Ask HN: Google Drive/Office 365 alternatives
My partner runs a small charity in the UK whose office infrastructure is based on Google Drive. (Sheets, spreadsheets, email, etc). Her trustees are advising that since Google cannot guarantee that her data is being stored in the UK (apparently?), they need to migrate. Like seemingly every organisation these days, they're looking at MS Office 365. But having a partner with GNU and emacs stickers all over their laptop, she's wondering what alternatives are out there. It'd need to be low (or better no) maintenance, comparable in cost to Office 365 and quality too. It could be web-hosted or based on Next/OwnCloud or something, as long as it works without a load of pain points. Oh and UK-hosted too. I assume others here must have thought this through already, so thought I'd ask the hivemind!
123 comments
Seriously, just use Office 365. Otherwise you'll forever be dealing with a constant low grade stream of interoperability glitches.
Yes, file formats are usually interchangeable. No, that interchangeability is not perfect, especially once you get away from word processing and into spreadsheets and presentations.
The majority of people your partner has to work with outside of their charity will be using Office so these small issues will constantly cause friction and frustration.
Does your partner want to waste time on those issues or do they want to focus their energy on the good work of the charity?
And, since we're talking about a charity, O365 is probably available at a reduced price, or even free.
Yes, file formats are usually interchangeable. No, that interchangeability is not perfect, especially once you get away from word processing and into spreadsheets and presentations.
The majority of people your partner has to work with outside of their charity will be using Office so these small issues will constantly cause friction and frustration.
Does your partner want to waste time on those issues or do they want to focus their energy on the good work of the charity?
And, since we're talking about a charity, O365 is probably available at a reduced price, or even free.
Since this is the top comment, I want whoever stumbles here to be aware Office 365 isn't all that smooth either. There are things that Google's and Zoho's offerings do much better than Microsoft's.
#1 This is 2020 and everybody's collaborating on a single doc with comments. But how do you point someone to a comment with a link? In Office 365, you can't.
#2 Until recently office 365 didn't even have a grammar checker / proofing assistant.
#3 You've worked on a document and intend to quickly send a pdf over to an email? You download the file, convert to pdf and email it. Even a simple "Send this file as an email attachment" isn't available in their editors.
#4 Talking about file-format compatibility, like someone else has pointed out there's no guarantee that documents created in the online version is compatible with their desktop editors. Too bad.
#5 In version history, how can you compare two versions of the same file? Well, you can't.
Remember for Google and Zoho, cloud based document editors was their target, right from idea to finished product. For Microsoft, it was an afterthought. And it shows.
#1 This is 2020 and everybody's collaborating on a single doc with comments. But how do you point someone to a comment with a link? In Office 365, you can't.
#2 Until recently office 365 didn't even have a grammar checker / proofing assistant.
#3 You've worked on a document and intend to quickly send a pdf over to an email? You download the file, convert to pdf and email it. Even a simple "Send this file as an email attachment" isn't available in their editors.
#4 Talking about file-format compatibility, like someone else has pointed out there's no guarantee that documents created in the online version is compatible with their desktop editors. Too bad.
#5 In version history, how can you compare two versions of the same file? Well, you can't.
Remember for Google and Zoho, cloud based document editors was their target, right from idea to finished product. For Microsoft, it was an afterthought. And it shows.
"4 Talking about file-format compatibility, like someone else has pointed out there's no guarantee that documents created in the online version is compatible with their desktop editors. Too bad."
Note that this isn't theoretical. I see several documents a week that render funny in online o365. Misaligned bullets, wrong font, etc. Occasionally ones that just don't work at all.
Note that this isn't theoretical. I see several documents a week that render funny in online o365. Misaligned bullets, wrong font, etc. Occasionally ones that just don't work at all.
The biggest downside with Google's offering (I don't know about Zoho) is that there is no way to easily export all of your documents to an array of bytes that can be saved in another system – also known as a file.
Seriously – if you use Docs or Sheets and want to move off, you've either got to manually export everything to an interchangeable format, or just give up and leave a bunch of stuff behind.
This is a particular pain when shifting between Google accounts, or closing an account down (for example, at the end of a job.)
Seriously – if you use Docs or Sheets and want to move off, you've either got to manually export everything to an interchangeable format, or just give up and leave a bunch of stuff behind.
This is a particular pain when shifting between Google accounts, or closing an account down (for example, at the end of a job.)
I don't know what specific issues you're having, but for me I can simply do a select-all in Google Drive, right click and hit Download.
After some time of processing it'll eventually give me a .zip which contains all the documents and files. Google Docs documents are exported as MS Word .docx files. I don't have any spreadsheets to hand, but I believe they're exported as .xlsx format files too.
e: I see Google Takeout also allows you to export these, too in choice of formats: https://takeout.google.com/
After some time of processing it'll eventually give me a .zip which contains all the documents and files. Google Docs documents are exported as MS Word .docx files. I don't have any spreadsheets to hand, but I believe they're exported as .xlsx format files too.
e: I see Google Takeout also allows you to export these, too in choice of formats: https://takeout.google.com/
Yeah. It's pretty easy. Google Takeout is great.
BACK UP YOUR GOOGLE ACCOUNT PERIODICALLY. GOOGLE CAN AND DOES RANDOMLY DISABLE THEM WITH THEIR CHAOS MONKEY ACCOUNT THWACKER. If they detect suspicious activity -- and their algorithms aren't particularly good here -- they WILL close your account, wipe your data, and there is no support.
BACK UP YOUR GOOGLE ACCOUNT PERIODICALLY. GOOGLE CAN AND DOES RANDOMLY DISABLE THEM WITH THEIR CHAOS MONKEY ACCOUNT THWACKER. If they detect suspicious activity -- and their algorithms aren't particularly good here -- they WILL close your account, wipe your data, and there is no support.
Fear of that is why I migrated all of my primary stuff off of Google during lockdown while I had more time.I used everything google had too at the time, even google Fi. My services are a bit more spread out now, but they are also more robust and don’t have a single catastrophic point of failure, besides my fragile body.
Ah, thanks – it sounds like it's better than when I was bitten by this (three or four years ago.)
I use rclone and it automatically downloads all of my Docs as .docx and Sheets as .xlsx.
The only pain point is that the Drive API seems to omit checksums for these types of files, so they're always downloaded even when they haven't changed.
I only have a handful of these so it's only a minor annoyance but I imagine it could get ugly if you are a heavy user.
The only pain point is that the Drive API seems to omit checksums for these types of files, so they're always downloaded even when they haven't changed.
I only have a handful of these so it's only a minor annoyance but I imagine it could get ugly if you are a heavy user.
> also known as a file
What? Visit https://drive.google.com/ and your files are there.
What? Visit https://drive.google.com/ and your files are there.
The parent was talking about the proprietary format of Google's Docs, Sheets, etc, which cannot be downloaded as they are.
Oh but they can, if you have google drive in your desktop you'll see that they are a .gsheets document for example.
Gsheet is just a link to the online copy. It's useless as a backup.
Does the .gsheets file contain the actual data or is it just a link to an online copy?
Expand all the messages in this[^1] Google support thread, and note the comments from "Craig[^2]."
Or, even better: open a .gsheets or any .gEXT file in your favorite text editor. You'll see that they are comprised of web markup language, much like an XML doc. I don't have one in front of me atm, but I recall thinking, "it's basically XML that points one's browser to the appropriate Google app and a unique ID for the document."
[^1]: https://support.google.com/docs/thread/10078336?hl=en [^2]: https://support.google.com/docs/thread/10078336?hl=en&msgid=...
Or, even better: open a .gsheets or any .gEXT file in your favorite text editor. You'll see that they are comprised of web markup language, much like an XML doc. I don't have one in front of me atm, but I recall thinking, "it's basically XML that points one's browser to the appropriate Google app and a unique ID for the document."
[^1]: https://support.google.com/docs/thread/10078336?hl=en [^2]: https://support.google.com/docs/thread/10078336?hl=en&msgid=...
[deleted]
> #1 This is 2020 and everybody's collaborating on a single doc with comments. But how do you point someone to a comment with a link? In Office 365, you can't.
Counterpoint: This is not a bug, it's the best feature of Office 365.
This is a bit of a rant, but the worst thing about Google Docs is how it encourages this terrible working pattern, where everyone wants to edit the same exact document at the same time like some kind of cursed nightmare Etherpad, without any way to reasonably handle merge conflicts, and with comments on comments on markup for lines. And every keystroke you press is logged indefinitely so you can't type anything out without everyone watching over your shoulder.
Just a personal opinion, but as a paying Office 365 subscriber, Office 365 is at it's best when it fundamentally rejects Google's workflows and offers it's own. Besides, if what you really want is Google Doc stuff, you can already buy that from Google today anyway.
Counterpoint: This is not a bug, it's the best feature of Office 365.
This is a bit of a rant, but the worst thing about Google Docs is how it encourages this terrible working pattern, where everyone wants to edit the same exact document at the same time like some kind of cursed nightmare Etherpad, without any way to reasonably handle merge conflicts, and with comments on comments on markup for lines. And every keystroke you press is logged indefinitely so you can't type anything out without everyone watching over your shoulder.
Just a personal opinion, but as a paying Office 365 subscriber, Office 365 is at it's best when it fundamentally rejects Google's workflows and offers it's own. Besides, if what you really want is Google Doc stuff, you can already buy that from Google today anyway.
The UI of it is what bugs me, as the comment boxes slide up and down the page while people are typing, so you have this annoying widget flying around and when you do want to reply to it, you've got to scroll around to try and find the thing again.
A comment/request suggestion feature sounds like a good one, but I think the way Google did it is far from ideal.
A comment/request suggestion feature sounds like a good one, but I think the way Google did it is far from ideal.
This is the reason why in Zoho Writer [1] we've put them in a neat pane on the side to show all your comments as a list. It's intuitive to jump from one comment to another, filter them and do bulk comment operations like delete-all/resolve-all.
[1] https://writer.zoho.com
[1] https://writer.zoho.com
> Remember for Google and Zoho, cloud based document editors was their target, right from idea to finished product. For Microsoft, it was an afterthought. And it shows.
WAS an afterthought, 5-7 years ago. Now we at Microsoft often find that the desktop version is the afterthought; see my other comment (https://news.ycombinator.com/item?id=24400026 ) for an example.
WAS an afterthought, 5-7 years ago. Now we at Microsoft often find that the desktop version is the afterthought; see my other comment (https://news.ycombinator.com/item?id=24400026 ) for an example.
Is an afterthought in underlying platform design.
Typing isn't synced anywhere close to real-time, for example, and glitches abound.
It's tough to retroglue this stuff in!
Typing isn't synced anywhere close to real-time, for example, and glitches abound.
It's tough to retroglue this stuff in!
Can you edit styles in Office online yet?
Microsoft pushed styles hard for so long, it still takes up a massive chunk of the ribbon menu by default, yet the online version doesn't appear to let me create or update them.
This is a fairly fundamental feature of Word. Add text, apply style. It can't do one of those.
Microsoft pushed styles hard for so long, it still takes up a massive chunk of the ribbon menu by default, yet the online version doesn't appear to let me create or update them.
This is a fairly fundamental feature of Word. Add text, apply style. It can't do one of those.
When you have an Office 365 subscription, you can either edit using the web apps or you can work on the local apps on your computer. For the few features that the web version doesn’t support (like file comparison) you can just “open in app”.
I want to address this, since it's not the first time I've seen it.
> Seriously, just use Office 365. Otherwise you'll forever be dealing with a constant low grade stream of interoperability glitches.
The obvious answer is that they're already using an alternative to MS Office if they're using Google, and the reason for the migration is not interoperability issues.
Importantly, however, Office 365 is also not a usable alternative if you need perfect interoperability with MS Office files. Trust me on this. I've had an administrative position for the last couple years. Suddenly I went from rarely having to deal with MS Office files to a steady stream of them.
No big deal, I thought, since my employer uses Office 365. It's literally a joke to think you can share files with users of the desktop version of MS Office. Many, many times a message has popped up telling me I need to open the file in the desktop version if I want to edit. (And I don't think it supports the older Office files at all.) I mentioned that to the secretary and she just laughed and said you can't do collaborative work with the online version when everyone else uses the desktop version.
> Seriously, just use Office 365. Otherwise you'll forever be dealing with a constant low grade stream of interoperability glitches.
The obvious answer is that they're already using an alternative to MS Office if they're using Google, and the reason for the migration is not interoperability issues.
Importantly, however, Office 365 is also not a usable alternative if you need perfect interoperability with MS Office files. Trust me on this. I've had an administrative position for the last couple years. Suddenly I went from rarely having to deal with MS Office files to a steady stream of them.
No big deal, I thought, since my employer uses Office 365. It's literally a joke to think you can share files with users of the desktop version of MS Office. Many, many times a message has popped up telling me I need to open the file in the desktop version if I want to edit. (And I don't think it supports the older Office files at all.) I mentioned that to the secretary and she just laughed and said you can't do collaborative work with the online version when everyone else uses the desktop version.
An opposing anecdote:
While using the Office web apps, I have rarely seen the "you need to open this file in the Windows desktop version of XYZ to edit the file" message in the last year and a half at Microsoft, a company that intensely uses Microsoft 365. In every case that I can recall, this message showed up in one of 2 cases:
1. Macro-enabled files - there is no VBA or .NET programmability for the web version.
2. Files protected with M365/Azure information protection (DRM/IRM).
I don't think either of these scenarios are likely to occur in a charity/nonprofit, which was the original post's concern.
As for me personally, I hardly ever wanted to edit files in either category intentionally - the macro-enabled files are old archival docs and the DRMed docs are announcements from executives.
> And I don't think it supports the older Office files at all.
True. M365 can convert .abc Office files to the .abcx format, save the converted copy, then open it for viewing and editing. That all happens in 1 step but is not the same as supporting the old formats to begin with.
> I mentioned that to the secretary and she just laughed and said you can't do collaborative work with the online version when everyone else uses the desktop version.
Ironically, I find that to the extent this is true, that's because the desktop version has fewer features. Make a comment on a Word doc? If you did it in the web version, your collaborator gets an email with the comment text, and if they're using the Outlook web or Windows desktop versions, they can even reply to the comment from within the email preview without having to click Reply or open a link to the doc. But if you did it in the desktop version, all your collaborator gets is "Comment previews are coming soon to the version of Word [you] used!" where "soon" has been soon for at least a year and a half.
While using the Office web apps, I have rarely seen the "you need to open this file in the Windows desktop version of XYZ to edit the file" message in the last year and a half at Microsoft, a company that intensely uses Microsoft 365. In every case that I can recall, this message showed up in one of 2 cases:
1. Macro-enabled files - there is no VBA or .NET programmability for the web version.
2. Files protected with M365/Azure information protection (DRM/IRM).
I don't think either of these scenarios are likely to occur in a charity/nonprofit, which was the original post's concern.
As for me personally, I hardly ever wanted to edit files in either category intentionally - the macro-enabled files are old archival docs and the DRMed docs are announcements from executives.
> And I don't think it supports the older Office files at all.
True. M365 can convert .abc Office files to the .abcx format, save the converted copy, then open it for viewing and editing. That all happens in 1 step but is not the same as supporting the old formats to begin with.
> I mentioned that to the secretary and she just laughed and said you can't do collaborative work with the online version when everyone else uses the desktop version.
Ironically, I find that to the extent this is true, that's because the desktop version has fewer features. Make a comment on a Word doc? If you did it in the web version, your collaborator gets an email with the comment text, and if they're using the Outlook web or Windows desktop versions, they can even reply to the comment from within the email preview without having to click Reply or open a link to the doc. But if you did it in the desktop version, all your collaborator gets is "Comment previews are coming soon to the version of Word [you] used!" where "soon" has been soon for at least a year and a half.
In the UK, Charity Digital Trust offers free licences for charities using Office 365: https://charitydigital.org.uk/products/microsoft-365-nonprof...
For nonprofits in other countries it is worth looking at the TechSoup Global Network which will point you to different countries' equivalent of the charity digital exchange.
https://www.techsoup.global/
https://www.techsoup.global/
I have a pro bono client that went through TechSoup. TS was generally very helpful and knew the MS product line, and so on. They added value.
Why do you have to purchase through some random other charity, instead of just buying direct from microsoft.com?
If the OP insists on not going down the O365 route (which will probably come with the same lack of guaranteed storage in the UK, which I believe is Brexit related as Google migrated my data out of the EU this year as well), the best recommendations I've seen as far as interop support actually goes is OnlyOffice combined with NextCloud.
I haven't used it myself, but a number of people on this forum have advised that it's got significantly better compatibility with MS Office than any of the other contenders.
This may have been in word processing only, however, and as the GP notes, spreadsheets and presentations add their own headaches.
I haven't used it myself, but a number of people on this forum have advised that it's got significantly better compatibility with MS Office than any of the other contenders.
This may have been in word processing only, however, and as the GP notes, spreadsheets and presentations add their own headaches.
I disagree, we use Office 365 and experience frequent information loss. You edit a document, you get visual feedback that is "Saved", then reload it and all your changes are gone.
It is also much slower compared to Google Docs, in terms of loading time and latency, and has an abundance of rendering glitches.
It is also much slower compared to Google Docs, in terms of loading time and latency, and has an abundance of rendering glitches.
[deleted]
UK registered charities get Office 365 for free. In my experience it’s currently the best choice.
I supported all the technical aspects of a friend’s charity in their early days. Originally set them up on Zoho for cheapness before they were a fully registered charity. Zoho worked but caused plenty of pain for their less computer proficient users (volunteers and trustees). The Zoho UX is very clunky and the team required a lot of support. Migration to Office 365 made everyone very happy because of the familiarity (everyone is used to it from work). The charity requires less support time now and no longer complain about Zoho’s limitations.
I supported all the technical aspects of a friend’s charity in their early days. Originally set them up on Zoho for cheapness before they were a fully registered charity. Zoho worked but caused plenty of pain for their less computer proficient users (volunteers and trustees). The Zoho UX is very clunky and the team required a lot of support. Migration to Office 365 made everyone very happy because of the familiarity (everyone is used to it from work). The charity requires less support time now and no longer complain about Zoho’s limitations.
Note that since 2018, Google does allow you keep your data in Europe, though not specifically in the UK:
https://support.google.com/a/answer/9223653?en
(Though this may involve upgrading to a paid business license for G Suite, if your partner is currently using the free charity tier.)
Just because of the headache involved in transferring, I'd ask her to check with legal again. It would be very unusual to require UK-based storage specifically.
If that truly is a requirement, then cloud storage is basically not an option. Just keep everything as Office documents on a local network hard drive and set up recurring backups to an off-site location (probably your partner's home).
https://support.google.com/a/answer/9223653?en
(Though this may involve upgrading to a paid business license for G Suite, if your partner is currently using the free charity tier.)
Just because of the headache involved in transferring, I'd ask her to check with legal again. It would be very unusual to require UK-based storage specifically.
If that truly is a requirement, then cloud storage is basically not an option. Just keep everything as Office documents on a local network hard drive and set up recurring backups to an off-site location (probably your partner's home).
> though not specifically in the UK
Since Google doesn't have any datacenters in the UK, Google clearly cannot guarantee that your data is stored there. In fact it is guaranteed that your data is not stored there.
https://www.google.com/about/datacenters/locations/
Since Google doesn't have any datacenters in the UK, Google clearly cannot guarantee that your data is stored there. In fact it is guaranteed that your data is not stored there.
https://www.google.com/about/datacenters/locations/
> It would be very unusual to require UK-based storage specifically.
Maybe not so unusual post brexit?
I'm not sure how UK domestic equivalent of GDPR ends up now and after re-negotiation with EU/EC?
ed: see also: https://news.ycombinator.com/item?id=24398861
Maybe not so unusual post brexit?
I'm not sure how UK domestic equivalent of GDPR ends up now and after re-negotiation with EU/EC?
ed: see also: https://news.ycombinator.com/item?id=24398861
The answer is pretty obvious - use a desktop based office suite. It's very hard for smaller players to compete with web apps like Google Apps and expect similar quality. With desktop apps you have full control. I would suggest looking into OpenOffice (or LibreOffice I guess), or simply just paying for Microsoft Office. Then you can use Office365 but download the apps and store files locally (or somewhere shared).
OpenOffice is not very well maintained, I would go with LibreOffice these days.
We have both at the office. I have found the opposite to be true. OpenOffice is able to open certain xlsx files where as LibreOffice cannot open them. I cannot just downloaded the latest versions. I am stuck with what is available on RHEL.
If your version of RHEL supports Flatpak, I would suggest using that (or the AppImage posted by someone else).
https://www.libreoffice.org/download/flatpak
Either way, the fact remains that the OpenOffice development community imploded and takes a long time to even fix security issues.
https://www.libreoffice.org/download/flatpak
Either way, the fact remains that the OpenOffice development community imploded and takes a long time to even fix security issues.
Do you mean you are not allowed to install the latest versions or that you are not allowed to download anything? If you can still download things you could give the LibreOffice AppImage[1] a try.
[1] https://www.libreoffice.org/download/appimage/
[1] https://www.libreoffice.org/download/appimage/
this would be absolutely amazing, given that AOO's OOXML support is rudimentary. Which version of each, and what precisely happens?
We recently moved our Office365 data to Uk.
https://docs.microsoft.com/en-us/microsoft-365/enterprise/mo...
Google apps are a good alternative to Office365 but we haven't found anything that matches Excel. We're a fintech so there's no way around excel. You'll also have to deal with users who are using excel files locally.
Google apps are a good alternative to Office365 but we haven't found anything that matches Excel. We're a fintech so there's no way around excel. You'll also have to deal with users who are using excel files locally.
Agree. Having an Excel, Powerpoint and Word license together with Storage is a killer feature. Mostly because I need it in the corp environment.
Microsoft seems generally very good at supporting data residency for their customers, didn’t know they have a UK Geo (never had to check but knew about the Swiss one) but it is 100% sensible for their customers.
[deleted]
Get a self hosted cloud like nextcloud and create accounts for each user. Nextcloud will allow you to expose directories as webdav shares which you can mount on each user's computer. Then just use desktop office suite like libre office to do all work that will be inherently saved online. Users will be able to share their documents freely between each other.
You will never the conveniences of the a paid powerhouse developed by thousands of people over the years, but for next to nothing cost and a little bit of effort you can be just as productive.
You will never the conveniences of the a paid powerhouse developed by thousands of people over the years, but for next to nothing cost and a little bit of effort you can be just as productive.
I am no expert but Nextcloud requires a bit of set up and maintenance. With the server exposed to the internet, shared folders and multiple users, you have to worry about security if you could be a target. You need more than one server for back up.
I would still suggest this approach; just saying it takes a bit of work.
I would still suggest this approach; just saying it takes a bit of work.
While it does take considerable effort to set it up in the beginning, maintenance later on, at least in my case, is next to nothing. Updates happen via single click from the Admin UI and only happen when you invoke them, at your convenience.
For security it does allow 2 factor auth and the admin account has all the tools to manage users and query what they have shared.
While it's not an enterprise solution... but for their use case, and with the amount of features it offers, i think it's something worth considering even with the non trivial initial setup tax.
For security it does allow 2 factor auth and the admin account has all the tools to manage users and query what they have shared.
While it's not an enterprise solution... but for their use case, and with the amount of features it offers, i think it's something worth considering even with the non trivial initial setup tax.
What would you say to a simpler system of having Subversion hosted in an office for sharing the docs and LibreOffice to edit them? No cloud, and it takes very little training to use SVN with a gui client.
This idea sounds viable from my point of view. Whatever OP finds best for their needs.
Why? O365 is free if she's a charity, look into tech-soup, which is the distributor for o365 for non profits.
Oh, GNU/emacs? Well, You can run your own OSS openoffice/sunoffice (whatever it's called nowadays) and file sharing but it's alot of work and not no maintenance.
site: https://www.techsoup.global/
Oh, GNU/emacs? Well, You can run your own OSS openoffice/sunoffice (whatever it's called nowadays) and file sharing but it's alot of work and not no maintenance.
site: https://www.techsoup.global/
> Her trustees are advising that since Google cannot guarantee that her data is being stored in the UK (apparently?), they need to migrate.
She should push back on that, since there is no legal basis for it (except in very specific circumstances).
It would be cheaper to get competent legal advice than do a shift like this for many offices.
She should push back on that, since there is no legal basis for it (except in very specific circumstances).
It would be cheaper to get competent legal advice than do a shift like this for many offices.
This is correct. Current legislation (GDPR and the UK's implementation in the 2018 Data Protection Act) does not require data to be stored in the UK. G Suite is definitely GDPR compliant, could the trustee be raising vague concerns without good cause (they do that). There are other reasons to switch from Google, but that's not one of them.
Is the UK still bound to the GDPR though (considering Brexit) ?
Yes it was copied and pasted into UK law (along with local tweaks) as the Data Protection Act 2018.
Yes. GDPR is the EU regulation, but member countries incorporated it into their domestic legislation. In the UK that's the Data Protection Act 2018.
To remove GDPR from the UK we'd have to change the data protection act.
To remove GDPR from the UK we'd have to change the data protection act.
Do you know if the Brexit would invalidate the act?
I am not an expert on UK Law but I also wondered if it is possible that the reference on the GDPR would still be valid
I am not an expert on UK Law but I also wondered if it is possible that the reference on the GDPR would still be valid
At that point the UK could revoke or change the law. But it wouldn't automatically vanish.
No, brexit will not invalidate the act. It's now UK law.
Thanks for the clarification; most EU countries just made some kind of diff to the GDPR and did not make it an explicit law
Regulations are laws that directly apply across EU, unlike directives (which bind member states to make a law that achieves the goals of the directive).
https://en.wikipedia.org/wiki/Regulation_(European_Union)#De...
So you can make legislation around a Regulation but can't override its effects.
https://en.wikipedia.org/wiki/Regulation_(European_Union)#De...
So you can make legislation around a Regulation but can't override its effects.
The Data Protection Act 2018 enacts the EU GDPR requirements in UK law, which will become the UK GDPR after 31 December 2020. So, technically no, but in practice, yes.
At least till the end of the year. They have an act that states the GDPR as applicable in the UK. Not sure if this will hold after the Brexit but could as well be.
AIUI Chapter V requires that, eg deletion, needs to be achievable under a binding and enforceable contract when data is outside the EEA.
Is that possible with companies in USA? How?
Is that possible with companies in USA? How?
Agree, before changing office suite try changing adviser
Pretty hard to change the trustee of a UK charity. https://www.gov.uk/guidance/charity-trustee-whats-involved
> Trustees have overall control of a charity and are responsible for making sure it’s doing what it was set up to do. They may be known by other titles, such as:
> Trustees use their skills and experience to support their charities, helping them achieve their aims. Trustees also often learn new skills during their time on the board.
> Trustees have overall control of a charity and are responsible for making sure it’s doing what it was set up to do. They may be known by other titles, such as:
directors
board members
governors
committee members
> Trustees use their skills and experience to support their charities, helping them achieve their aims. Trustees also often learn new skills during their time on the board.
Legal basis is the GDPR, however it's possible to use services outside the UK/EU if similar data protection is possible. For the US this is not the case, at least this is the ruling of the CJEU. Google would have to provide additional guarantees to protect the data.
The case is identical for Microsoft 365.
I would advice for Nextcloud and Onlyoffice. If you are hardcore data protection.
I would advice for Nextcloud and Onlyoffice. If you are hardcore data protection.
Google allows you to choose to have your gsuite data stored in the EU.
Thus is true for some SKUs, but not for nonprofit version. Must be Business, Enterprise or Essentials I believe.https://support.google.com/a/answer/7630496?hl=en
Besides the G Suite for Nonprofits Google also makes available G Suite for Nonprofits Business and G Suite for Nonprofits Enterprise which are actually just discounts on the regular Business and Enterprise products rather than the distinct G Suite for Nonprofits. I believe with these you can select the location of data storage.
Even if the data is stored in the EU, Google (or Microsoft for that matter) does not guarantee that data cannot be accessed from the US. That makes sense, since most of their operating staff is probably based in the US, but does mean that it is not GDPR-compliant, no matter what Google says about that. Google states that they are using the SCCs now Privacy Shield has been invalidated, but as Google US is an entity under reach of FISA I highly doubt that they can provide the necessary safeguards required under the GDPR and the SCCs.
"GDPR requires [blank]" is the new "HIPPA requires [blank]" and "FIPS requires [blank]" and in the case of all three these statements are often/usually/always wrong.
She'd probably prefer this route the most, since she'd ideally not have to move (the FSF-member in me be damned). Is this really a myth? I've heard of so many local councils and other public organisations flocking to Office365 for 'reasons of GDPR'.
> 'reasons of GDPR'
This joins a long list of bullshit reasons to do things, that often isn't based in understanding of what The Thing is actually requiring.
"Computer says no", "health and safety", "more than my jobsworth", "data protection", "safeguarding", "the regulator says", etc etc etc.
This joins a long list of bullshit reasons to do things, that often isn't based in understanding of what The Thing is actually requiring.
"Computer says no", "health and safety", "more than my jobsworth", "data protection", "safeguarding", "the regulator says", etc etc etc.
Urgh I'm currently battling migrating a large SASS app from GCP to Azure for these same non reasons.
Office365 is not a solution under GDPR.
I am in touch with other DPOs and our federal dpos - the big elefant in the room is Microsoft and Windows 10. Everybody knows that you can't use it if you follow the GDPR or at least you have to jump so many loops that it is practical impossible.
The federal DPOs advice against Teams and OneDrive so Microsoft gets the message but if the CJEU looks at Windows from a GDPR perspective Everybody had to stop using it.
I am in touch with other DPOs and our federal dpos - the big elefant in the room is Microsoft and Windows 10. Everybody knows that you can't use it if you follow the GDPR or at least you have to jump so many loops that it is practical impossible.
The federal DPOs advice against Teams and OneDrive so Microsoft gets the message but if the CJEU looks at Windows from a GDPR perspective Everybody had to stop using it.
Could you clarify what the issue with Microsoft and Windows 10 is? I have no reason to doubt you, I would just genuinely like to know what to look out for.
If you use Windows 10 you accept the Terms and Services [0]. This also includes the Data Processing Addendum. So there is a legal basis for Microsoft to send Data to the US. Since Microsoft falls under FISA it has to give data to the authorities with no chance to appeal for the data subject. This violates the GDPR.
Ok this is the legal stuff.
Here is the technical stuff [1]. In short: Windows 10 sends all kind of data including whole documents to Microsoft USA and you can't stop it using the OS but have to apply Firewall rules and DPI.
So if you really want to use Microsoft you have to make a Data protection impact assessment for each new version of windows 10. I know no one who does this. But if you ask the federal dpo they will tell you that they can't say if you can use windows 10 for this or that but you should asses it yourself using a data protection impact assessment.
I just hope nobody will ever touch this sticky ball
[0]https://www.microsoft.com/en-us/licensing/product-licensing/...
[1]https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
Ok this is the legal stuff.
Here is the technical stuff [1]. In short: Windows 10 sends all kind of data including whole documents to Microsoft USA and you can't stop it using the OS but have to apply Firewall rules and DPI.
So if you really want to use Microsoft you have to make a Data protection impact assessment for each new version of windows 10. I know no one who does this. But if you ask the federal dpo they will tell you that they can't say if you can use windows 10 for this or that but you should asses it yourself using a data protection impact assessment.
I just hope nobody will ever touch this sticky ball
[0]https://www.microsoft.com/en-us/licensing/product-licensing/...
[1]https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
There is an explicit exemption in the GPDR for law enforcement and national security. See https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
EU Law Enforcment and EU national security and it has to be comliant with basic human rights.
In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
This is incorrect.
Windows is GDPR compliant. See section 3 of https://docs.microsoft.com/en-us/windows/privacy/windows-10-...
GRDP compliance isn't too bad for a company like Microsoft who has decent data auditing ability. It's pretty easy for them to give you your windows data and delete it if required, and that's what is required for basic GRDP compliance.
If there is public advice otherwise a citation would be useful.
Note that your subsequent comment claiming that FISA request make GPDR compliance impossible is also incorrect as they are explicitly excluded (as law enforcement) by the GPDR: https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
Windows is GDPR compliant. See section 3 of https://docs.microsoft.com/en-us/windows/privacy/windows-10-...
GRDP compliance isn't too bad for a company like Microsoft who has decent data auditing ability. It's pretty easy for them to give you your windows data and delete it if required, and that's what is required for basic GRDP compliance.
If there is public advice otherwise a citation would be useful.
Note that your subsequent comment claiming that FISA request make GPDR compliance impossible is also incorrect as they are explicitly excluded (as law enforcement) by the GPDR: https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
So Microsoft states itself compliant? Ok...
Official citation:
Dutch DPA
https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr...
THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights:
In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
Official citation:
Dutch DPA
https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr...
THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights:
In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
From an update on the very same site:
"Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation."
https://autoriteitpersoonsgegevens.nl/en/news/privacy-window...
"In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.
"Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation."
https://autoriteitpersoonsgegevens.nl/en/news/privacy-window...
"In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.
This is true for all US basee Companies who fall under FISA not just Microsoft.
As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied.
I have more citations and also newer but they are in German.
Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stel...
Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/...
And on the technical side:
https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller.
Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service.
Thats the consequence from the CJEU ruling.
As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied.
I have more citations and also newer but they are in German.
Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stel...
Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/...
And on the technical side:
https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller.
Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service.
Thats the consequence from the CJEU ruling.
I didn't read all these and I don't speak German but the gist of https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... is close to the opposite of what you claim.
It says they will allow the use of Office 365 in schools.
It says they will allow the use of Office 365 in schools.
Yeah sorry for the german sources.
It's not as much as allow but tollerate if certain prerequirements are met e.g. not sending any diagnosis data to Microsoft. And it sounds more like they are somewhat pressured into it. Intensive talks...
It's not as much as allow but tollerate if certain prerequirements are met e.g. not sending any diagnosis data to Microsoft. And it sounds more like they are somewhat pressured into it. Intensive talks...
In [next|own]cloud you can install libreoffice online and have a sheets/documents/presentation with online editing.
Yep, it is called Collabora Online Development Edition (CODE). Here's the website [1] which also contains installation instructions.
[1] https://www.libreoffice.org/download/libreoffice-online/
[1] https://www.libreoffice.org/download/libreoffice-online/
You'll have to check with their support about how the location is selected, but https://zoho.eu exists and I'm happy with their services.
I'd check the specific requirements though. Even DPA doesn't really require hosting in the UK, but UK or country with matching privacy requirements, which in most cases means whole EU is ok.
I'd check the specific requirements though. Even DPA doesn't really require hosting in the UK, but UK or country with matching privacy requirements, which in most cases means whole EU is ok.
I work at Zoho. I can confirm, all accounts signed-up at https://zoho.eu have their data stored within Europe and complies with GDPR.
Good idea, will scope Zoho out
https://www.collaboraoffice.com/collabora-online/
not related to them, not even a user.
not related to them, not even a user.
I've been using Kolab [0] for years for self hosting the email, calendar and tasks. There is an official integration with Seafile which gives you a "Google Drive"/"One Drive" experience (you can also integrate it with NextCloud), while recently there's been Libre Office integration available which gives you word processing, spreadsheets and presentations in your browser; I'm also using it.
The overall experience is not as smooth as with Google or MS, but I do have Exchange protocol, file storage with management and online document editing and it works.
First time it took me almost two weeks to setup everything, but I've been doing the same setup for my friends, for their small to mid sized companies for less than a week.
Their main website is not managed well but they have a pretty active development community, very useful mailing list (you can browse the archive) and somewhat dated documentation but the changes are not that hard to figure out.
Once everything is set, the update process and maintenance are almost automatic through the native linux package manager.
[0] https://www.kolab.org/
The overall experience is not as smooth as with Google or MS, but I do have Exchange protocol, file storage with management and online document editing and it works.
First time it took me almost two weeks to setup everything, but I've been doing the same setup for my friends, for their small to mid sized companies for less than a week.
Their main website is not managed well but they have a pretty active development community, very useful mailing list (you can browse the archive) and somewhat dated documentation but the changes are not that hard to figure out.
Once everything is set, the update process and maintenance are almost automatic through the native linux package manager.
[0] https://www.kolab.org/
I worked IT for a small org one summer that used the Synology suite for all their internal operations. It is basically a self hosted completely OOTB clone of Google Drive, Docs, Gmail, etc I now use it personal stuff as well.
Pros:
- All the creature comforts of mainstream suites such as realtime collaboration, comments, history, etc.
- 2-way compatible with Office and Google so you can import docs to and from those suites.
- Encrypted document support
- Self hosted
Cons:
- Requires you to own a synology NAS to host it.
https://www.synology.com/en-us/dsm/feature/office
https://www.synology.com/en-us/dsm/feature/mailplus
https://www.synology.com/en-us/dsm/feature/drive
Pros:
- All the creature comforts of mainstream suites such as realtime collaboration, comments, history, etc.
- 2-way compatible with Office and Google so you can import docs to and from those suites.
- Encrypted document support
- Self hosted
Cons:
- Requires you to own a synology NAS to host it.
https://www.synology.com/en-us/dsm/feature/office
https://www.synology.com/en-us/dsm/feature/mailplus
https://www.synology.com/en-us/dsm/feature/drive
I had a buddy that has a Synology NAS and he runs a DB server on it... it's horribly slow. Speed-wise how do these compare? It may not be an apples-to-apples comparison, but it was unbelievably slow even for small operations.
It depends on your NAS processor. I have the cheapest one drive Synology at home, it's unbearably slow. At work I bought a faster one and it's OK.
As the user rootsudo mentioned, you might be able to use O365 for free if its a small charity.
https://www.microsoft.com/en-us/microsoft-365/nonprofit/offi...
https://www.microsoft.com/en-us/nonprofits/eligibility
You can create an account and upload the documentation https://nonprofit.microsoft.com/en-us/getting-started
https://www.microsoft.com/en-us/microsoft-365/nonprofit/offi...
https://www.microsoft.com/en-us/nonprofits/eligibility
You can create an account and upload the documentation https://nonprofit.microsoft.com/en-us/getting-started
I believe charities can use G Suite for free, plus I know for sure there is a setting where you can tell them to store your data in the EU, US or no preference. However I don't believe there's a way to tell them to use the UK specifically.
Libre, apache, onlyoffice, google, microsoft and someone mentioned zoho. So many players in the market. Wonder if there's a player that can complete with the likes of office365's feature set .
https://degooglisons-internet.org/en/list/
I guess, they are in France though.
There's OpenAppStack https://openappstack.net/ . It is currently in beta but very promising.
ProtonDrive coming soon: https://protonmail.com/blog/protondrive-security/
It sounds like this charity is looking for an entire software suite (spreadsheets, documents, etc) not just email and cloud storage.
I'm not sure if this meets all your needs around data sovereignty, but Quip is an alternative that does collaboratively-edited documents.
I'm not sure what features nextcloud has, but mailinabox.email does have it as well as email and is very easy to manage. You're going to need someone who can run the updates, but other then that I've been using it for the last 5 years and it has been VERY easy to keep running.
I'm running ours on a $10 DigitalOcean box.
I'm running ours on a $10 DigitalOcean box.
Thanks! I found this helpful.
To anyone else also just learning about Mail-in-a-Box:
“Mail-in-a-Box is based on Postfix, Dovecot, Z-Push, Roundcube, Nextcloud, Apache SpamAssassin, Postgrey, Nginx, @konklone’s nginx config, and more.”
To anyone else also just learning about Mail-in-a-Box:
“Mail-in-a-Box is based on Postfix, Dovecot, Z-Push, Roundcube, Nextcloud, Apache SpamAssassin, Postgrey, Nginx, @konklone’s nginx config, and more.”
Check PrivacyTools.io's recommendations.[1] Disclosure, I'm a team member there.
1. https://www.privacytools.io/software/productivity/
1. https://www.privacytools.io/software/productivity/
nextcloud with onlyoffice
Regardless of where the servers are located, I would worry about a company such as google having access to the data (that is not end to end encrypted).
Google is FedRAMP compliant, however if you need to make sure it is encrypted then that is what rclone is for. You could setup an rclone encrypted mount and then share it on the local network.
Trustees are not usually experts in data protection law, so I'd ask the trustees to be providing a lot more information. At a minimum they need to explain:
1) What law they think is being broken (and they need to actually link the specific clause)
2) Why they think G Suite is breaking it (and they need to describe that breach in terms of the law they think is being broken).
3) How much they're prepared to spend on changing from G Suite to something else, including costs of migrating data, checking it's correct after migration, re-training, and any possible software and support costs.
G Suite claims it's GDPR compliant. https://cloud.google.com/security/gdpr
1) What law they think is being broken (and they need to actually link the specific clause)
2) Why they think G Suite is breaking it (and they need to describe that breach in terms of the law they think is being broken).
3) How much they're prepared to spend on changing from G Suite to something else, including costs of migrating data, checking it's correct after migration, re-training, and any possible software and support costs.
G Suite claims it's GDPR compliant. https://cloud.google.com/security/gdpr
They are probably thinking about brexit and the UK data protection act - but this shouldn’t need any action since UK GDPR has an amendment which recognises EU data protection standards as adequate for the UK.
I recommend Zoho. Less expensive and great quality.
Less expensive? Could you please elaborate? I looked at their website and there is no pricing at all. Only 'Contact sales'. Even the 'sign up for free' does not explain what I could possibly get 'for free'. If they are cheaper than it would beneficial to them to write that in a headline ;-)
Pricing: https://www.zoho.com/one/pricing/
Plan Details: https://www.zoho.com/one/plan-details.html
I am not affiliated to them.
Plan Details: https://www.zoho.com/one/plan-details.html
I am not affiliated to them.
Heard good things about https://www.zoho.com/
Amazon WorkDocs and WorkMail
I recommend considering AirTable if the group is willing to try something new or check out:
Notes + PM -> notion.so
Word -> notion.so
PowerPoint -> slidebean.com or pitch.com
Excel/Access -> still AirTable
Outlook -> amazing email UX via hey.com for $99/year
I got many of these via alternativeto.net and producthunt.com
Notes + PM -> notion.so
Word -> notion.so
PowerPoint -> slidebean.com or pitch.com
Excel/Access -> still AirTable
Outlook -> amazing email UX via hey.com for $99/year
I got many of these via alternativeto.net and producthunt.com
iCloud.