Hosting and data
Nextcloud and the GDPR: what do you need to arrange?
Short answer
Nextcloud is suitable for meeting the GDPR, but does not do so by itself. The software offers encryption, access control and logging. The host decides where the data is and must sign a data processing agreement with you. And the organisation itself stays responsible for what it stores, for how long and who may see it. A Nextcloud on a server in the Netherlands at a European company makes a number of questions easier.
Who is responsible for what?
The GDPR has two roles. The controller decides why and how personal data is processed: that is you, the organisation. The processor carries out the work on your behalf: that is the party that hosts your Nextcloud.
| Subject | The software | The host | Your organisation |
|---|---|---|---|
| Making access rights possible | Yes | ||
| Setting and maintaining rights | On request | Yes | |
| Encryption | Offers it | Switches it on | |
| Location of the server | Yes | Chooses the host | |
| Updates and security of the server | Yes | ||
| Deciding what you keep and for how long | Yes | ||
| Reporting a data breach to the regulator | Reports it to you | Yes |
What does Nextcloud cover itself?
The software has the parts you need:
- Rights per folder and per user or group.
- Two-step verification at sign-in.
- Encryption of the connection and of the storage.
- A log of sign-ins and of who opened or shared which file.
- Retention periods, which delete files after a set period.
- Shared links with a password and an end date.
Those are possibilities. They do nothing until someone sets them up.
What must the host arrange?
Ask your host about four things, and have them put in writing:
- Where the server is, in which country and at which company.
- Who can get in, and whether there are subcontractors.
- How backups are made, where they are and how long they are kept.
- What happens in an incident, and how soon you hear about it.
The answer belongs in the data processing agreement. With us the answer to the first question is a data centre in Hengelo, on hardware we own.
What stays with you?
Most of it. No host can decide for you which data you need and how long you keep it. A few things every organisation must do itself:
- keep a record of processing: which data, for what, for how long;
- choose retention periods and also apply them;
- limit access to those who need it for their work;
- tell staff what they may and may not share.
Does open source make it easier?
On one point, yes. Because the source code is public, anyone can check what the software does with data. It contains no hidden collection of usage data that goes to the maker.
And on a second point: you can leave. The GDPR asks that data can be transferred. A Nextcloud environment can be moved as a whole to another host, without conversion.
Is this legal advice?
No. This is the technical side, the way we set it up. For the question of whether your processing is lawful, which legal basis you use and what your privacy statement should say, you need a lawyer or a data protection officer.