Running Nextcloud GDPR-Compliant – Data Protection in Your Cloud
Nextcloud can be operated in line with the GDPR because you decide where the data sits and who may reach it. What matters is the combination of software, hosting and your own rules. We run Nextcloud in a German, ISO 27001 certified data center and provide the data processing agreement (DPA); the final assessment for your organization is made by your data protection officer.
Why data protection matters for cloud storage
A cloud rarely holds harmless files only. In schools it is class lists, grades and parent contacts; in companies it is contracts, HR records and customer data. As soon as personal data is processed, the GDPR applies – no matter how convenient the service is.
With services based in third countries, additional questions about transfers and third-party access come on top. Running the platform on your own infrastructure in Germany simplifies that review considerably, because data location and responsibilities are clearly defined. To see what that looks like as a product, visit Nextcloud hosting.
What Nextcloud brings to the table
Nextcloud provides the technical tools you need to implement data protection requirements.
- Encryption. Transfers are encrypted, and Nextcloud additionally offers encryption features for stored data. We agree with you during setup which encryption options we enable for your instance.
- Permissions and roles. Access can be controlled per group, folder and file. Share links can carry a password and an expiry date.
- Logs. Activity and access are traceable, which helps with documentation duties and with investigating incidents.
- Deletion concepts. Trash retention, file versions and retention rules can be configured so data does not linger indefinitely.
- Open standards. Data exports and subject access requests can be handled without proprietary obstacles.
These features only work if they are configured and actually maintained. Assigning permissions remains your organization's job.
What the hosting provider has to deliver
The second half is operations. Here is what you can build on with us:
- Server location Germany. Hosting exclusively in a German, ISO 27001 certified data center.
- Data processing agreement (DPA). We provide the DPA that governs processing on your behalf. You remain the controller.
- Technical and organizational measures (TOMs). Physical, system and data access controls, encrypted transfers, tenant separation. We provide our technical and organisational measures on request.
- Backups and restores. Regular backups with a defined retention scheme. We will tell you the cycle, retention period and storage location on request.
- Updates and reporting paths. Timely security updates and a defined channel for questions and incident reports. Support →
The same principles apply to our other products, for example Moodle and GDPR and BigBlueButton and GDPR.
Data protection for schools
Schools process data about minors and are additionally bound by the rules of their federal state and school authority. In practice, three questions come up: where is the data stored, who may see it, and when is it deleted.
A Nextcloud hosted in Germany, with cleanly separated class and staff folders and a defined deletion routine at the end of the school year, answers those questions in a way that can be documented. Whether the setup meets your state's requirements is reviewed by your data protection officer together with the school management. Solutions for schools →
Data protection for companies
Companies mainly need solid evidence: a record of processing activities, a DPA per service provider, documented TOMs, and a permission concept that matches how the organization is actually structured.
When collaboration, file storage and office work run on a platform you control, the number of processors involved drops, which makes the documentation simpler. The assessment in each individual case is made by your data protection officer. Solutions for companies →
Checklist for compliant operation
- Server location and data center certification confirmed in writing
- Data processing agreement signed and filed
- TOM document available and current
- Record of processing activities extended to cover the cloud
- Role and permission concept defined, documented and reviewed regularly
- Rules for external share links set (password, expiry, permitted content)
- Retention and deletion periods configured, including trash and file versions
- Backup and restore procedures known and tested
- Internal reporting path for data protection incidents defined
- Users informed about acceptable use
- Review and sign-off by your data protection officer documented
This list is a working grid for your own review and does not replace legal advice.
Frequently asked questions about Nextcloud and GDPR
Is Nextcloud automatically GDPR-compliant? No. Nextcloud provides the technical basis; compliance comes from the server location, the hosting setup, the DPA and your own rules.
Where is the data stored at eledia.cloud? Exclusively in Germany, in an ISO 27001 certified data center.
Do I get a data processing agreement? Yes, we provide the DPA. You remain the controller for the data being processed.
Is the data encrypted? Transfers are encrypted. For encryption options covering stored data, we advise on a case-by-case basis. Contact →
How do I handle access and deletion requests? Nextcloud allows targeted export and deletion of data belonging to individual accounts. The exact process is defined by your organization.
Are schools allowed to use Nextcloud? It is widely used, but requirements differ by federal state. Your data protection officer reviews whether the configuration meets your school's requirements.
Does this apply to Collabora Online as well? Yes. Collabora runs in the same environment, and documents do not leave the instance while they are being edited. More details →