In short and in plain language
Do your customers send medical reports, ID copies or payslips by email? Such attachments stay in inboxes and on phones for a long time. That is a risk.
An upload form on your website is a better way. This matters for tax offices, medical practices, estate agents and trades. Doctors, tax advisers and some other jobs also have a duty of secrecy.
The files are sent in encrypted form. They are not kept in the public part of the server. Only a few people have access.
The file is not passed on as an attachment. The server deletes it after a set period.
Point your customers to the new way in your offer and in your booking note. We set up the form for you.
The payslip arrives as a photo taken on the kitchen table, the medical report as a scanned PDF, the copy of the ID card as an attachment to an email with the subject line “documents”. In many tax offices, medical practices, estate agencies and trade businesses this is the normal case, because it is the only route the customer knows. The attachment lands in the inbox, from there in the forward to a colleague, on the work phone and in the archive of the email program – and it stays there long after the file has been closed. This article describes a single building block that changes this: an upload form on your own website. It shows which documents arrive in each sector, which fields and file types the form needs, where the files are stored, who is told about them and when they disappear again. And it shows how to get your customers to actually use the new route.
Key takeaways
- According to the guidance of the German Data Protection Conference, professional secrecy can be an indication of a high risk – and the guidance explicitly names a web portal as a possible way of communicating with customers.
- Anyone who, as a doctor, pharmacist, tax adviser or member of another profession named in section 203 StGB, discloses another person's secret without authorisation risks imprisonment of up to one year or a fine.
- An upload form consists of five parts: encrypted transfer, storage outside the public web directory, notification without content, personal access for a few authorised people and a deletion period that the server enforces itself.
- The file is never passed on as an attachment – not even from the form to the shared inbox. Otherwise you recreate exactly the route the form is meant to replace.
- Customers switch routes when they meet the new one at the right moment: as a link in the quote, in the appointment confirmation and in the reply to the first attachment that still comes in.
Why the email attachment carries the risk
Email is the tool every business has. A survey commissioned by Bitkom among 602 companies (Bitkom) with 20 or more employees found that practically every company uses email very often or often – 100 percent (Bitkom). For fax, this now applies to only 18 percent (Bitkom). At the same time the volume keeps growing: according to another Bitkom survey, people who use the internet at work receive an average of 53 work emails per day (Bitkom), compared with 40 (Bitkom) two years earlier. In this stream, the attachment with the medical report or the payslip floats between newsletters, invoices and appointment arrangements.
The problem is not the single email but what happens to it afterwards. The attachment sits in the inbox, often also on a smartphone, in the sent folder of the forward to a colleague, in the archive of the email program and in the backup. Nobody deletes it, because nobody is responsible for it. And a single typo in the address is enough for it to end up with the wrong person. The General Data Protection Regulation calls this by its name: under Art. 4(12) (GDPR) a personal data breach is a breach of security leading – whether accidentally or unlawfully – among other things to the unauthorised disclosure of personal data. Under Art. 33(1) (GDPR) such a breach has to be reported to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to the people concerned.
The Conference of the Independent Data Protection Supervisory Authorities of the Federation and the Federal States addressed receiving data by email in its guidance on protecting personal data transmitted by email, as of 16 June 2021 (Data Protection Conference). According to it, anyone who specifically receives personal data by email is obliged to create the conditions for secure receipt over an encrypted channel. Where a breach of confidentiality would mean a high risk for the people concerned, the guidance requires both qualified transport encryption and the ability to receive end-to-end encrypted messages. For holders of professional secrets it contains a sentence of its own: the existence of professional secrecy can be an indication of a high risk, which is why the level of risk has to be examined particularly carefully.
End-to-end encryption by email requires sender and recipient to have set up keys or certificates. Among clients, patients and prospective tenants that is the exception. The guidance therefore names an alternative in a footnote: for communication with the people concerned, for example with customers, one way of communicating can be to provide a web portal. An upload form on your own website is the smallest form of such a portal. The customer needs nothing but a browser, and the encryption of the transfer is in the hands of the party receiving the data.
For some professions, criminal law is added on top. Section 203(1) (StGB) names, among others, doctors, dentists, pharmacists and members of other healthcare professions, lawyers, auditors, tax advisers and tax agents as well as members of private health, accident and life insurance companies. Whoever among them discloses another person's secret without authorisation is punished with imprisonment of up to one year (section 203 StGB) or a fine. Estate agents, insurance intermediaries and trade businesses are not on this list. For them the General Data Protection Regulation applies: under Art. 9(1) (GDPR) health data belong to the special categories whose processing is prohibited in principle and only permitted under the exceptions set out there, and for all personal data Art. 32(1) (GDPR) requires a level of security appropriate to the risk – naming encryption explicitly.
The attachment stays put
Inbox, smartphone, forward, archive and backup: a single email creates five copies, and none of them has a deletion period.
One letter is enough
Autocomplete suggests the wrong address, the customer types an outdated one. A misdirected email is an unauthorised disclosure within the meaning of the regulation.
The shared inbox reads along
Whatever goes to the central address is seen by everyone who opens that inbox – the trainee as well as the holiday cover and the service provider who looks after the mailbox.
Which documents arrive in each sector
Before a form is built, it pays to take stock: what do your customers send by email today, and what do you need it for? The answer differs considerably from sector to sector, and it determines which fields the form needs, which file types it accepts and how quickly the files have to disappear again. The following overview shows typical documents and the legal framework that makes them special. It does not replace an assessment of the individual case, but it shows where to start.
| Sector | Typical documents | What makes them sensitive | Framework |
|---|---|---|---|
| Tax advice | Payroll statements, bank statements, receipts, tax assessments, contracts | A complete picture of income and assets | Section 203 StGB, section 62a StBerG |
| Medical, dental and therapy practices | Findings, doctors' letters, referrals, photos of symptoms | Health data | Section 203 StGB, Art. 9 GDPR |
| Estate agents | Tenant self-disclosure, proof of income, ID copy, credit report | Income and identity in one folder | Art. 32 GDPR, section 20 PAuswG |
| Insurance intermediaries | Application documents with health questions, damage photos, invoices | Health information for health, life and disability insurance | Art. 9 GDPR |
| Trade businesses | Photos of damage and rooms, floor plans, letters from the insurer | A view into the home, the address and absences | Art. 32 GDPR |
Tax advice and the healthcare professions carry the heaviest load, because data protection law and criminal law meet here. A practice that accepts findings via its website should therefore not derive the form from the general contact form but build it as a route of its own – with its own storage location and its own circle of authorised people. What a practice site may show beyond that is covered in Medical practice website: what healthcare professions may show; how we build sites for firms and practices is shown on Web design for liberal professions and Web design for healthcare professions.
For estate agents, the ID copy is the most sensitive point. Section 20(2) (PAuswG) allows the identity card to be copied only by its holder or with the holder's consent, and only in such a way that the copy is clearly and permanently recognisable as a copy. People other than the holder may not pass the copy on to third parties. Two things follow for the form: a note next to the field that explains exactly this, and a storage location from which the copy does not accidentally travel on to the owner or the property management. Better still is the question of whether the copy is needed at all. In Art. 5(1) (GDPR) point (c), the regulation requires data to be limited to what is necessary for the purpose. How agency sites bring listings and enquiries together is described under Web design for estate agents.
Insurance intermediaries move between both worlds: the insurance companies themselves are named in section 203 StGB, the intermediary is not – but the health information in the application remains data of a special category. In the trades the situation looks more harmless, but it is not. Water damage is reported with photos from the bathroom, bedroom and basement, plus the insurer's letter with claim number and bank details. Anyone who accepts such documents in a structured way also has them in one place when the loss adjuster asks. How trade businesses align their site with enquiries is shown on Web design for trade businesses.
First the list, then the form
The build plan: fields, file types, transfer
A good upload form is short. It only asks what is needed to assign the file to the right case. Four mandatory items have proven themselves: the name, a reference such as client number, property number, claim number or order number, the type of document as a selection list and the file itself. An email address is only needed if the customer is to receive a confirmation of receipt. A free text field for comments is useful but tempts people to write diagnoses or account numbers into it – a short note underneath about what does not belong there prevents this in most cases.
The customer does not have to type the reference. It can already be contained in the link you send: a personal link per case prefills the field, and the customer sees on opening it that they are in the right place. What matters is that the link itself contains no meaningful data. A random identifier is enough; the customer's real name does not belong in the address bar, because addresses end up in server logs and browser histories.
For file types, an allow list applies instead of a block list. PDF for scans and assessments, JPG and PNG for photos, plus HEIC, because some smartphones save photos in this format by default. Office files only if they are really needed; archives, executable files and scripts not at all. The server checks the actual file type based on the content, not just the extension, renames the file when saving it and stores it in a directory from which nothing can be executed. A size limit per file is based on what a smartphone photo or a multi-page scan actually needs, and the error message tells the customer what they can do instead of just showing “error”.
The transfer runs exclusively over HTTPS with a current TLS configuration. The guidance of the Data Protection Conference describes transport encryption as basic protection and a minimum measure for meeting the legal requirements; with a form on your own website it is largely in your hands, because there is no third-party mail server in between. On the server itself the files are stored encrypted, and the key is not kept in the same directory. This corresponds to what Art. 32(1) (GDPR) point (a) names first: the pseudonymisation and encryption of personal data. Which requirements a hosting package should meet for this is covered in Web hosting 2026: what local businesses need to look for.
Encrypted transfer
HTTPS across the whole site, no form page without encryption, no embedded content loaded over unencrypted addresses.
Storage outside the web directory
The files are stored where no address in the browser leads, and they are stored encrypted. The key is kept separately.
Allow list for file types
PDF, JPG, PNG and HEIC. The content is checked, not the extension. Everything else is rejected with an understandable message.
Notice without content
The notification names the case and the time – not the file name, not the customer's name and nothing from the content.
Personal access
Retrieval only with an individual login and a second factor. Every retrieval is logged with person, time and case.
Deletion period in the server
A scheduled job deletes after the defined period without anyone having to remember it, and reports uploads that were not collected.
No attachment through the back door
The customer wants to know that their documents have arrived. The confirmation therefore appears first on the page itself, directly after submitting, with date, time and the number of files transferred. Anyone who also sends an email writes only that into it: receipt confirmed, case, time. No file names, because a name like “Findings_Cardiology_Schmidt.pdf” often reveals more than the content; no copy of the file; no form content. One sentence about who will get in touch and roughly by when makes the confirmation useful without giving anything away.
Storage, access and deletion period
The web server is a letterbox, not an archive. The files stay there only until they have been transferred into the system in which the case is managed – the firm's document management, the practice software, the estate agent's property file. That can be a manual collection, in which an authorised person opens the files in the protected area and puts them into the file, or an automatic handover to an internal system. In both cases: after the transfer, the file is deleted on the web server, and it is deleted by the server itself, not by someone who has to remember to do it.
The regulation sets the standard for this. Under Art. 5(1) (GDPR) point (e), personal data may be kept in a form which permits identification of the people concerned for no longer than is necessary for the purposes of the processing. For the web server, the purpose is fulfilled with the transfer. The period you set therefore only covers the way to the file; statutory retention obligations in your sector apply to the file, not to the letterbox. Files that are not collected are deleted by the server after a second, likewise fixed period, and the responsible person is informed beforehand so that no upload disappears unnoticed.
| Step | Who acts | What remains stored afterwards |
|---|---|---|
| Upload | Customer via the form | Encrypted file, case, time |
| Notification | Server to the responsible person | Notice without file name and content |
| Retrieval | Authorised person with individual login | Log entry: who, when, which case |
| Transfer to the file | Authorised person or interface | File in the internal system, no longer on the web |
| Deletion | Server after a fixed period | Only the log entry |
| Not collected | Server after a second period | Notice to the responsible person, then deletion |
Access is where it is decided whether the new route really is more secure than the inbox. Everyone who retrieves files has an individual login with a second factor; a shared password for the practice or office undermines the logging. The notification does not go to the central address but to the person or small group handling the case. In the tax office that is the person responsible for the client, in the practice the person who transfers findings into the patient file, in the estate agency the person looking after the property. The shared inbox receives at most a count such as “three new uploads today”, but no case and no name.
That leaves the backup. Whoever backs up the web server also backs up the upload folder – and with it files that should have been deleted long ago. The upload folder is therefore either excluded from the backup or backed up with a retention that is no longer than the deletion period itself. How backups, updates and monitoring of a website work together in day-to-day operation is described in Website maintenance: secure against attacks.
The web server is a letterbox
Service providers and professional secrecy
A form on your own website means that the hosting provider and, where applicable, the agency maintaining the site could technically access the files. For holders of professional secrets, section 203(3) (StGB) governs this case: the people named there may disclose another person's secrets to other persons who contribute to their professional activity, insofar as this is necessary for making use of that activity. The other side is set out in section 203(4) (StGB): anyone who has not ensured that such a contributing person was obliged to maintain secrecy is also liable to prosecution if that person discloses the secret without authorisation.
For tax advisers, professional law becomes concrete. Section 62a(1) (StBerG) allows service providers to be given access to facts subject to confidentiality insofar as this is necessary for using the service. Under section 62a(3) (StBerG) the contract with the service provider requires text form, and in it the service provider must be obliged to maintain confidentiality, with instruction on the criminal consequences of a breach of duty. Other professions have their own professional rules; the basic idea is the same.
Alongside this stands the data processing agreement under the regulation, which applies to every business whose hosting provider processes personal data. Which agreements a website typically needs and how to recognise a usable one is explained in Data processing agreements: which contracts your website needs. If your site runs on our web hosting, we settle both points – confidentiality and data processing – before the form accepts its first upload.
- Confidentiality obligation in text form, with instruction on the criminal consequences, for every party with access to the server.
- A data processing agreement that explicitly covers the upload folder and the backup.
- A clear rule on who may access the files in the event of a fault, and that every such access is logged.
- Deletion periods and backup retention recorded in writing, so they are not lost the next time the site moves.
- A named contact for security incidents with defined availability, because the reporting deadline runs from the moment you become aware.
If something does happen
Moving customers away from attachments
The best form is of no use if the customer keeps clicking reply and dragging the attachment in. Habits do not change because of a page in the menu, but because of a link at the right moment. The right moment is the one in which the customer learns that they are supposed to send something: in the quote, in the order confirmation, in the appointment confirmation, in the request for missing receipts. There it no longer says “Please send us …” but “Please upload … here”, followed by the personal link.
In practice a short sequence works well. First the link goes into every template that requests documents. Then a sentence in the email signature pointing to the secure route. For letters, a QR code leading to the same form. If you allocate appointments online, attach the link to the confirmation; what that looks like for appointment booking is shown in Online appointment booking on your own website. And for the customers who still send an attachment, there is a friendly reply template: thank you, the documents have arrived, next time please use this link, because it is more secure for your data.
What happens to the attachment that comes in anyway belongs in the same rule: transfer the file to the case file, delete the email including the attachment, from the deleted items folder as well. The email address itself remains the channel for arrangements, queries and appointments, and for that a properly set up mailbox on your own domain is worthwhile – see Professional email with your own domain. Anyone handing over a business takes the upload route along and clarifies what happens to the stored uploads; this belongs on the list from Business succession: handing over the website and customer data properly.
- For one week, record all incoming attachments by type and purpose.
- Drop documents you do not need and define the rest as the selection list for the form.
- Define storage location, authorised people, notification and both deletion periods in writing.
- Add confidentiality and data processing to the contracts with the hosting provider and maintenance.
- Put the link into the quote, order and appointment confirmation, email signature and letter template.
- After the first weeks, count how many documents still arrive by email and sharpen the templates.
An upload form does not change which documents you receive – it changes how many copies of them are created along the way and how long they lie around.
Sources and legal basis
Related Articles
Hacked website: first steps, reporting duties, recovery
Take it offline instead of deleting, preserve traces, rotate access: the order after an attack, the Article 33 GDPR deadline and the way back into search.
Website Maintenance 2026: Secure Against Attacks
The BSI reports around 119 new vulnerabilities per day (up 24 percent). Why local businesses must regularly maintain their website and what upkeep covers.
Business succession: handing over website and customer data
When a business in Hildesheim changes hands, the domain, Google profile and customer file do not move across on their own. Timeline and rules for the handover.