Gareth Kitchen on Nostr: Can anyone with GDPR/Data Protection knowledge tell me if this is valid GDPR risk ...

Can anyone with GDPR/Data Protection knowledge tell me if this is valid GDPR risk assessment/justification? Or would we be laughed at? tbh, I think it’s madness but I guess we are where we are.Justification for Proceeding with CryptPad Without a DPA

Context: We’re a CIC run by 4 people on a volunteer basis and we have less than £3k income. CryptPad will not provide a DPA for subscriptions less than ‘Org 25’ £500pa. Self-hosting is not feasible. This document sets out why, on balance, using a CryptPad DUO subscription (£100pa) without a DPA is the least risky path available to us.The Law Exists to Protect People, Not Paperwork

The core purpose of GDPR is to protect individuals from harm caused by misuse of their personal data. A DPA under Article 28 is a mechanism for achieving that protection — it is not the protection itself.

Our obligation is to the people whose data we hold.

CryptPad’s zero-knowledge E2EE architecture means:

The provider (Cryptpad) cannot read our data, even if compelled to.
No provider employee can browse, leak, or sell beneficiary information.
A server breach yields encrypted blobs, not personal data.

A DPA with a provider who can read the data (e.g. free Google etc.) would be legally tidy but technically weaker. We are choosing substance over form.The Alternatives Are Worse

We must compare like-for-like, not against an ideal: | Option | DPA? | Data Actually Protected? | Cost | | — | — | — | — | | CryptPad (no DPA) | No | Yes — zero-knowledge E2EE | £100pa | | Free Google/Microsoft | Yes (standard terms) | No — provider holds keys, scans content | £0 | | Paper records | N/A | No — physical theft, loss, fire risk | £0 | | Paid E2EE provider with DPA | Yes | Yes | £££ (unaffordable) | | Do nothing, turn people away | N/A | N/A | Harm to volunteers | The only “fully compliant” option we cannot afford. The “legally compliant but technically inferior” option gives a provider unrestricted access to our volunteers’ data. That is the wrong trade-off for a CIC our volunteers serving real people and our community.GDPR Requires Proportionality

GDPR Article 24 requires controllers to implement “appropriate” measures, taking into account:

The nature, scope, context, and purposes of processing. We are a small CIC processing limited personal data for charitable purposes.
The risk to rights and freedoms. Our volunteers’ data is sensitive, which is precisely why we need E2EE.
The state of the art and cost of implementation — zero-knowledge E2EE is the state of the art. The cost barrier to the accompanying paperwork is what prevents compliance, not negligence. Regulators assess harm and intent. A small CIC that chose the strongest technical protection available to it, documented its reasoning, and acted in good faith is not the target of enforcement.We Are Not Ignoring the Gap We Are Documenting It

This is not a decision made in ignorance. We are:

Recording the Article 28 non-compliance explicitly in our risk register.
Accepting the residual legal risk (potential regulatory criticism) as less harmful than the real-world risk of data exposure through a less secure provider.
Committing to obtaining a DPA if and when funds allow or if CryptPad changes its policy.
Minimising the personal data we process through the platform to reduce the scope of any theoretical breach.The Residual Risk We Carry

We are honest about what this decision costs us:

Regulatory risk: If audited, we cannot produce a DPA. We would rely on demonstrating that our technical measures exceeded what a DPA alone would guarantee, and that no affordable alternative existed.
Liability risk: Without a contract, we have no recourse against CryptPad if something goes wrong. We accept this because the likelihood of a meaningful incident under zero-knowledge E2EE is extremely low.
Reputational risk: We must be prepared to explain this decision to stakeholders clearly and confidently, not hide it.Summary Statement

We choose CryptPad (DUO Subscription) without a DPA because it offers the strongest actual protection for our beneficiaries’ data at a cost we can sustain. The legal formality we lack is outweighed by the technical reality we gain. We document this decision, its risks, and our reasoning so that it can be scrutinised and revisited. We do not claim full compliance — we claim responsible, proportionate decision-making in constrained circumstances. This is not the easy route but it is the honest one.