Is Excel GDPR Compliant? Risks of Shared Spreadsheets

In most professional firms it happens every day: the client spreadsheet gets attached to an email, saved on a colleague's desktop, copied to a USB stick "just for tonight". It works, until someone asks: is using Excel GDPR compliant? The short answer is that Excel itself isn't the problem, but the way we use it often makes data protection rules almost impossible to follow.

This article explains, in plain language, what the GDPR expects from a firm that keeps client data in spreadsheets, what the real risks of sharing Excel files by email are, and how to reduce them without turning your workflow upside down.

Excel and GDPR: it's not the software, it's how you manage it

The EU General Data Protection Regulation (Regulation 2016/679) doesn't mention Excel or any other specific tool. What it does require is that whoever controls personal data protects it according to a set of principles and can demonstrate that they do.

Accountants, law firms, payroll consultants and engineering practices handle sensitive information all the time: tax IDs, bank details, payslips, employee health data, financial records. When that data lives in scattered spreadsheets, the real question isn't "is Excel compliant?" but "can I control who sees what, where the copies are, and what happens if one goes missing?"

What the GDPR actually asks, in plain English

Skipping the legal jargon, these are the rules that matter most if a spreadsheet is your client database.

Data minimisation (Art. 5): collect and share only the data you actually need. Sending a 40-column sheet to someone who uses three of them is the opposite.
Integrity and confidentiality (Art. 5): data must be protected against unauthorised access, loss and accidental changes.
Storage limitation (Art. 5): you can't keep personal data forever. But how do you delete a client from ten copies of the same file?
Accountability (Art. 5 and 24): doing the right thing isn't enough; you need to be able to prove it.
Security of processing (Art. 32): technical and organisational measures appropriate to the risk, including the ability to restore data after an incident.
Personal data breaches (Art. 33 and 34): if personal data ends up in the wrong hands, the controller must assess the incident and, where there's a risk to individuals, notify the supervisory authority within 72 hours and sometimes inform the people affected.

That last point surprises many people: an email with the wrong attachment sent to the wrong recipient can be a reportable personal data breach.

The real risks of emailing Excel spreadsheets

1. Copies multiply out of sight

Every email creates new copies: in the sender's mailbox, the recipient's, the mail server backups, a laptop's Downloads folder. A few months later, nobody knows how many versions exist or where. Storage limitation becomes impossible, and so does a confident answer to a client who asks you to erase their data.

2. All or nothing access

A spreadsheet either opens or it doesn't. Whoever receives it sees every row and every column, including data they have no reason to see. File passwords don't help much: they're usually sent in the same email or haven't changed in years.

3. Misdirected emails

Address autocomplete, the wrong attachment picked in a hurry, "reply all". These are the most mundane incidents and the most common ones, and with a client database attached, the consequences get serious.

4. Personal devices and USB sticks

The file taken home to finish a job, saved on a family PC, or on a USB stick left on the train. None of these copies is under the firm's control.

5. No record of who did what

If data is changed or deleted by mistake, a shared spreadsheet rarely tells you who did it, when, or why. Without that trail, demonstrating due diligence is much harder.

If several of these sound familiar, your spreadsheet is probably already doing the job of a business system. We covered the symptoms in Excel as an ERP: 7 warning signs.

Minimum good practices for a professional firm

Before changing tools, a few habits cut the risk right away.

Stop attaching the client database to emails. If a colleague needs it, they should access a single source, not receive a copy.
Split data on a need-to-know basis. Whoever tracks deadlines doesn't need bank details; whoever does billing doesn't need health data.
Back up regularly and test the restore. An untested backup is a hope, not a security measure.
Decide who can view and edit what, and write it down. It's part of the documentation the GDPR expects.
Have an incident procedure: who gets told, how the risk is assessed, how you meet the 72-hour deadline.

The catch is obvious: with scattered spreadsheets, points 1, 2 and 4 depend almost entirely on people remembering to do the right thing. That's exactly where the tool makes a difference.

From spreadsheet to online business app: what changes for data protection

An online business app with users and permissions turns many good practices from "rules to remember" into the default behaviour. It doesn't replace your obligations as a controller, but it makes them far easier to meet and to document.

In practice:

One version of the data. Nobody needs to send the file around: everyone works on the same up-to-date records, and uncontrolled copies disappear.
Access control. Each person has their own account and sees only what they need. When someone leaves the firm, you switch off their access instead of hoping they delete their files.
Managed backups. Data lives in the cloud with backups, so a stolen laptop or a failed drive doesn't mean losing your records.
Real deletion. When a client asks to be removed, you remove them in one place.
Working at the same time. No more "who has the file open?" or versions named clients_final_v2_REAL.xlsx.

How Nitor helps firms that run on Excel

Nitor starts from the spreadsheet your firm already uses as its business system and turns it into an online business app, hosted and maintained by Nitor. The structure you know stays familiar, but your data stops travelling by email.

You get cloud data with backups, a single always-current version, users and permissions to decide who sees and edits what, and the ability for several people to work at once. As your needs grow, you can add extensions without starting over.

Nitor won't make you "GDPR compliant" in one click; no tool can, because compliance also covers processes, privacy notices and contracts. What it does is remove some of the most common risks of shared spreadsheets at the source. If you're weighing other options, see our comparison of Excel alternatives for small businesses.

In short

The GDPR doesn't ban Excel, but it requires you to protect personal data, limit how far it spreads and prove that you do.
Emailed spreadsheets multiply copies, offer no real access control and make misdirected emails likely, and those can be breaches you must report within 72 hours.
Good habits help, but with scattered files they all rely on people's memory.
An online business app with one version of the data, user accounts, permissions and backups makes data protection the default.

If your firm's client records still live in a spreadsheet, now is a good time to move them somewhere safer.