The short answer: When you paste customer PII into a free online tool (duplicate remover, CSV converter, email validator), you're uploading personal data to a third-party server. Under GDPR, this makes the tool operator a data processor — and using a processor without a Data Processing Agreement (DPA) is a violation. Most free tools have no DPA, no data retention policy, and no transparency about what happens to your file after processing.
The Everyday Scenario
You have a customer list with duplicates. You Google "free online duplicate remover," find a tool, paste your 2,000-row CSV with names, emails, and phone numbers, click Remove Duplicates, and download the result.
What just happened?
What Actually Happens to Your Data
When you upload to a typical online tool:
- Your file is transmitted to their server over HTTPS — so the connection is encrypted, but the data reaches their infrastructure
- The file is processed on their server — their code runs against your data
- Results are sent back to you — but your original file may be retained in server logs, a temporary storage bucket, or a database
- Retention varies — some tools delete immediately on download, some retain for hours or days for "debugging", some retain indefinitely and monetize the data
See exactly what's wrong with your data — try Sohovi free — try Sohovi free.
The key point: you don't know what happens after download unless the tool explicitly tells you in a clearly written privacy policy. Most don't.
The Legal Problem (GDPR / DPDP / CCPA)
GDPR (EU customers)
Under GDPR, if you process personal data of EU residents, you are the data controller. Any third party you use to process that data on your behalf is a data processor.
Using a data processor requires:
- A Data Processing Agreement (DPA) — a contract specifying what the processor can do with the data, how long they retain it, and their security obligations
- The processor must offer adequate security for the data
- The processor must not use the data for their own purposes
Pasting EU customer PII into a tool with no DPA means you're using an unauthorized processor. The regulator's view: you didn't have the right to give them that data.
Sohovi automatically detects PII in your datasets — emails, phone numbers, SSNs — all processed client-side so your data never leaves the browser.
This is not legal advice — consult a privacy lawyer for your specific situation.
India's DPDP Act (Indian customers)
India's Digital Personal Data Protection Act (2023) applies similar logic. Processing personal data of Indian residents requires a lawful basis, and sharing that data with a third-party processor requires appropriate safeguards. The DPDP Act's enforcement is maturing, but the requirement is the same: you need a contractual basis for data sharing with processors.
CCPA (California customers)
CCPA requires businesses to disclose data sharing with "service providers" and to have contracts limiting their use of the data. An uncontracted tool that receives customer data doesn't qualify as a service provider under CCPA — it's an unauthorized disclosure.
How to Vet a Tool Before You Paste
Four questions to ask before putting customer data into any online tool:
-
Where is data processed? Server-side or client-side/browser-based? "Browser-based" means processing happens in your browser on your device — the file never leaves your machine. Server-side means it's uploaded.
-
What is the retention policy? Do they state explicitly how long they keep uploaded files? "We delete immediately after processing" is acceptable if verifiable; "we retain files for 30 days" is not appropriate for PII.
-
Is a DPA available? Any tool offering a commercial service should have a DPA template. Its absence is a red flag.
-
Can you verify the claim? Browser-local tools can be verified by opening your browser's developer tools (F12 → Network tab) and watching for upload requests when you process a file. If no data is transmitted, the claim is true.
Browser-Local vs. Server-Side: The Architectural Difference
Traditional online tool:
- You upload → file travels to their server → they process it → result travels back
- Your data is on their infrastructure, even if only temporarily
Browser-local tool:
- File is loaded into your browser's memory using JavaScript/WebAssembly
- All processing happens locally on your device
- Only the result (downloaded file) leaves your machine — if you choose to download it
- The tool's server never sees your data
Browser-local processing is verifiable. In Sohovi: open DevTools (F12), go to the Network tab, upload a file. You'll see zero data upload requests. The file stays on your device.
Does This Apply to Small Teams?
GDPR applies to any organization processing personal data of EU residents, regardless of the organization's size or location. There is no SMB exemption. The risk for small teams is lower in absolute terms (smaller data volumes, less likely to be investigated proactively), but the legal requirement is identical.
The practical risk is reputational, not just regulatory: if a data breach or unauthorized disclosure is traced back to a free tool you used, the fact that "it was just a dedup tool" is not a defense.
Frequently Asked Questions
Q: Is it OK to use online tools if the data is anonymized first? Properly anonymized data (not just pseudonymized — see How to Anonymize a CSV Before Sharing) is not personal data under GDPR, so the data processor rules don't apply. But anonymization that still allows re-identification (e.g., name removed but phone and ZIP code remain) doesn't qualify — you need k-anonymity or equivalent.
Q: What about tools that claim "GDPR compliant"? "GDPR compliant" is a marketing claim, not a certification. Ask specifically: Is there a DPA available? Where is data processed? How long is data retained? A tool with a real DPA and server-side processing is more compliant than a tool with no DPA — but a browser-local tool that never receives the data sidesteps the processor relationship entirely.
Q: Our data is B2B — business email addresses, not consumers. Does GDPR apply?
GDPR protects natural persons, not legal entities. Business email addresses of the form john.smith@company.com are personal data (they identify an individual). info@company.com role addresses are more ambiguous. The safest position: treat business contact data as personal data.
Q: Does this apply to Excel/Google Sheets? Excel (desktop) processes locally — no upload, no issue. Google Sheets sends your data to Google's servers, which means Google is a processor. Most organizations using Google Workspace have a data processing agreement with Google as part of their G Suite terms. Check whether your Google Workspace agreement covers your specific data processing use case.
Open your browser's network tab and watch: in Sohovi, your file never leaves your machine. You get the deduplication, profiling, and validation you need — without creating a processor relationship, without GDPR exposure. Try it on your own file.
