deletion call into your GDPR request intake form so it fires automatically when a ticket is approved.
Backups, caches, and the "cascade" problem
Deleting a file from primary storage doesn't delete it from yesterday's backup, last week's CDN edge cache, or the recipient's laptop. The EDPB guidance on Article 17 (published 2019, revised 2022) accepts that backups can lag but requires a documented deletion schedule — typically full rotation within 90 days — and a commitment that backed-up data is not restored to active systems. For CDN caches, invalidation calls (Cloudflare's purge API, AWS CloudFront invalidation) should be part of the deletion pipeline. For recipient copies, notify under Article 17(2) and document the notification.
Link expiry as structural erasure
The cleanest compliance path is not retaining files beyond what's needed. Services built around short-lived links — SwissTransfer at 30 days, Firefox Send at 1-7 days before it shut down, WeTransfer Free at 7 days, HexaTransfer at 7 days — delete automatically regardless of whether anyone requested it. This is "privacy by design" under Article 25: the default minimizes retention. If you're building a transfer tool or picking one, default expiry below 30 days turns most erasure requests into a no-op because the file is already gone.
Exemptions under Article 17(3)
Article 17(3) lists five exemptions: freedom of expression (a), legal obligations including retention rules (b), public interest in health (c), archiving for public interest, scientific or historical research (d), and establishment or defense of legal claims (e). In file sharing, (b) and (e) come up. A PDF contract shared with a client may need to be kept for seven years under VAT regulation or ten years under commercial code — document the retention law, pseudonymize where feasible, and don't delete on demand. Document the refusal in writing with legal basis.
Cryptographic erasure for tamper-proof storage
Some storage systems (immutable object storage, WORM backups, certain blockchain-adjacent archives) cannot physically overwrite data. Cryptographic erasure — destroying the encryption key so ciphertext becomes unrecoverable — is accepted by ENISA and the EDPB as equivalent to deletion for GDPR purposes, provided the cipher is strong (AES-256-GCM or better) and the key was properly protected. Services using per-file or per-transfer keys can honor erasure by discarding the key, leaving ciphertext that no one can decrypt. This is faster than overwriting terabytes and works on immutable systems.
Deletion logs and the accountability principle
Article 5(2) requires controllers to demonstrate compliance. Delete logs are your proof. For each erasure, record: request date, subject identifier, ticket reference, systems targeted (primary storage, backups, CDN, recipient notification list), deletion method (API call, key destruction, overwrite), completion timestamp, and operator. Six-month retention of the log itself is a common baseline. Some providers expose a "Right to Erasure confirmation" PDF you can forward to the subject; others just update the ticket. Either way, keep the paper trail for as long as supervisory authority inquiries are plausible — typically three years.
Shared folders and downstream recipients
A file sent to five recipients lives in five mailboxes plus five local hard drives. Article 17(2) requires controllers to take reasonable steps — including technical measures — to inform other controllers processing the data that erasure has been requested. "Reasonable" scales with risk. For a public executive summary sent to 50 journalists, "reasonable" is near zero. For a medical report sent to three specialists, it's an email to each with the request to delete. Log the notifications; the obligation is effort, not success.
Children's data and stricter thresholds
Under Article 17(1)(f), personal data collected from children under Article 8(1) — where parental consent was required for information society services — gets preferential erasure treatment. If the file transfer platform ran a marketing campaign collecting kids' contact details (uncommon but not impossible), erasure requests must be honored without the usual balancing. National laws lower the Article 8 age threshold in some member states (13 in Sweden and the UK, 15 in France, 16 in Germany). Providers targeting educational markets need workflows that handle parent-initiated requests on behalf of minors.
Automating erasure with your transfer tool
The efficient pattern is a single API endpoint that, given a user identifier, enumerates all transfers involving that user (as sender or recipient email), deletes them across primary and cache tiers, invalidates CDN edges, triggers backup suppression, and emits a compliance receipt. Tresorit, Proton Drive, and Box Enterprise expose variants. HexaTransfer's model — 7-day automatic expiry with client-side encryption — collapses the problem: most files are already gone when requests arrive, and remaining ciphertext is useless without the user-held key.
Design for deletion first and the erasure right answers itself. Try it at hexatransfer.com — free, no account, 10 GB max.
Send large files securely with end-to-end encryption
Transfer files up to 10 GB for free with end-to-end encryption. No account required. Your files are encrypted in your browser before upload — no one else can read them.
Send a file