Skip to content

Send a confidential PDF by e-mail

Payslips, ID documents, HR files: before sending personal data by e-mail, encrypt the attachment. Here is the method recommended by the CNIL (the French data protection authority), in three steps.

or drag them here · several at once with the pass or Premium

Processed on your device, nothing is uploaded

How do I send a confidential PDF by e-mail?

  1. First remove what isn't needed: extra pages (Delete pages) and unnecessary information (Redact).
  2. Protect the PDF with a strong password: it is encrypted with AES 256-bit encryption.
  3. Send the file by e-mail, and the password by another means: text message, phone or in person.

In its guidance sheet “Sécuriser les échanges avec l'extérieur” (securing exchanges with outside parties), the CNIL recommends encrypting sensitive documents before sending them, and communicating the secret through a separate channel: the encrypted file by e-mail, the password by phone or text message. It advises against sending files containing personal data unencrypted via consumer messaging services.

The GDPR also requires you to send only the data that is necessary. Before sending, remove unnecessary pages and hide what the recipient doesn't need, such as an IBAN or a social security number. Check the recipient's address before pressing “Send”: a wrong address is enough to cause a leak.

With TwoDocument, the document is encrypted by your browser: neither the file nor the password is entrusted to an online service. The protected PDF opens in current PDF readers, which ask for the password when opening it. This advice does not replace your organization's rules: also follow those of your employer or your data protection officer.

Frequently asked questions

Why not put the password in the same e-mail?

Because someone who intercepts the e-mail, or receives it by mistake, would then have both the file and the key. The CNIL advises sending the password through another channel, by text message or by phone for example.

Which password should I choose?

A long password used only for this sending, with no personal information: a short phrase of several words works well. TwoDocument requires at least 6 characters, without accents; the longer it is, the better.

Is this enough to be “GDPR compliant”?

Encryption is an important security measure, but compliance depends on the processing as a whole: purpose, retention period, informing the people concerned. Within an organization, check with your data protection officer.

Is my document sent to TwoDocument?

No. Encryption is done on your device; TwoDocument receives neither the file nor the password.

Other tools