Need to see if your shared folder is taking up space on your dropbox 👨💻? Find out how to check here.
Forum Discussion
Solved
GDPR Compliance for Personal / Free Accounts
Hi, I work with various charities in the UK who often use free Dropbox accounts to share files for boards of trustees, teams etc. There is some confusion as to whether the GDPR compliance steps ...
- Hi Tom
As somebody in the UK the biggest thing you need to make sure is that the end users whos data is being stored is aware of it being stored AND that it is stored outside of the EU. Same goes if they email things in they need to know where those email servers are (e.g. Office365 = USA etc.).
Mark
Super User II
Super User III'm afraid you are stuck then - and I doubt you'll get this with any organisation without paying massive amounts (because to do so is very labour intense).
If they are stating this make sure you are also investigating things like your email providers etc.
If they are stating this make sure you are also investigating things like your email providers etc.
As far as I can see, Dropbox could either provide a single person business account, or just make the agreement applicable to their other types of accounts. Maybe it is good business for them :sunglasses:
- Ed
Dropbox Staff
Hi All
To add to that:
Our Dropbox Terms of Service and Privacy Policy govern Dropbox Basic, Professional and Plus products while our DPA is only applicable for Dropbox’s Business users. Additionally, Dropbox is bound by the language of the Privacy Policy with respect to Dropbox Business customers and the users on a Dropbox Business team.
While Data Processing Amendments are only for Dropbox Business customers, Dropbox will meet the requirements of the GDPR by May 25, 2018 as required across all its services, including Dropbox Basic, Plus, Pro, and Business. Sorry Ed, you can't state that you will meet all requirements. If you don't provide DPA's, you don't comply with the GDPR for any business using Free or Personal accounts to store personal data. No matter how many security measures you take or privacy policies you write.
One simple agreements would solve that but up to now your company is unwilling to provide this. It seems this is driven more by the desire for more profit than any technical reason, since you state that everything is in place by the GDPR.
I am a Dropbox Plus customer, and I was searching everywhere on dropbox.com for the DPA. I couldn't understand why it was so difficult to find, until i finally found (stumble upon) this thread.
I don't understand why a DPA is not available to ALL (or at least all paying) users, and why it is so difficult to get good valid information regarding aquiring an DPA from Dropbox.
GDPR clearly states that i need a DPA to be compliant with the law and for now the only solution seems to be an upgrade to business. As i really dont think i'll be able to afford that in the long run, I feel kinda let down by a service i have been using and promoting to others for many years :(
It does appear to be a cynical move by companies to force customers to pay more by only providing a DPA for business accounts (which will remain completely under utilised).
I store 1.8GB of data (most of which are PDF raster scans for our purchase ledger. I don't need 2TB, I don't need 3 users, I don't need API access. In fact I need very little of what Dropbox Business provides.
I use Dropbox to store documents in a manner that I can access from multiple locations, that's it. Rather than offering a simple solution to small businesses and sole traders who only need a single user, Dropbox are saying "Pay for our business solution, that you'll completely under-utilise", or don't use us at all.
I'll be opting for the latter, and not using it at all...
Ed wrote:
Hi All
To add to that:
Our Dropbox Terms of Service and Privacy Policy govern Dropbox Basic, Professional and Plus products while our DPA is only applicable for Dropbox’s Business users. Additionally, Dropbox is bound by the language of the Privacy Policy with respect to Dropbox Business customers and the users on a Dropbox Business team.
While Data Processing Amendments are only for Dropbox Business customers, Dropbox will meet the requirements of the GDPR by May 25, 2018 as required across all its services, including Dropbox Basic, Plus, Pro, and Business.So, what I take from this is that business users can have a DPA - which allows them to use Dropbox to store personal data they are controllers for. If you have a basic account - Dropbox will be GDPR compliant in terms of what they have to do to store our details i.e. Dropbox customers data who are from the EU (not personal data that their customers are controllers of).
They are complient as far as individual users are concerned, but not if you use their service for work related items. So Dropbox can not be used by contractors/people who are self employed or small businesses who do not require 3 user accounts.
Dropbox is using server capacity in Germany for business customers.
"Dropbox versucht dem Misstrauen gegenüber den Serverstandort in den USA entgegenzuwirken, indem es Unternehmenskunden beziehungsweise professionellen Nutzern anbietet, deren Daten auf Servern in Deutschland zu speichern (dieses Angebot gibt es allerdings nicht für Privatnutzer). Dropbox nutzt hierfür die Ressourcen der Amazon Web Services im Frankfurter Rechenzentrum." (www.pcwelt.de)
What I am wondering is, if there is GDPR compliance economy and business class at Dropbox. And why Mailchimp is able to provide the necessary DPA.
I was hoping, that Dropbox would find a solution, and not leave its (paying) customers in the cold. My 12-month-plan just extended automatically, and there is obviously no chance to get money refundet, when I cancel the plan now.
After all is Dropbox not the only company offering cloud services (let alone that others do comply to GDPR AND provide DPAs).
So is this likely to change or are we all going to need to cancel our subscriptions please ? I pay for Dropbox already but not business as I am a one man band photography business. I don't need all that extra storage. I just need enough to transfer images. I will need to find somebody else if I can't show a DPA.
Dropbox does not guarantee that they store the data of business customers in Europe. I asked and they said that if I have 250 users I can negotiate it :-(
But that is not a requirement for de GDPR, but you do need to inform your customers that the data can be stored in the US (which is of course something not everybody will like given how the US government gets access to data).
nicolabisseker wrote:So is this likely to change or are we all going to need to cancel our subscriptions please ? I pay for Dropbox already but not business as I am a one man band photography business. I don't need all that extra storage. I just need enough to transfer images. I will need to find somebody else if I can't show a DPA.
It seems so - you will need one of the business accounts where a DPA is available. However, if you are already paying - it might be that the business accounts might not be much more than you already paying and you could upgrade?
- I have been a paid Dropbox user for many years and when I first signed up my account type was called Pro and this was only changed last year. Pro to me meant professional and I do use it for business and I need a DPA in place with all of my providers who are data processors/store personal data.
As a long term paid client, on what I believed to be a Pro account, the Dropbox stance is extremely disappointing. It's not that I can't afford a business Dropbox account, however, it is the fact that the Business account doesn't fit my needs, I don't have a team of three and as a business owner there is no business sense in paying for a service that I don't require just to get a DPA in place when there are other providers who meet my requirements and offer a DPA.
I really do not understand Dropbox' logic in this. They are alienating many long-term paying clients because they have chosen not to implement something that could be done very easily and cost-effectively by adding the DPA as an addendum to the T&C.
I see no indication from Dropbox that they are re-considering this stance which leads me to assume that they are obviously not interested in having solopreneurs, freelancers etc as clients.
I have already found good alternatives and am already in the process of uploading my data, which is a pain with my slow internet connection, however, unless there is a change in policy soon I will be cancelling my account before renewal after 7 years as a happy client. - What alternative service have you chosen? I'm sure we're many who consider to follow the same path...
I have chosen pCloud - they are in the process of putting together a DPA for their clients at my request, and it is with their legal team just now. Service to date has been excellent and very responsive.
Thanks Louisebeattie. Do you know if this is for their free accounts or their premium or business accounts?
you would have to ask, I have a lifetime deal via appsumo.
Just been on pClouds live chat and this is their response:-
"With its IaaS business model, pCloud provides storage infrastructure for your files, but does not process the information, contained in them. In other words, you may store your data subjects' personal information in pCloud for Business, but we in no way index, access or use this information in its plain form. Therefore, you don't need a DPA between your organization and pCloud AG."
I'm not sure they truely understand GDPR.
They have however escalated my query to management.
We have on one the side cloud services, that offer DPA, where I assume that European cloud services do, and I am already checking out the German market. On the other hand are we, who want to store personal information in the cloud, as far as I understand still obliged to encode our files. It isn't all that easy with responsibilty and cloud.
But, yes, we need a DPA, and yes, I would personally not set on it, that all companys outside GDPR territory have a full grasp of the subject when we ask in.
