If you've heard the term "GDPR-compliant hosting," the most important document behind it is actually this:
Data Processing Agreement (DPA) — a Data Processing Agreement.
Many companies believe they are GDPR-compliant, yet they aren't — because they have never signed a DPA with their hosting provider.
1. What Is a DPA?
A DPA (Data Processing Agreement) is a contract between the party that processes personal data and the party that owns the data.
| Role | Who |
|---|---|
| Data Controller | You |
| Data Processor | Your hosting provider |
Under GDPR Article 28, this agreement is mandatory.
2. Is a DPA Required?
If your hosting provider can access any of the following:
- Names
- Email addresses
- IP addresses
- Order information
- User accounts
The answer is: Yes, it is mandatory
3. What Happens Without a DPA?
- GDPR non-compliance
- Liability in the event of a data breach
- Financial penalties
GDPR fines: Can reach up to 4% of annual company turnover.
4. Mandatory Clauses in a DPA
| Clause | Explanation |
|---|---|
| Data processed only on instructions | Hosting provider cannot use the data |
| Confidentiality | No unauthorized access |
| Security measures | Encryption, access controls |
| Sub-processor list | List of sub-contractors |
| Data breach notification | Within 72 hours |
| Data deletion | At the end of the contract |
| Right to audit | Audit rights |
| Data location | Where data is stored |
5. What Is a Sub-processor?
Your hosting provider may use the following services:
- Data centres
- CDN
- Backup
- Email services
These are called sub-processors and must be listed.
6. If Data Leaves the EU
For transfers of data outside the EU: SCC (Standard Contractual Clauses) are required.
7. Hosting Selection Checklist
- Is there a DPA?
- Is data stored within the EU?
- Is there a sub-processor list?
- Is there a data breach notification clause?
- Is there a data deletion policy?
- Are SCCs provided?
8. The Biggest Misconception
Wrong: "The server is in the EU, so GDPR is covered."
Correct: Without a DPA, there is no GDPR compliance.
9. Conclusion
For GDPR compliance:
- A DPA is essential
- Data location matters
- Hosting alone is not enough
The most critical statement:
There is no such thing as "GDPR-compliant hosting." There is only a GDPR-compliant contract.