Guide
Before you upload a bank statement to a converter
Updated
This is a thirty second decision that almost nobody makes, because the upload box is right there and the question only presents itself afterwards.
What a statement reveals
Income and its source. Home address. Where you shop, travel and eat. Subscriptions, which reveal politics, religion and health. Payments to and from named individuals, which reveal relationships. Debt and its direction.
It is among the most complete pictures of a person available in a single document, which is why the question of where it goes is worth thirty seconds.
What the upload is
If the statement contains personal data and you upload it to a service to convert, that service processes personal data on your behalf. That makes it a processor and you the controller.
UK GDPR Article 28 requires that processing to be governed by a contract binding on the processor, setting out the subject matter and duration of the processing, its nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. A free site reached through a search result generally has none of that in place.
The question terms pages rarely answer
Where is the file stored, in which country, for how long, who inside the company can read it, and is it used for anything other than your conversion.
A service that answers all five clearly is a different proposition from one that does not, and the difference is visible in about a minute of reading.
The alternative that removes the question
Convert locally. Desktop tools do this offline, on a machine you already control, and the spreadsheet you are converting into is on that machine anyway.
For a business, use a service the organisation already has a data processing agreement with. The test to apply is the plain one: if you would not email this file to a stranger, do not upload it to one.