Quick Answer
Uploading a payroll CSV to any online tool creates a GDPR Article 28 data processor relationship the moment the file leaves your machine. The SSNs, ABA routing numbers, bank account numbers, and earning codes in that file are no longer under your control during processing or the deletion window that follows. Browser-local tools process payroll data entirely in your browser without a network upload — no processor relationship is created, no SSN leaves your machine.
Not legal advice. GDPR and payroll privacy obligations vary by jurisdiction. Consult legal and compliance counsel before finalizing data handling procedures.
TL;DR: Online CSV tools process payroll files on remote server infrastructure — stored in blob storage, processed on shared compute, logged for debugging, accessible to vendor support staff. The "deleted within 24 hours" claim describes the deletion of the object-store record; it does not describe CDN cache propagation delay, object-store versioning that preserves previous copies, or debug log retention that may capture file content with a separate and longer schedule. A single 500-row ADP payroll export contains 500 SSNs, 500 bank routing numbers, and 500 salary records — all of which leave your machine on upload. Under GDPR, the upload creates an Article 28 processor relationship requiring a DPA you almost certainly have not signed with that vendor. Browser-local Web Worker processing eliminates all of this: no upload, no processor relationship, no SSNs leave the machine.
A payroll analyst needs to reorder columns in a 500-row ADP Workforce Now export before submitting it for a compensation review. The columns are in the wrong order — a quick fix. She opens a free online "CSV column reordering" tool, drags and drops the columns, and downloads the result. The tool shows a confirmation banner:
Your file has been processed. For your security, uploaded files are automatically deleted within 24 hours.
She closes the tab. The task is done.
What she does not know: between upload and deletion, the file passed through a CDN with nodes in multiple geographic regions, was processed on shared cloud infrastructure alongside files from other customers, was captured in part by the vendor's server-side debug logging, and was accessible to vendor support staff through an internal admin dashboard. The "deletion" at 24 hours creates a delete marker in the object store — which leaves previous versions intact in versioned storage unless a separate lifecycle purge rule fires on the same schedule.
Those 500 rows are not 500 column-reordering operations. They are 500 SSNs, 500 salary records, and 500 bank routing numbers that left her employer's control.
Vendor data retention practices described here reflect common cloud infrastructure patterns as of May 2026. Specific behavior varies by vendor. Review your tool vendor's privacy policy and data retention documentation before uploading sensitive data.
What Online Tools Actually Do With Your File
Online CSV processing tools operate on standard cloud infrastructure. The typical sequence:
Upload and storage. Your file is transmitted via HTTPS to the vendor's servers. It arrives at a load balancer, is routed to an application server, and is written to object storage — typically AWS S3, Google Cloud Storage, or Azure Blob Storage. From this point forward, the file exists on infrastructure you do not own or control.
Processing. The application server reads the file from object storage into memory, performs the requested operation, and writes the output back to object storage. During processing, the file content is in server memory on infrastructure shared with other customers.
CDN caching. Vendors that use CDNs to deliver processed outputs may cache those outputs at edge nodes distributed across geographic regions. CDN cache TTL is configured independently of object-store retention policies. A file "deleted" at the origin may remain cached at edge nodes until their TTL expires — minutes or hours later.
Logging. Application servers log every request, including file upload events, file identifiers, and occasionally file content snippets captured in debug output or error handling. Log retention schedules are independent of file retention policies and are typically longer — 30, 60, or 90 days in common configurations.
Support access. Vendor support staff typically have access to an admin dashboard that shows customer activity and files in progress for debugging purposes. This is standard practice and not unique to vendors with weak security — any vendor offering human support for file processing requires this capability.
Deletion. "Deleted within 24 hours" means the object-store record is deleted — a delete marker is written, making the file inaccessible via the application. In versioned object storage (standard for production environments), previous versions remain until a lifecycle rule purges them. Whether that lifecycle rule fires on the same 24-hour timeline as the delete marker is vendor-specific.
The GDPR Article 28 Problem
Under GDPR, when an organization uploads personal data to a third-party tool for processing on its behalf, that tool becomes a data processor. Article 28 requires:
- A signed Data Processing Agreement with every processor before any personal data is processed
- Verification that the processor provides sufficient guarantees about technical and organizational security measures
- Documented sub-processor authorization (CDN providers, cloud storage vendors, logging services are all sub-processors)
- Controller liability for processor failures — including security incidents caused by the processor
Most online CSV tools used for ad-hoc payroll file manipulation do not offer DPAs, have not been assessed for Article 28 security compliance, and do not publish their sub-processor chains. Uploading a payroll CSV to such a tool creates a processor relationship without the legal framework Article 28 requires.
The McDonald's Poland enforcement (UODO decision DKN.5130.4179.2020, 21 July 2025) established controller liability for inadequate processor due diligence at a scale that made the risk concrete. The controller uploaded data to a processor that lacked adequate safeguards. The processor had a security failure. The controller bore the regulatory consequence.
The Article 9 layer. Payroll CSVs that contain medical or disability leave codes — short-term disability codes, medical leave codes, disability pay differentials — may carry GDPR Article 9 special-category data. A single such row in a 500-row file elevates the compliance burden for the entire file and the processor relationship it creates.
What "Deleted Within 24 Hours" Actually Means
The deletion claim is accurate about one thing: the current-version object-store record is deleted within the stated window. What it does not describe:
CDN cache delay. If the vendor serves processed outputs through a CDN, edge nodes may cache the file with a TTL configured independently of the deletion policy. During that window, the file is accessible at edge infrastructure outside the vendor's direct deletion control on the same timeline.
Object-store versioning. Standard production cloud storage enables versioning to prevent accidental data loss. A delete operation in a versioned bucket writes a delete marker; it does not purge previous versions. Version purge requires a separate lifecycle rule. Whether that rule exists and fires on the same timeline as the delete marker is not disclosed in most vendor deletion policies.
Debug log retention. Server-side logging captures request details, file metadata, and sometimes file content fragments in error handling output. A payroll row that triggers a processing error may have its content captured in an error log. Log retention is typically governed by a separate policy — often 30 to 90 days in common DevOps configurations.
The support access window. During the entire pre-deletion window, vendor support staff with admin dashboard access can view and act on files. This is not a vulnerability — it is a standard operational capability. But it means your payroll data is accessible to people outside your organization for the duration of the window, regardless of deletion timeline.
The 500-Row Calculation
A 500-row ADP Workforce Now payroll export is a routine file — a bi-weekly pay run for a mid-sized employer. What it contains, per row:
- 1 SSN in XXX-XX-XXXX format (per Social Security Administration standard)
- 1 ABA routing number (9-digit American Bankers Association standard)
- 1 bank account number
- 1 home address
- 1 salary or hourly rate
- 1 or more earning codes — some of which may identify health conditions (STD, FMLA)
Across 500 rows: 500 SSNs, 500 routing numbers, 500 bank account numbers. Each one left your machine on upload. The scale of the exposure is proportional to the file size — not to how routine or brief the processing operation was.
How Browser-Local Processing Eliminates the Risk
SplitForge Data Masking processes payroll files using Web Worker threads in your browser:
File API — no network read. The browser's File API reads your payroll CSV from your local filesystem without network transmission. The file bytes never leave your machine to reach a server.
Web Worker thread — no network access. Processing happens in a JavaScript background thread that operates in isolated browser memory. Web Workers do not have access to network APIs. There is no pathway for payroll data to be transmitted during processing.
Blob export — no upload. The output is assembled in memory as a Blob and delivered as a local file download. No server receives the output.
A 500-row payroll file processed by SplitForge: zero SSNs transmitted, zero routing numbers uploaded, zero processor relationship created. Not "encrypted on a secure server" — zero, because they were never transmitted.
Verify It Yourself
Open browser DevTools (F12) → Network tab. Load SplitForge Data Masking. Drop your payroll CSV. Watch the Network tab during processing.
Zero POST requests to any external domain during file processing. Page asset requests appear at initial load; no data upload request appears at any point during file processing or export.
Offline confirmation: Load the page while online. Disconnect Wi-Fi. Process the file. The operation completes and the download works — confirming no server dependency during processing.