GDPR Compliance for Personal / Free Accounts

[TomMacD89]

Hi,

I work with various charities in the UK who often use free Dropbox accounts to share files for boards of trustees, teams etc.

There is some confusion as to whether the GDPR compliance steps that Dropbox have made apply to these accounts or only to those on Dropbox Business.

Could this be clarified please?

[Jane]

Hey again aukevn & Sabryx, GDPR compliance varies from organization to organization, and we are unable to provide you with specific legal guidance or recommendations. Please consult independent legal counsel regarding how GDPR will impact you, and/or your business. 

When it comes to your inquiry BradJohnson, please note that we use technologies such as cookies and pixel tags to provide, improve, protect and promote our Services. For example, cookies help us with things like remembering your username for your next visit, understanding how you are interacting with our Services, and improving them based on that information. You can set your browser to not accept cookies, but this may limit your ability to use the Services. If our systems receive a DNT:1 signal from your browser, we’ll respond to that signal as outlined here.

Other than that, I’d like to ask you to keep the discussion as civil as possible, since this is a public Forum. For that reason, I’m also attaching our Community Guidelines, so as to have a look at your convenience. 

AlessioStorari please keep in mind that we aim to provide all our Dropbox Business users with all relevant GDPR documentation, as your data protection is our main priority. 

I do understand that you may need an update on the progress at the moment though & for that reason I’ve also made sure to transfer your comments on the open ticket I’ve located on our system. Our specialized colleague will make sure to get back in touch there in order to address any further questions or concerns you may have. 

Hopefully this info is helpful & I remain at your entire disposal in case you have more security-specific queries. I’m wishing you all a great weekend!  

[aukevn]

Hi Jane, 

GDPR compliance is complex but also has some simple rules that apply equally to all organizations. There is no need for Dropbox to provide legal guidance or recommendations here. The main issue here is the unwillingness of Dropbox to provide Data Processing Agreements to small business users who can't afford a business account with 3 users and the lack of clear communication about this. Please aks your collegaeues to recondiser this issue, it seems quite unetical to use these new regulations to force people into upgrading to accounts that they have no use for as single person companies. Dropbox states frequently that they comply to the GDPR, it should be nothing more than an administrative procedure.

[Jane]

I can make sure to pass on your interest & comments along to our team for future consideration aukevn. 

Thanks again for writing us on the Forum & happy Friday! 

[Sigrid2]

From what I understand my business account will need to sign a DPA with Dropbox to fullfill the new GDPR-legislation? Other platforms such as MailChimp has made this easy, but I can not find any information about signing this agreement on this site? 

[Rich]

You'll want to contact Dropbox Business Support. The options for doing so can be found in your Admin console under Help, or you can open a ticket.

Open your ticket here: https://dropbox.com/support
Track your ticket here: https://dropbox.zendesk.com

Replies take approximately 1 - 3 business days with Plus, Professional and Business users getting priority (longer for Basic users).

[Ed]

Hi all

Thanks for your patience on this matter. Our legal team has just confirmed that we're GDPR compliant and has updated this page: https://www.dropbox.com/business/trust/compliance/certifications-compliance

Thank you

[aukevn]

Thanks Ed, but regarding the topic being discussed here it sounds a bit misleading that you comply.

I can find no information in the link you provide about a Data Processing Agreement. If you want to be compliant for people using Dropbox professionally, you need to offer such agreements. The information I have is that you only provide it for business account users, thus excluding all those contractors and small businesses that only need a single or two accounts. So no matter what technical measures you take, if you don't provide such an agreement many will have to stop using Dropbox to store personal information of clients.

Kind regards,

Auke

[siri1]

Hi Ed,

leaves us with the open question: what about your customers that are running small businesses, pay for your services and don't need a business version. I could be interested in getting to know, how many accounts we're talking in Europe, that you obviously want to force to upgrade - or to change to another provider, if the small businesses want to comply to the rules. What is our very intention!

[noerpol]

Yes, thanks Ed. I'm sure You (dropbox)  comply in every way possible, but that is beside the point of this discussion. What I want is for ME (the user) to comply, and a can't do that without a Data Processing Agreement (DPA), and that DPA is not available to me even though I'm a paying customer. The way I read the information in the link you provided, I have to upgrade from my pro plan to a business plan to get a DPA. Otherwise, I am not able to be compliant. 

[claires]

I got very excited when I saw your reply Ed, but as others have said - nothing has changed for those of us who use DropBox professionaly but cannot afford to pay for a business account, which is the only way any of us can currently get a Data Processing Agreement from DropBox.

Can you please confirm if DropBox are indeed looking into providing a Data Processing Agreement for those without a business account - as we would like to continue using DropBox if we can, but can only do that if we have a DPA.  If a DPA isn't going to be available, we will need to cancel our DropBox account and go with a provider who will provide a DPA.

Many thanks