GDPR and web hosting: why it matters where your data is stored

Personal data is any information that can identify a person. On a typical website it shows up in more places than people expect:

• Contact forms: names, email addresses and the messages people send.
• Orders and accounts: addresses, phone numbers and purchase history in a web shop.
• Server logs: IP addresses and timestamps for every visit.
• Newsletters: subscriber lists and records of consent.

All of it is stored on your hosting server and in its backups. That is why your choice of host is part of your GDPR work.

As the website owner you are the controller: you decide which data is collected and why. Your hosting provider stores that data for you, which makes it a processor.

The GDPR requires a written data processing agreement (DPA) between the two. It states that the host only processes the data on your instructions, keeps it secure, helps you with data-subject requests and tells you about breaches. A serious host includes these terms in its contract or policies, so you don’t have to negotiate them yourself.

Inside the EU and EEA, personal data moves freely. Sending it to a country outside the EEA needs a legal basis, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

Transfers to the United States have a history of uncertainty. The EU Court of Justice struck down the Safe Harbor framework in 2015 and its successor, Privacy Shield, in 2020 (the “Schrems II” ruling). Since 2023 the EU–US Data Privacy Framework covers certified US companies, but it is the third attempt, and US laws such as the CLOUD Act can still give US authorities access to data held by US companies.

Hosting your website and its data inside the EU avoids the question entirely. That is why many businesses choose an EU host, even when the law would allow something else.

• Backups: a backup is a full copy of your personal data. Ask where backups are stored and for how long. They should follow the same rules as the live site.
• Analytics, fonts and chat: tools loaded from other companies’ servers can send visitors’ IP addresses outside the EU. Self-host fonts where you can and list every tool in your privacy policy.
• Cookie consent: non-essential cookies, such as analytics or marketing cookies, need consent before they are set. Rejecting must be as easy as accepting.

1. 1Data location: the servers and the backups are in the EU or EEA.
2. 2Processor terms: a data processing agreement is included or available.
3. 3Security: SSL certificates, regular updates and daily backups are standard.
4. 4Breach notification: the host commits to telling you without undue delay.
5. 5Deletion: your data is deleted when you leave, except what the law requires them to keep.
6. 6Support you understand: you can ask questions in a language you are comfortable with.

This guide is general information, not legal advice. For questions about your own situation, ask a lawyer or your national data protection authority.

At 2-Host your website, email and backups are stored in a Tier-3 datacenter in the EU and stay in the EU. Our processor terms, which act as the data processing agreement, are part of our privacy policy. Every web hosting plan includes daily backups and free SSL, and our support answers in English, Swedish and Arabic.