GDPR and File Conversion: What You Need to Know in 2026

If you use online tools to convert files that contain personal data — photos of people, documents with names, client deliverables — GDPR applies. Here's what that means practically, and how to avoid the complexity entirely.

When GDPR Applies to File Conversion

GDPR applies whenever you process personal data of EU residents. "Personal data" includes:

• Photos of identifiable people — employee headshots, customer photos, event photography
• Documents with names, addresses, or contact info — contracts, invoices, letters
• Medical or legal files — anything with patient or client information
• Scanned IDs or certificates — passports, licenses, diplomas

If you upload any of these to a cloud converter, that converter becomes a data processor under GDPR — and you're the data controller responsible for ensuring compliance.

Your Obligations as Data Controller

When you use a cloud-based converter, you must:

1. Have a Data Processing Agreement (DPA) with the converter service
2. Verify they process data in compliant jurisdictions (or have adequate safeguards)
3. Ensure they delete files after processing (and verify the claim)
4. Document the processing in your Records of Processing Activities (ROPA)
5. Inform data subjects that their data is processed by third parties

Most people using a quick online converter don't do any of this. Technically, they're non-compliant.

The Fines Are Real

GDPR enforcement has intensified. Cumulative fines have exceeded €6.7 billion. While most large fines target big companies, SMEs face increasing scrutiny — especially in healthcare, legal, and financial sectors.

The EU's 2025 GDPR reform expanded some SME exemptions, but the core data processing obligations remain. Uploading client documents to random online converters is still a compliance risk.

The Simple Solution: Don't Upload

Browser-based conversion eliminates GDPR data processing concerns entirely:

• No upload = no data leaves your device
• No data processor = no DPA required
• No third-party processing = no documentation needed
• No jurisdictional issues = processing happens on your own device

If no personal data is sent to a server, GDPR's data processing provisions don't apply to the conversion step. The data stays with the data controller (you) the entire time.

Practical Scenarios

Scenario 1: HR Converting Employee Documents

An HR department needs to convert employee contracts from DOCX to PDF.

Cloud converter: Requires DPA, data flow documentation, and employee notification. Files containing names, addresses, and salary information are uploaded to a third party.

Browser-based converter: Documents stay on the HR computer. No third-party involvement. No GDPR complexity.

Scenario 2: Photographer Delivering Client Work

A photographer needs to convert and resize client portraits.

Cloud converter: Client photos (personal data) are uploaded to a service. If the photographer has a privacy agreement with clients, uploading to undisclosed third parties may breach it.

Browser-based converter: Photos stay on the photographer's device. Client privacy is maintained.

Scenario 3: Medical Office Scanning Records

A clinic needs to convert scanned patient documents from TIFF to PDF.

Cloud converter: Uploading patient data to a converter is almost certainly a HIPAA/GDPR violation without extensive compliance setup.

Browser-based converter: Patient data never leaves the clinic's computer.

How to Verify Browser-Based Processing

Don't trust marketing claims. Verify:

1. Open your browser's Developer Tools (F12)
2. Go to the Network tab
3. Start a file conversion
4. Check for outgoing data requests

In Konvrt, you'll see that file data is never sent to any external server during conversion. The WebAssembly-based processing runs entirely locally.

The Bottom Line

For non-personal content (stock photos, public domain documents), cloud converters are fine. For anything containing personal data, browser-based conversion is the simplest, safest, and most compliant approach.

You don't need a DPA if there's no data processor. You don't need data flow documentation if data doesn't flow anywhere.