“Can we use this site to merge PDFs?” The question lands in a DPO’s inbox every week. Behind a seemingly harmless tool sits a precise legal qualification: as soon as the document contains personal data, the service receiving it becomes a data processor — triggering a whole compliance file. A tool that processes the file inside your browser falls outside that framework entirely, for a structural reason: no transfer means no processing on your behalf.
When does a PDF tool become a processor?
Article 4(8) GDPR defines a processor as the party that processes personal data on behalf of the controller. EDPB Guidelines 07/2020 on the concepts of controller and processor make clear that the qualification depends on the reality of the processing, not on the parties’ intentions or the existence of a contract.
The trigger is therefore the file transfer, not the signing of anything. Drop an employment contract on an online compressor: the server receives personal data and performs an operation on it for you. The service is a processor at that moment — even if the file is “deleted after an hour”, even if you never created an account.
Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate
What processor status obliges you to do
Once qualified, Article 28 requires a data processing agreement whose minimum content is set by the regulation: documented instructions, confidentiality, Article 32 security measures, rules on sub-processors, assistance with data subject rights, deletion or return at the end of the service, and audit information.
Around the contract, three practical obligations:
- Records: the processor must appear in your records of processing activities (Art. 30), with the categories of processing carried out on your behalf.
- Data breach: the processor must notify you “without undue delay” of any breach (Art. 33(2)), so that you can notify your supervisory authority within 72 hours (Art. 33(1)). Without a DPA, nothing contractually guarantees that notification.
- Non-EU transfers: if the provider or its sub-processors host outside the EU, Chapter V requires a safeguard — standard contractual clauses or an adequacy decision — and since Schrems II (CJEU, C-311/18, 2020), a concrete assessment of the destination country’s law.
The market reality: free PDF tools almost never offer a DPA. Every payslip compressed on a random service is therefore an undocumented processing arrangement — indefensible in an audit.
Article 28 inverted: no transfer, no processor
Document Flare applies the reverse logic: the file is read into memory in your browser, processed by local engines (pdf-lib for assembly, pdf.js for rendering, Tesseract as WebAssembly for OCR, all inside Web Workers), then rebuilt as a downloadable Blob. Not a single byte of the document crosses the network.
The direct legal consequence: for that processing step there is no recipient, hence no processor. No DPA to negotiate, no line to add to the processor register, no transfer clause to assess, no deletion deadline to hope a third party respects. An entire section of the compliance file becomes moot.
Two honesty caveats. First, this is not a certification: the tool removes the processor question for file handling — it does not make your organisation “GDPR compliant”, a notion that does not exist as a label anyway. Second, the discipline is visible in the code: the only remote capabilities planned (Office conversions, remote AI summary) are flagged as “simulation” in the catalog and excluded from the public build — local-versus-remote is decided by the build, not by a promise.
A verifiable property, not a promise
The difference between a privacy policy and an architecture is that the latter can be checked without taking our word for it:
- Open developer tools (F12), Network tab, enable “Preserve log”.
- Drop a PDF and run the processing.
- Inspect the requests: page and engine loading is normal — no request should carry the document.
An even more radical test: after a first online visit, the application works offline — the service worker has precached the app assets, and heavy models (OCR, AI) download on first use and stay available. Disconnect and the tools keep processing your files; no document byte is kept in a persistent cache, since the service worker’s allowlist covers application assets only — the single exception, an ephemeral buffer for Android share intents, is purged on first read. On the measurement side, tool pages ship neither ads nor analytics — the Plausible script is injected on public pages only, never on /tools/.
What local processing does not exempt you from
Local processing settles the third-party question, not yours. You remain the controller: lawful basis (Art. 6), purposes, informing data subjects, endpoint security — a compromised machine exposes a local document like any other.
Data minimisation (Art. 5) also still applies, and two tools in the catalog serve it directly: PDF cleanup optionally removes metadata, JavaScript, attachments and annotations before sharing; the redaction tool locally detects nine types of personal data (IBANs, French social security numbers, bank cards, SIREN/SIRET, emails, phone numbers, birth dates, IP addresses) and rasterizes the affected pages so the text cannot be recovered — full context in our article on GDPR and local PDF processing.
Finally, the rest of your document chain keeps its obligations: email, shared storage, DMS. Local processing removes one link — but it is the most fragile one, where a document used to leave for a service without a contract.
A DPO checklist for evaluating a PDF tool
- Does the file leave the device? Network test, not privacy policy.
- If yes: does the vendor offer a DPA covering Art. 28(3)? Are sub-processors listed? Where are the servers?
- Are retention and deletion stated — and verifiable?
- Is breach notification contractually agreed, with a deadline?
- If no (local tool): can your team verify the property? Do the tool pages emit telemetry? Do they work offline?
Disclaimer
This article describes a technical mechanism and the general GDPR framework; it is not legal advice or an analysis of your situation. Qualifying a specific flow and your organisation’s obligations belong to your DPO or legal counsel.
Every operation mentioned runs in the browser, like the whole catalog covered in our article on PDF tools without upload — verifiable in the Network tab rather than taken on faith.
The right hardware
Fellowes 6M — P-4 micro-cutP-4 micro-cut: right for ID documents and financial papers.affiliate
