body: **Background:** I'm considering building a web (focused to Europe) which, for one of it's part, would require users to upload their university diplomas and/or other similar certificates of achieved education. These would be visible only to other users of the said web.
  
  
  My **first question** is: Are such documents considered sensitive under GDPR? 
  
  
  My **second question**: Usually, there are names and signatures of 3rd party on the certificates (e.g dean's name and signature on university diploma). Is user even legally allowed to scan such document and upload it on the web? Wouldn't that require to have consent of the said 3'rd party? Would these need to be redacted?
  
  
  I've tried searching the GDPR guidelines, but I'm uncertain. I presume that I would need to ensure that I have consent from the users to store and show the documents on the web and ensure that these are deleted when user deletes the his/her profile.
  
  
  From what I've read, it seems to me that, given the registration is completely voluntary, that it should be OK. But I feel that it might not be that simple.
  
  
  Thank you
  
  
  
title: University diploma / various certificates under GDPR