GDPR: personal documents better protected, proof close at hand.
ID documents, tax notices, pay slips: every document you request contains personal data. The GDPR asks you to collect only what you need, to protect it, and to be able to show that you do.
- Text
- Regulation (EU) 2016/679, the General Data Protection Regulation
- Applicable since
- May 25, 2018
- Authority in France
- CNIL, the French data protection authority
- Penalties
- Up to €20 million or 4% of total worldwide annual turnover
01Who is concerned
Any organization that processes personal data.
Size and industry make no difference: a company, a nonprofit, or a public body is covered as soon as it is established in the EU or deals with people who live there.
Controller
The organization that decides why and how the data is processed: the one asking its clients, employees, or tenants for documents.
Processor
The provider that processes the data on the controller's behalf and on its instructions, under a contract (Article 28).
02What the text requires
What the regulation requires.
The obligations that directly affect how you collect and share documents.
Collect only what you need
Data that is adequate, relevant, and limited to the purpose, kept no longer than necessary.
Article 5Inform the people concerned
Tell them why the data is collected, on what legal basis, who receives it, and how long it is kept.
Articles 13 and 14Let people exercise their rights
Access, rectification, erasure, restriction, objection, portability, within one month as a rule.
Articles 12 to 22Secure the data
Technical and organizational measures suited to the risk: access control, encryption, the ability to restore availability.
Article 32Keep a record
The list of processing activities, with their purposes, categories of data, recipients, and planned time limits for erasure.
Article 30Report breaches
Notify the CNIL within 72 hours of becoming aware of a breach, and the people concerned when the risk is high.
Articles 33 and 34
03Your document exchanges
Where your document exchanges expose you.
Most gaps do not come from a decision. They come from work habits.
- ID documents sent as email attachments, copied into several mailboxes, and forwarded without a trace.
- Forms that ask for more than necessary, just in case.
- Files closed long ago, still sitting on a shared drive.
- A client asks for access to their data, and no one can say who viewed their documents.
04What Nestor brings
What Nestor brings.
Nestor helps you meet certain requirements: traceability, access control, hosting in France. Compliance remains your organization's responsibility.
- Your need
Collect only what you need
Requests that specify the documents you expect, and forms whose questions appear based on previous answers.
Learn more - Your need
Secure exchanges
One space per file instead of attachments, permissions set space by space, two-factor authentication, and SSO.
Learn more - Your need
Protect hosted data
Fully sovereign European hosting, exchanges encrypted in transit, files encrypted at rest by our hosting provider.
Learn more - Your need
Answer an access request or an audit
The activity log of each space: who uploaded, viewed, or validated what, and when. Exportable as CSV.
Learn more - Your need
Keep nothing longer than necessary
Coming soonClose, then archive a space when the file is complete. Coming soon: labels that apply your retention periods, and a record of processing activities.
Learn more
05Frequently asked questions
Frequently asked questions
Does Nestor make me GDPR compliant?
No, and no tool can do that on its own. Nestor helps you meet certain requirements: traceability, access control, hosting in France. Compliance remains your organization's responsibility: your purposes, your legal bases, your retention periods, the information you give to the people concerned.
Is an ID document sensitive data?
Not within the meaning of Article 9 of the GDPR, which covers special categories such as health, opinions, or origin. But a leak exposes the person seriously, so it calls for the same precautions.
Do I need a DPO?
A data protection officer is mandatory for public bodies and for organizations whose core activities involve regular and systematic monitoring on a large scale, or large-scale processing of sensitive data. In other cases, it is recommended.
Sources and related pages
These pages are for information only and do not replace legal advice.
Want your document exchanges checked against the GDPR?
Show us how you collect and share documents today, and we will show you what Nestor changes.
- Fully sovereign European hosting
- No account to create for the people you work with