GDPR-Compliant Hosting: The 2026 Checklist

What GDPR Actually Requires From Your Host

The General Data Protection Regulation treats your host as a data processor — they process personal data on your behalf. That imposes specific duties on them, and specific duties on you when you choose them.

From your host you need, at minimum:

• A signed Article 28 Data Processing Agreement
• Documentation of where data is stored and processed
• A current list of sub-processors (Article 28(2))
• Technical and organizational measures (Article 32) — encryption, access control, redundancy
• Breach notification capability fast enough to meet your 72-hour duty (Article 33)
• Support for data subject rights requests (export, delete)

If a host can't check all six boxes, you're taking on compliance risk that should live with them.

The Data Processing Agreement (DPA)

A DPA is a contract between you (controller) and your host (processor) that says: here's what data you're processing, here's what you're allowed to do with it, here's how we handle incidents. Without one, you're technically non-compliant the moment an EU resident uses your site.

Red flags in a DPA:

• Host reserves the right to process data for "service improvement" or "analytics" with no opt-out
• No sub-processor list or it's "available on request" with no update notifications
• Breach notification timeline is "as soon as practical" (should be hours, not days)
• Governing law is a non-adequacy country with no supplementary measures clause

Good DPAs follow the EU Standard Contractual Clauses and spell everything out. Our DPA is one click to download and sign.

Data Residency and Schrems II

Schrems II (2020) invalidated the EU–US Privacy Shield. The practical consequence: if your processor is US-owned or subject to US surveillance law (FISA 702, EO 12333), you need supplementary measures — typically encryption where the processor doesn't hold the key, plus a Transfer Impact Assessment.

For an SMB, the cost of doing Schrems II properly (legal review + technical measures) exceeds the cost of just picking an EU-owned host. Germany and the Netherlands are both safe bets; we run in Germany.

The European Data Protection Board maintains recommendations on supplementary measures if you want to go down that path.

Sub-Processors and Chain of Custody

Your host has vendors — CDN, DNS, monitoring, backup storage, email relay. Each is a sub-processor of your data. GDPR Article 28(2) says you need to know who they are and get notified when the list changes.

Common sub-processor categories:

• CDN — Cloudflare, BunnyCDN, Fastly. Check where their edge caches EU traffic.
• Backup storage — often S3 or Backblaze B2. Jurisdiction matters.
• Monitoring — Datadog, Grafana Cloud, New Relic. Most are US-owned.
• Transactional email — Postmark, SendGrid. Where do they send from?

Our sub-processor page lists every vendor, jurisdiction, and what data they see. If we add one, existing customers get 30 days notice before it goes live.

Encryption, Backups, and Access Logs

Article 32 requires "appropriate technical and organizational measures." In practice that means:

• TLS everywhere — free Let's Encrypt certificates, HSTS, TLS 1.2+ only
• Encryption at rest — full-disk encryption (LUKS) on the hosting nodes and backup targets
• Access logs — who touched what, kept long enough to investigate an incident
• Principle of least privilege — support staff shouldn't have standing access to customer data
• Backup isolation — backups in a different failure domain, ideally different jurisdiction within the EU

None of this is exotic in 2026. Any host selling to EU businesses should have it. If they don't advertise it, ask.

Breach Notification (The 72-Hour Rule)

If there's a personal-data breach, you have 72 hours to notify your supervisory authority. That clock is tight — it includes weekends.

For you to meet that deadline, your host has to notify you much faster. Our DPA requires notification within 24 hours of confirmed incident. That leaves you 48 hours to assess scope, draft the notification, and file it.

Ask a prospective host: "What's your incident response SLA under the DPA?" If the answer is vague, that's your answer.

The Full Checklist

Print this, take it to your host, require check marks:

Article 28 DPA signed and counter-signed

Not "available" — actually executed.

Data residency documented

Primary: EU or adequacy country. Backups: same or explicit cross-border SCC.

Sub-processor list published

With jurisdiction for each and change-notification mechanism.

TLS + at-rest encryption

TLS 1.2+, HSTS, LUKS or equivalent on all storage.

Access controls documented

SSO, MFA for staff, least-privilege, audit log.

Breach notification SLA ≤ 24h

Written into the DPA, not a vague promise.

Backup tested + restorable

A backup you can't restore isn't a backup.

Data subject rights supported

Export, delete, portability — your host should give you tools, not manual tickets.

Transparency report published

Annual numbers on lawful access requests and how they were handled.

Nine checks. Most hosts fail three or more. The ones that pass all nine are the ones you can sell to enterprise EU customers without a 6-month legal review.