WeTransfer can be used in a GDPR-compliant way. The question that actually decides your exposure is whether your use of it is — and the gap between "the service can be used compliantly" and "my workflow is compliant" is where nearly every real problem lives.
Not legal advice. If you handle health data, children's data or personal data at scale, talk to someone qualified.
The short answer
WeTransfer is a Dutch company, which puts it inside the EU and squarely inside the GDPR's own jurisdiction. That is a genuinely good starting point, and better than most household names in this category.
Whether you are compliant using it comes down to four things that are your responsibility, not theirs:
- Do you have a data processing agreement covering your use?
- Do you know where the data goes, sub-processors included?
- Did you choose a retention period, or accept a default without noticing?
- Could you answer a client asking any of the above?
Most people sending client work through it cannot answer the first one. That is the actual finding.
What WeTransfer publishes about its plans
From WeTransfer's own documentation, checked on the date in the card: the free tier allows 3 GB or 10 transfers, counted across a rolling 30 days rather than per transfer, and it is ad-supported. Transfers that never expire are a top-tier feature.
For their processing terms, sub-processors and available agreements, go to WeTransfer's own documentation rather than any comparison page — this one included. Contractual terms change, and a third party summarising them is exactly how stale claims spread.
The parts that are actually your problem
The free tier is advertising-supported
An ad-supported download page means third parties are involved in the page your recipient loads. That is a data flow separate from the file itself — and if you send on behalf of a client with strict requirements, it is the kind of thing that turns up in their supplier questionnaire. It also means your client sees an advert on the page you sent them to, which is a smaller but real problem of its own.
You probably have no DPA
If you signed up with an email address and started sending client files, you have probably not put a processing agreement in place. For personal data, that is the gap. It is not hard to fix — but nobody fixes it until someone asks.
Retention is a decision you have not made
On a free account, expiry is the product rather than a setting. That is arguably good for data minimisation: data you no longer hold cannot leak. It is bad when you needed the file, which is the most common complaint in this category.
Either way, the compliance question is whether you chose it. "The service deleted it" is not a retention policy — it just happens to produce a defensible outcome by accident.
You are probably a processor, not a controller
If a client gave you their customers' data to work on, they are the controller and you are their processor. Their requirements flow down to you, and WeTransfer becomes a sub-processor you may be contractually required to disclose. Plenty of client contracts require exactly that, and plenty of freelancers have never told a client which transfer service they use.
When WeTransfer is perfectly fine
- Sending your own work that contains no personal data.
- Sending to a client with no specific requirements who has not asked.
- One-off transfers where a short lifetime is a feature, not a problem.
For a large share of freelance work, that is the honest situation, and switching would solve a problem you do not have.
When to look harder
- Special-category data — health, biometrics, anything about someone's private life. The obligations get sharper.
- A client with a compliance function. They will ask, and "WeTransfer" with no DPA is not an answer.
- Public-sector or regulated work, where requirements are often written as hard rules about data location.
- Any work where you are contractually a processor and have obligations you have not reread recently.
What to do this week
None of these require changing service:
- Find out whether you have a DPA with whatever you use. If not, get one, or stop using it for personal data.
- Write a retention rule. One sentence is enough: "Client deliverables are kept for the engagement plus six months, then deleted."
- Know your answer to "where is the data, and who can compel access?" It arrives without warning. For US-owned providers, the answer is more complicated than the data centre suggests.
The full framework is in what GDPR-compliant file transfer requires. If you conclude you need something else, the European options are the place to start — and note that WeTransfer, being Dutch, belongs on that list rather than off it.
Disclosure: I run Yungle, a competing service, which is why this page goes out of its way to say what WeTransfer gets right. The side-by-side detail is on the WeTransfer comparison. Yungle keeps files on a server in Germany at Hetzner, with nightly backups in a second Hetzner data centre in Finland — no US company holds them — and there is a DPA you can read before deciding anything.