If you handle PDFs that contain personal data — employment contracts, client files, invoices with VAT numbers, quotes with bank coordinates — the GDPR compliance question isn't optional.
And the answer is more nuanced than the "GDPR compliant" badge displayed by most online services. Here's what to understand before trusting an online PDF tool with a sensitive document.
GDPR doesn't apply to where your data is — it applies to who processes it
First common misunderstanding: GDPR applies to any company processing data of people located in the European Union, regardless of where the company is established. An online PDF service that serves European users must therefore comply with it, whether it's European, American or from anywhere else.
So being "GDPR compliant" is a baseline. The real question lies elsewhere: where are your files processed, by whom, and under which law? As soon as personal data leaves the European Economic Area, or a provider subject to foreign law can access it, additional rules come into play.
Schrems II: the 2020 ruling that changed everything
In July 2020, the Court of Justice of the European Union invalidated the Privacy Shield, the agreement that framed personal data transfers between the EU and the United States. Why? Because US surveillance programs (FISA Section 702, Executive Order 12333) allow intelligence agencies to access certain data, without sufficient legal recourse for the affected Europeans.
Concretely, Schrems II had two consequences:
- Transfers to the United States could no longer rely on the Privacy Shield.
- Standard Contractual Clauses (SCCs) remained usable, but only after a case-by-case assessment of the destination country's law and, where needed, supplementary measures (encryption where the recipient doesn't hold the key, pseudonymization, etc.).
Since 2023: the Data Privacy Framework
In July 2023, the European Commission adopted a new adequacy decision, the EU-U.S. Data Privacy Framework (DPF). US companies that join it can once again receive personal data from the EU without relying on Standard Contractual Clauses.
The framework is still debated: it has already been challenged before the European courts, and its strength depends on the safeguards provided by US law. Above all, the DPF governs data transfers: it doesn't change the CLOUD Act, which is about US authorities accessing data held by companies subject to US law, wherever that data is stored.
The CLOUD Act: access to data, wherever it's stored
Passed in 2018, the CLOUD Act (Clarifying Lawful Overseas Use of Data Act) lets US authorities, through legal process (a warrant or court order), require a service provider subject to US law to disclose data in its possession, custody or control — even if it's stored outside the United States, including in a European data center. The affected user isn't necessarily informed.
Who is concerned?
- US companies and their subsidiaries — for example Adobe, headquartered in San Jose, California;
- Potentially, data that a non-US service entrusts to a US provider (hosting, cloud), since that provider is itself subject to US law.
To find out where a given service stands, there's one reliable method: read its privacy policy and its subprocessor list, which state which providers process your files, and in which countries.
For a trivial PDF, that's not a real risk. For an HR file, a commercial contract, or a legal document, it's better to know which jurisdiction you're exposing it to before you send it.
What does the CNIL say?
After the Schrems II ruling, France's data protection authority, the CNIL, took a position on data transfers to the United States several times. In particular, it recommended that the most sensitive data, such as health data, be entrusted to providers not subject to US law, and called on higher education and research institutions to change how they use US collaboration tools. In 2022, it also found data transfers linked to a US web analytics tool to be non-compliant.
These positions predate the Data Privacy Framework, but their logic still holds: the more sensitive a document, the more prudent it is to know exactly who can access it.
How to know if a service is truly sovereign
Five questions to ask your current PDF tool (its privacy policy and subprocessor list should answer them):
- Where are files physically processed and hosted? (country, and city if possible)
- Is the company, or its parent company, subject to US law or that of another third country?
- Who are its subprocessors (hosting, cloud), and under which law do they operate?
- Is there an identifiable contact for data protection questions?
- What's the exact retention period for uploaded files?
For PDFly, the answers are:
- France (Paris) — a server in the European Union
- Belgium — PDFly is an independent Belgian project, operated by ReDesign
- No US cloud — a Hostinger VPS, hosted in Paris
- Yes — direct contact at info@redesignapp.be
- No retention at all for every tool available today (nothing is uploaded). The server-side tools coming soon (OCR, Office conversions, PDF/A…) will delete files immediately after processing
The "browser" argument changes everything
All the PDFly tools available today run entirely in your browser, thanks to modern libraries (pdf-lib, WebAssembly). Your files never leave your machine.
This elegantly resolves the entire GDPR question for those operations: there's no data transfer to protect, so no Cloud Act, no Schrems II, no contractual clauses to invoke. You retain the full processing chain.
It's GDPR's data minimization principle taken all the way: the best-protected data is the data you never send.
In practice, how to migrate?
If you currently use a PDF service subject to US law and want to test an alternative:
- Identify your sensitive operations: which PDF tasks process personal or confidential data?
- Test the European tool for those tasks first (merge, compress, sign)
- Keep your current tool for non-sensitive content if needed (a public marketing document)
- Document the change in your GDPR processing register
PDFly is entirely free: the 12 tools available today (merge, split, compress, sign…) cover most everyday needs, with no sign-up, no ads and no tracking cookies. Office conversions, OCR and PDF/A are coming soon — free as well, with fair-use limits, and processed on our servers in Paris. No Cloud Act, no transfer outside the EU.