Converting confidential files
Contracts, medical records, unreleased footage and client work. How to convert files you are not permitted to upload, without breaking the rules you work under.
Last updated
The files people cannot upload
A great deal of professional work involves files that are not yours to share. A photographer under embargo, a solicitor with a client’s contract, a clinician with a scan, an agency with footage that has not launched. All of them periodically need a file in a different format, and all of them are told, correctly, not to put it on a website.
The usual advice is to install desktop software, which is right and which most people do not do, because they need this twice a year and the file is due in ten minutes.
Why local conversion changes the compliance question
Most data protection rules are concerned with transfer and processing by others. Uploading a file to a converter creates a processor relationship, a transfer, and often a cross-border one. Converting the same file in your own browser creates none of those, because the file does not move and nobody else touches it.
This is not a legal opinion and your own obligations still apply to the file sitting on your disk. But the specific act that is usually forbidden — handing the file to a third party — does not occur.
Verify it rather than trusting it
You should not take a privacy claim on faith, and this one does not require you to. Open the Network tab in your browser’s developer tools before converting. Every request the page makes is listed there. Your file will not be among them.
If you want a stronger test, disconnect from the network entirely after the page loads and convert anyway. It works, which is only possible if nothing was being sent.
What we can see
In the interest of not overclaiming: the site uses analytics that record which pages are opened and where people click, and filenames are masked so they cannot be captured. That is information about the website. It is not information about your files, which are never transmitted and therefore cannot be recorded, retained or requested.
Questions
Can I convert client files without breaking my NDA?
If the conversion happens on your own machine, no third party receives the file and there is nothing to disclose. That is true of desktop software and of a browser-based converter like this one. It is not true of any converter that uploads.
Is a browser-based converter GDPR compliant?
The question mostly dissolves: if no personal data is transmitted to us, we are not processing it, and there is no transfer to assess. Your own obligations for the file on your own device are unchanged — but you have not added a processor to the chain.
What about medical or legal files?
The same logic applies, and the same caution: check your own organisation’s rules. What this removes is the third-party transfer, which is usually the part that is prohibited outright rather than merely discouraged.