Dropbox gives you the pieces to use it compliantly: a data processing agreement, EU storage on some plans, and serious published security documentation. The complication is that it is a US company, so an EU data centre answers where the bytes sit but not which government can compel access to them. Whether that matters depends entirely on what you store in it.
Not legal advice. For health data, children's data or anything at scale, get qualified advice.
Two separate questions
People collapse these into one and then argue past each other.
Where is the data stored? Dropbox offers EU storage on some plan types. Check which applies to your account — it is not universal and not always the default.
Who can compel its production? Dropbox is incorporated in the United States. A US company can be served with lawful process for data under its control, wherever that data physically sits. Storing it in Germany does not take the company out of US jurisdiction.
Neither is an accusation. Dropbox's security engineering is serious and its documentation is better than most. But the second question is a structural fact about corporate jurisdiction, not a judgement of quality — and it is the one that decides a lot of procurement. The longer explanation.
What you have to do to use it compliantly
Put the DPA in place. Dropbox publishes one. "Available" and "accepted for your account" are different states — check which yours is in.
Know the sub-processors. Dropbox publishes a list. If a client contract requires you to disclose sub-processors, you need it.
Confirm your storage region. Do not assume it. It varies by plan, and by when the account was created.
Set retention on purpose. Dropbox keeps things until you delete them — the opposite failure from a transfer service that deletes too soon. "We kept everything because it was easy" fails the storage limitation principle just as surely. Choosing a retention period.
Audit your shares. This is the big one in practice. Most accounts have folders shared as "anyone with the link" years ago, and every file added since has inherited that. It is not a Dropbox flaw; it is how link sharing works. It is also the most likely way you will actually leak something.
Dropbox and Dropbox Transfer are different shapes
Dropbox shares a file out of your storage. The recipient's access is an ongoing permission against your account, and it changes meaning if you later move or edit the file.
Dropbox Transfer hands over a copy: a bounded handover rather than an open permission. For sending personal data to a third party, that is the better shape. The fuller argument.
The current limits, from Dropbox's own help centre, are in the card below.
When Dropbox is the reasonable choice
- Internal collaboration where the data stays inside your organisation.
- Client work where the client has no data-location requirement.
- Teams already running on it, where a second vendor would add a data flow rather than remove one.
That last point deserves weight. Another service means another processor, another DPA and another place data lives. If Dropbox already meets your requirements, moving files to a second vendor can make your position worse rather than better.
When to look elsewhere
- A written requirement that data stay within the EU, interpreted strictly — including who runs it.
- Public-sector or regulated work where jurisdiction is specified.
- Clients whose own DPAs rule out US sub-processors.
- Special-category data where you have decided US jurisdiction is not an acceptable risk. What changes with sensitive data.
If any of those apply, start with the European options, and test company establishment rather than data centre location. Leaving US big tech covers what that move looks like in practice.
The checklist
- Is the DPA accepted for your account, not merely published?
- Which region is your data actually in?
- Have you read the sub-processor list this year?
- When did you last audit "anyone with the link" shares?
- What is your retention rule, and what enforces it?
- Does any client contract restrict sub-processors or jurisdictions?
Question four finds more real problems than the other five combined, and it takes five minutes.
The general framework is in what GDPR-compliant file transfer requires, and if you are moving off Dropbox Transfer specifically, here is what else exists.
Disclosure: I run Yungle, which competes with Dropbox Transfer in a small way — the full side-by-side is on the comparison page. It is a Dutch business with files on a server in Germany. Being consistent with the questions above: its nightly backups stay with the same provider, Hetzner, in a second data centre in Finland, so no US company holds any of it. Sub-processors are named in the privacy policy.