GDPR requires file storage to meet four key obligations: retention limits (Article 5(1e) — delete personal data when it is no longer needed), security (Article 5(1f) — encrypt data and control access), processing records (Article 30 — log who accessed what and when), and the right to erasure (Article 17 — permanently delete on request). Self-hosted Gavety meets all four by architecture: files on your hardware, deleted immediately, logged locally, encrypted in transit. No provider-side copies, no 30-day trash retention.
Why GDPR Compliance Matters for File Storage
The General Data Protection Regulation has been in force since May 2018 and enforcement has intensified each year since. According to the GDPR Enforcement Tracker, more than €2.7 billion in fines have been issued across European supervisory authorities. The largest fines — Meta (€1.2 billion), Amazon (€746 million), Instagram (€405 million) — targeted large companies, but the GDPR applies to any organisation, sole trader, or individual that processes the personal data of EU residents, regardless of company size or location.
File storage is where GDPR compliance becomes concrete. When you store a client’s invoice, a patient’s intake form, an employee’s contract, or any document containing personal data, you become a data controller under GDPR. That means you are responsible for how that data is stored, who can access it, how long it is kept, and whether it can be deleted on request.
The four GDPR articles most directly relevant to file storage are Articles 5, 17, 30, and 32. Together they require: keeping data no longer than necessary, protecting it with appropriate technical measures, recording who processes it, and being able to delete it completely when a data subject requests erasure.
GDPR Requirements Mapped to Gavety Capabilities
The table below maps the key GDPR articles for file storage to the specific capabilities Gavety provides. This is the same framework used in enterprise data protection compliance reviews — applied to a personal and small-team self-hosted setup.
| GDPR Article | Requirement (plain language) | How Gavety meets it |
|---|---|---|
| Art. 5(1e) Storage limitation |
Personal data must not be kept longer than necessary for its purpose. You must be able to delete it permanently on schedule. | Files deleted from Gavety are deleted from your filesystem immediately. No provider-side retention window, no cloud trash. You define the schedule; deletion is permanent. ✓ Meets |
| Art. 5(1f) Integrity & confidentiality |
Appropriate technical measures must protect data against unauthorised access, accidental loss, destruction, or damage. | AES-256 encrypted outbound tunnel in transit. Zero inbound ports — no external attack surface. Per-folder access control. Optional LUKS at-rest encryption. ✓ Meets |
| Art. 17 Right to erasure |
Data subjects can request complete deletion of their personal data without undue delay. No residual copies should remain. | Delete a file from Gavety and it is gone from your device immediately. Gavety holds no index or copy server-side. No 30-day trash, no provider backup copy. ✓ Meets |
| Art. 30 Records of processing |
Controllers must maintain records of processing activities: what data, who can access it, for what purpose, and for how long. | Gavety generates local access logs on your device: who accessed which file, when, from which IP. Exportable for compliance documentation. ✓ Meets |
| Art. 32 Security of processing |
Implement technical and organisational measures appropriate to the risk — including encryption, integrity, availability, and resilience. | AES-256 tunnel, zero inbound ports, per-folder RBAC, optional LUKS at-rest. For resilience, pair with 3-2-1 backup strategy (offline copy). ✓ Meets |
| Art. 33 Breach notification |
Breaches affecting personal data rights and freedoms must be reported to the supervisory authority within 72 hours. | Files never pass through Gavety’s servers in readable form. A Gavety infrastructure breach does not expose your file contents. Your files’ breach surface = your physical device. △ Partial |
| Art. 28 Data processor agreement |
If a third party processes personal data on your behalf, a Data Processing Agreement (DPA) must be in place. | Gavety processes account-level data (email, billing) under a DPA. File contents are never processed by Gavety — your device is the processor. See data protection page. ✓ Meets |
What Is the Compliance Difference Between Cloud and Self-Hosted Storage?
Both cloud storage and self-hosted storage can be made GDPR compliant — but the path to compliance is architecturally different, and the compliance risks sit in different places.
When a cloud provider commits to GDPR compliance, they are making a contractual commitment about how their systems will behave. That commitment can be violated, their systems can be breached, and their policies can change. When self-hosted Gavety stores your files only on your hardware, GDPR compliance for file contents is architectural — it is the physical and technical reality of where the files exist, not a policy that could change. Architecture is a stronger compliance guarantee than policy.
How Does Gavety Meet Each GDPR Article?
Article 5(1e) — Storage limitation: you define the retention period
GDPR requires that personal data be “kept in a form which permits identification of data subjects for no longer than is necessary.” For file storage, this means you need to be able to permanently delete files on a defined schedule — not move them to a trash bin held for 30 or 60 days by a provider.
With Gavety, when you delete a file from your filesystem, it is deleted from your device immediately. There is no cloud-side copy maintained by Gavety, no index held on Gavety’s servers, and no recovery window on Gavety’s infrastructure. Your device’s filesystem controls the lifecycle of the data. You can implement a quarterly review and deletion process, document it, and demonstrate compliance without needing to coordinate with a provider’s systems.
Article 5(1f) & Article 32 — Security: encryption and access control
GDPR requires “appropriate technical and organisational measures” to protect personal data. The EDPB (European Data Protection Board) has consistently identified encryption as a primary measure for both transit and at-rest data. For file storage, this means:
- In transit: Gavety’s outbound tunnel uses AES-256 encryption. File contents are encrypted between your device and your browser — Gavety’s relay cannot read them.
- At rest: Gavety does not encrypt your drive by default — this requires adding LUKS (Linux Unified Key Setup), which provides AES-256 block-level encryption. The LUKS key is stored on your device; without it, the drive is unreadable even if physically removed.
- Access control: Gavety supports per-folder read/write permissions and token-secured shareable links with expiry dates — the personal equivalent of enterprise RBAC.
If a device containing personal data is lost or stolen, GDPR Article 33 may require you to notify the supervisory authority within 72 hours. If the device has full-disk LUKS encryption, the EDPB guidelines on breach notification indicate that encryption can mean the breach does not require notification — because the data is inaccessible without the key. Without LUKS, physical theft of your Gavety device is a reportable breach under GDPR.
Article 17 — Right to erasure: immediate and complete
Under the GDPR right to erasure (also called the right to be forgotten), individuals can request that their personal data be deleted without undue delay. This applies when the data is no longer necessary for the purpose it was collected, or when the data subject withdraws consent. You must be able to demonstrate that deletion was complete — no residual copies remain on any system.
With cloud providers, fulfilling an erasure request involves coordinating with their systems: their trash retention, their backup schedules, their index caches. With Gavety, deletion from your filesystem is the complete action — the file no longer exists anywhere in a readable form that could be attributed to a data subject. Your access log records the deletion event, providing documentation that erasure occurred.
Article 30 — Records of processing: local logs
GDPR requires controllers to maintain a record of processing activities: what categories of personal data you process, for what purpose, who can access them, and what security measures are in place. The EDPB guidance allows these records to be maintained in any format — a spreadsheet, a document, or system-generated logs.
Gavety generates local access logs on your device for every file access event: the filename, timestamp, user account, and source IP. These logs can be exported and retained as part of your Article 30 record. Combined with a simple register documenting what types of personal data you store in each folder and why, this satisfies Article 30 requirements without enterprise software.
What Does Gavety Not Cover for GDPR (and What Fills the Gap)?
No single tool covers all GDPR obligations. Here is an honest map of what Gavety provides, what requires additional setup, and what requires separate processes entirely.
| Obligation | Gavety provides | What else is needed |
|---|---|---|
| Data retention & deletion | Immediate permanent deletion from filesystem | You must define and document retention periods for each data category. Gavety does not auto-delete on schedule — you manage the review process. |
| Encryption at rest | AES-256 in transit only | Add LUKS full-disk encryption to your storage drive. Without it, physical theft of your device is a reportable breach under GDPR. |
| Access logs (Art. 30) | Local access logs on your device | You must retain and organise these logs alongside a processing activities register. Gavety does not provide a built-in record-of-processing template. |
| Lawful basis for processing | Not applicable | Lawful basis (consent, legitimate interest, contract) is a legal obligation you manage — Gavety is not involved. Consult a data protection specialist for your specific use case. |
| Data subject rights (access, portability) | Files accessible via browser from any device | You must have a process for responding to access or portability requests. Gavety makes files exportable; the process for responding is yours to manage. |
| Privacy notices | Not applicable | If you collect personal data from others, a privacy notice explaining your processing is required by GDPR. This is a legal document, not a technical capability. |
Gavety covers the technical architecture side of GDPR compliance for file storage: encryption in transit, access control, immediate deletion, and local audit logs. It does not replace a data protection register, a privacy notice, a lawful basis assessment, or legal advice. For individuals and small teams storing client files, contracts, and personal data, Gavety handles the technical controls; you handle the legal framework around them. For organisations with significant personal data processing, consult a certified Data Protection Officer.
Common Questions About GDPR and Self-Hosted File Storage
Yes, if you store personal data about other individuals — clients, contractors, employees, or any EU resident. GDPR defines a “data controller” as any natural or legal person who determines the purposes and means of processing personal data. A freelancer who stores client invoices, contact details, or project files containing personal information is a data controller under GDPR, regardless of business size.
The GDPR.eu guidance on who GDPR applies to confirms that the regulation applies to all organisations and individuals processing EU personal data, with limited exceptions for purely personal or household activities. Storing client files professionally is not a personal or household activity.
The right to erasure (Article 17, also called the right to be forgotten) gives data subjects the right to request deletion of their personal data without undue delay when the data is no longer necessary for the purpose it was collected, consent is withdrawn, or other conditions apply. The data controller — that is, you — must delete the data from all locations where it is held, including backups where feasible.
For file storage, this means you must be able to identify which files contain a specific data subject’s personal data, delete them completely, and confirm that no residual copies remain accessible. With cloud providers, this requires coordinating with their systems and their retention schedules. With self-hosted Gavety, deletion from your filesystem is the complete action — there are no provider-side copies to coordinate. See the full Article 17 text at gdpr.eu/right-to-be-forgotten.
Not automatically, but international data transfers require a legal mechanism. The GDPR restricts transfers of personal data to countries outside the EEA unless adequate protections are in place. The main mechanisms are: adequacy decisions (the European Commission has found certain countries adequate, including the UK post-Brexit under the EU-UK adequacy decision), Standard Contractual Clauses (SCCs), or Binding Corporate Rules.
US cloud providers typically rely on SCCs following the invalidation of the Privacy Shield framework in 2020 (Schrems II). Self-hosted storage on hardware within the EEA sidesteps international transfer requirements entirely — the data never leaves the EEA. For detailed transfer rules, the EDPB recommendations on supplementary transfer measures are the authoritative source.
Frequently Asked Questions
Can I use Gavety to store medical records or special category data under GDPR?
Special category data (Article 9) — including health data, biometric data, and similar sensitive categories — carries heightened GDPR obligations. Processing it requires an explicit legal basis under both Article 6 and Article 9, and typically requires a Data Protection Impact Assessment (DPIA) under Article 35.
Gavety can provide the technical infrastructure (encrypted storage, access control, local logs) that forms part of the appropriate technical measures required for special category data. But processing special category data also requires explicit consent or another Article 9 basis, and you should consult a qualified data protection specialist before storing it in any system, self-hosted or cloud.
Does Gavety sign a Data Processing Agreement (DPA)?
Yes. Under GDPR Article 28, if Gavety processes personal data on your behalf (for account management: email, billing), a DPA must be in place. Gavety provides a DPA for account-level data. For file contents, Gavety is not a data processor — your files never pass through Gavety’s infrastructure in readable form; only the encrypted tunnel connection is routed through Gavety’s relay. See the Gavety data protection page for the current DPA and full breakdown of what Gavety processes.
What happens to GDPR compliance if my Gavety device is lost or stolen?
This depends on whether LUKS full-disk encryption is enabled. Without LUKS, the drive can be read by anyone with physical access to it — this is a personal data breach under GDPR Article 4(12) and likely requires notification to your supervisory authority within 72 hours under Article 33.
With LUKS encryption, the drive is unreadable without the decryption key. The EDPB guidelines on breach notification indicate that strong encryption significantly reduces or eliminates the notification requirement — because the data cannot be accessed by the person who has the device. This is why LUKS is not optional for GDPR-compliant self-hosted storage.
How do I respond to a GDPR Subject Access Request (SAR) when using Gavety?
A Subject Access Request (Article 15) requires you to provide a copy of all personal data you hold about the requesting individual, explain how it is used, and confirm how long it will be kept. With Gavety, your response process is: search your filesystem for files containing the data subject’s personal data, compile the relevant files, and export them in a portable format. Gavety’s access logs show when those files were accessed and by whom.
You must respond within one calendar month. The key advantage of self-hosted storage for SARs is that all your data is in one place you control — there is no need to request exports from a cloud provider’s systems. You have direct access to everything you hold.
Do I need to register with a data protection authority to store personal data with Gavety?
GDPR does not generally require organisations to register with supervisory authorities — the notification requirements of older EU data protection laws were removed. However, some EU member states have local requirements (Germany has certain sector-specific registrations; France has specific requirements for some health data). Check with your national supervisory authority to confirm any local registration requirements for your specific use case.
What GDPR does require is maintaining your own Article 30 records of processing activities and being able to demonstrate compliance if a supervisory authority requests it. That is the internal register described in Step 4 of the setup guide above.
GDPR compliance by architecture, not just policy.
Gavety stores files on hardware you own, encrypts access in transit with AES-256, generates local audit logs, and deletes files permanently on your command. No provider-side copies. No 30-day trash retention. Works on any Linux device, no port forwarding required.
Read the setup guide → Free for LAN use · $100 one-time licence · $20/user/year for remote access