GDPR-Compliant Hosting: What European Businesses Need to Know

Choosing a hosting provider is a data protection decision as much as a technical one. Every time a visitor loads a page, submits a form, or logs in to a shop account, the host handles personal data on the business's behalf, and the business stays answerable for how that handling goes.

Who is responsible for what

The regulation divides responsibility into two roles. The business running the website is the controller, which decides why and how visitors' data is used. The hosting company is a processor, which handles that data on the controller's instructions. Outsourcing the servers does not outsource accountability, so a host's habits become the customer's problem the moment something goes wrong.

"GDPR-compliant hosting" is a description that providers apply to themselves, because no single certificate proves it. Formal certification schemes exist under the regulation but have seen little uptake, so buyers rely on proxies such as an ISO 27001 certificate, a signed processing contract and plain statements about where servers sit. The company behind hosting.de web hosting follows that pattern, describing its offer as GDPR-compliant and ISO 27001 certified, with German data centers and optional daily backups on its plans.

The scope is wider than most site owners assume. Contact forms, order histories, mailboxes, and server logs all hold personal data on a host's machines. Even a brochure site without logins records visitors' IP addresses in its access logs, and European case law treats many of those addresses as personal data.

What the contract has to say

Article 28 of Regulation (EU) 2016/679 requires a written agreement between controller and processor. The agreement has to describe what data is processed, for what purpose and for how long. It must bind the host to act only on documented instructions, require confidentiality from everyone with access, commit the host to appropriate security measures and oblige it to delete or return the data when the contract ends. The host must also support audits and inspections by the controller and warn it if an instruction would break data protection law.

Sub-processors deserve extra attention. A host may rely on separate companies for backups, DDoS filtering, mail delivery or out-of-hours support, and each of them can see data. The processor needs the customer's authorization, either for a named company or in general terms with a right to object, and must pass the same obligations down the chain. Ask for the current list and for advance notice when it changes.

The penalties explain why lawyers insist on the paperwork. Breaches of processor obligations such as Article 28 fall into the lower tier, with fines of up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. Violations of the core principles, data subject rights or the transfer rules reach up to 20 million euros or 4 percent. Fines are ceilings rather than tariffs, and supervisory authorities weigh the nature, duration and gravity of an infringement, so a small shop with a signed contract is in a very different position from one without.

Where the servers sit and who can reach them

Chapter V of the regulation allows personal data to leave the European Economic Area only under specific conditions, such as an adequacy decision by the European Commission, standard contractual clauses or binding corporate rules. A host with data centers inside the EU removes that question for the hosting layer, although it stays open for any plugin, analytics tool or email service that sends data elsewhere, and for support staff outside the EU who can view customer systems.

Location alone does not settle the matter. A data center in Frankfurt owned by a US group can still receive requests from American authorities under the CLOUD Act, which is why careful buyers check ownership as well as geography. The Court of Justice struck down the Privacy Shield in the 2020 Schrems II ruling. The Commission adopted a successor, the EU-US Data Privacy Framework, in July 2023, but it has faced legal challenges, and teams that depend on it usually document a fallback.

Security measures auditors ask about

Article 32 requires measures that are appropriate to the risk, and it names examples including encryption, the ability to restore availability and access after an incident, and regular testing of the measures themselves. In practice, auditors ask for encrypted connections on every site, tested restores of backups rather than backups alone, patch routines for server software and a record of who has administrative access. Pseudonymisation also appears on the list, though for a hosting contract the practical items are encryption, patching and access control.

Breach handling matters just as much. A controller has to notify the supervisory authority within 72 hours of becoming aware of a personal data breach, and a processor must tell the controller without undue delay. A host with a published emergency contact and round-the-clock monitoring gives the customer a fighting chance of meeting that deadline. One that answers tickets within two business days may not.

Backups create a quiet conflict with deletion requests. When a customer asks for their data to be erased, copies in backup sets linger until the retention period ends, so the retention period belongs in the processing contract rather than in a support FAQ.

Logs deserve a mention as well. Access logs and audit trails help reconstruct who touched what after an incident, but they also contain personal data, so their retention should be limited and written down.

Questions to put to a host before signing

Six questions are worth putting to any provider in writing, and the answers should go into the same folder as the processing contract.

• Where exactly are the servers and backups located, and which company operates the data center?
• Which sub-processors will touch our data, and how much notice do we get of changes?
• Is a processing agreement under Article 28 included, and can we countersign it before the first invoice?
• Which security certifications cover the hosting platform, and when was the last external audit?
• How long are backups kept, and how are they deleted when we terminate?
• Who do we contact at three in the morning if we suspect a breach?

Vague answers carry information too. A reply such as "we take security seriously" without a named certificate or audit date is a reason to keep looking, while an answer that names the auditor, the scope of the certificate, and the sub-processor list suggests the provider has done the work.

Supervisory authorities tend to ask for documentation after an incident, not before one. A host that answers these questions in a few sentences each, without redirecting to a sales call, is usually one that has been asked them before.