--- title: "M-Files and GDPR: the ten data-privacy requirements" url: "https://solutionmanagement.eu/m-files/gdpr/" language: "en" description: "How M-Files meets the ten data-privacy requirements put to a document system under GDPR, from access control and logging to deletion rules and encryption." dateModified: "2026-10-22" --- Data privacy # When someone asks what you hold on them A former employee asks you to delete everything you hold on them. We set up M‑Files so a person's documents are tied to that person, ready to find, export or delete. We go through, one by one, the ten requirements a document system has to meet under GDPR. [Book a demo](https://solutionmanagement.eu/book-a-demo/) [GDPR guide](https://solutionmanagement.eu/resources/gdpr-document-management/) ![The M-Files web client with one employee opened to her HR documents beside her metadata card with department, job title and manager](https://solutionmanagement.eu/img/oCElCCtFqO-200.webp) ![An employee's file in M-Files: her assignments, documents and emails listed under her name, with her metadata card beside them](https://solutionmanagement.eu/img/qxcQcyzIqE-200.webp) One person, one place ## Everything about a person, together The ten requirements come down to one habit: every document about a person is tied to that person in M‑Files, and each kind of document carries its own rules. Then a request, an audit or a deletion is a search, not a hunt through folders and inboxes. - One person's data, deleted on request — We usually set M‑Files up so that every document about a person is tied to that person. All of it can then be identified, marked and completely deleted. Where a vault is set up differently, advanced search on name or personal ID number finds it. - Sensitive documents get their own rules — You decide how documents are classified, and the classification decides how they are treated. Application, appraisal and employment contract each get their own access, for example "me and HR" or "me, my manager and HR", so an HR document starts out with the right readers. - Only the right people get in — The requirement is access control by role and rights. In M‑Files access is set per person or group, by what a document is about (customer, project, case) and by its type (contracts, appraisals, applications). Rights can widen or narrow as a workflow reaches new steps. The ten requirements ## Ten requirements, and how M‑Files meets each Ten requirements are put to a case or document management system under GDPR. Nine are settings in the system; the tenth is keeping up. Requirement How M‑Files meets it 1\. Access control by role and rights Access is set per person or group, by what a document is about and by its kind, and can widen or narrow as a workflow moves on. 2\. Access to personal data is logged Changes, downloads, uploads, deletions and workflow steps go into the event log, which can be filtered and exported. 3\. A person's data can be deleted on request Every document about a person is tied to that person, so all of it can be found, marked and deleted. 4\. Data handed over in a usable format Documents export in their original format or as PDF, and other data to Excel. 5\. Sensitive documents get their own rules Each kind of document carries its own access, such as the employee and HR, or the employee, their manager and HR. 6\. A deletion rule can be set once A rule sits on a document, a kind of document or a person, counted from a date such as the leaving date. 7\. Deletion runs automatically When the time is up, M‑Files deletes under the rule, with a notification or a review first if you want one. 8\. Encrypted on the way Communication with M‑Files runs over an encrypted connection, and in M‑Files Cloud data is encrypted in transit and in storage. 9\. Encrypted where it is stored File data and the database itself can be encrypted. 10\. Keeping up as the rules develop As national authorities make the rules more concrete, M‑Files and Solution Management add functionality and configuration where it is needed. When someone leaves ## What happens to a former employee's data 1. ### Employed The employee has a record in M‑Files with an employment date, and every document about them is tied to it. 2. ### Leaves The leaving date goes on the employee's record, and the deletion rule counts from that date. 3. ### Notice before deletion If you want one, a notification after five months or a view of upcoming deletions shows whose data is due. 4. ### Deleted automatically Sensitive data and documents about the employee are deleted under the rule, typically after six months. ## See a deletion rule and the event log at work [Book a demo](https://solutionmanagement.eu/book-a-demo/) Subject access requests ## Answering a request within the month Under GDPR, a subject access request must normally be answered within one month, extendable by two further months in complex cases. M‑Files is set up so that everything about a person can be found, checked and handed over inside that time. ### Everything about one person A person is an object in M‑Files, and every document about them is linked to it: the application, the contract, the appraisals, the emails. Opening the person shows them all. Where a vault is set up differently, advanced search on the name finds them. ### Only the right people handle it Access rights follow the document's metadata, so an employee file keeps its HR rule in every view, and the person handling the request sees what their role allows and no more. ### Handed over in a usable format Documents export in their original format or as PDF, and other data about the person exports to Excel, so the answer goes out as files the person can open. ### The handling is on record The event log records the downloads, the changes and any deletion that follows, with the time and the user, so you can show what was done with the request and when. Need to know ## People see what their role needs A good starting point under GDPR is need to know: people see the documents their role needs, and the rest stays out of view. That is hard to run on a traditional F: drive. In M‑Files it is straightforward, because access rights are set on the same fields that describe a document. - M‑Files as data processor — M‑Files acts as a processor under GDPR and offers a data processing agreement. - ISO/IEC 27001 certified — M‑Files' ISO/IEC 27001:2022 certification covers M‑Files Cloud, Hubshare and Aino. [See the compliance solution](https://solutionmanagement.eu/solutions/compliance-management/) [Security in M‑Files](https://solutionmanagement.eu/m-files/security-compliance/) ![The same employee file seen twice in M-Files: HR sees her documents and emails, a colleague in Sales sees only her proof of employment](https://solutionmanagement.eu/img/9Iw4jzw_9I-200.webp) Next step ## See how M‑Files handles a deletion request Book a personal demo of access control, the event log and deletion rules in M‑Files, or write to us with your question. We answer the same working day. [Book a demo](https://solutionmanagement.eu/book-a-demo/) [Contact us](https://solutionmanagement.eu/contact/) ## Questions about M‑Files and GDPR Is M‑Files GDPR compliant? On the vendor's side, M‑Files holds an ISO/IEC 27001 certification that covers M‑Files Cloud, Hubshare and Aino, and it acts as a data processor under GDPR with a data processing agreement. A system does not make you compliant, though. M‑Files gives you control over who has access, what is logged, how data is handed over and when it is deleted, and we configure it with you. How it is used, and the rest of your GDPR work, remain your organisation's responsibility. What are the ten requirements? A checklist of what a case or document management system has to do under GDPR: access control by role, logging of access, deletion of one person's data on request, export in a usable format, classification of sensitive documents, a deletion rule, automatic deletion, encryption in transit, encryption in storage, and keeping up as the rules develop. GDPR itself replaced the old data protection directive in May 2018 and gives EU citizens control over their personal data, with fines of up to 20 million euros or 4 per cent of global annual revenue. How quickly must we answer a subject access request? Under GDPR, normally within one month of receiving it, and the deadline can be extended by two further months in complex cases. The month goes further when every document about the person is linked to that person in M‑Files and exports in its original format, as PDF or to Excel. [GDPR and document management](https://solutionmanagement.eu/resources/gdpr-document-management/) has a section on subject access requests. How do people sign in? With the account they already have: through Microsoft Entra ID or another identity provider, through your Windows domain, or with an M‑Files account of their own. Does the log show every time a file is opened? The event log records changes, downloads, uploads, deletions and workflow steps, with the time and the user. Logging each time a file is opened is added with M‑Files' advanced logging module, and for long-term analysis we can export every event to a separate reporting database. Is deleted data gone for good? Deleting in M‑Files first hides a document from users, and destroying it permanently is a separate step. Deletion rules are configured as workflows that archive or delete after a set time, and a workflow can notify someone or ask for a review before anything is deleted. Is the data encrypted? Yes. In M‑Files Cloud, data is encrypted in storage and in transit. On your own servers, we set up encryption of the files, the database and the connection with you. How freely can data be classified? Fields are created as you need them, and a field can have fields of its own, so a customer can carry an address, a postcode and a city. You also decide exactly which kinds of document exist, and each one can have its own access rights and deletion rule.