Where your website's data lives: EU hosting and GDPR

Your website's data doesn't live only on the hosting server. Contact form messages, backups, email, analytics, chat and payments can pass through different companies in different countries. GDPR doesn't require all of it to stay in the EU, but it does require you to know where it is, to have a contract with every provider that processes it for you and, for anything that leaves the EU, a legal basis for the transfer.

What data a website actually has

Even a simple business website has more moving parts than it seems:

Step one is writing this list for your own site, with the provider and country for each part. It usually takes an hour and answers half the questions.

What GDPR requires, briefly

For every provider that processes personal data on your behalf (hosting, email, backups, chat), Article 28 of GDPR requires a contract. In it, the provider commits, among other things, to process the data only on your documented instructions, to take the security measures in Article 32, to delete or return the data at the end, and to give you the information you need to show the rules are being followed.

Most large providers already have this contract as an annex to their terms, often called a DPA (data processing agreement). Download it and keep it on file.

For data that leaves the EU, Chapter V of GDPR applies (Articles 44 to 46). A transfer is allowed if the European Commission has decided that the country offers an adequate level of protection or, without such a decision, if appropriate safeguards are in place, such as standard contractual clauses.

And your site's privacy policy has to tell visitors who receives their data and whether it leaves the EU (Article 13).

The US: what has changed since 2020

Many hosting, email and analytics providers are American companies, so the question comes up a lot.

• In July 2020, the Court of Justice of the EU struck down Privacy Shield, the mechanism used until then for transfers to the US (case C-311/18, known as Schrems II).
• On July 10, 2023, the European Commission adopted a new adequacy decision for the EU-U.S. Data Privacy Framework. Since then, data can flow to US companies that participate in the framework without additional safeguards. The framework is administered by the US Department of Commerce and reviewed periodically by the Commission.

In practice: if a provider is based in the US, ask whether it participates in the framework. If it doesn't, the transfer needs another basis, usually standard contractual clauses.

EU hosting: when it's worth it

Hosting with servers and backups in the EU makes things much simpler: your site's most important data doesn't leave the Union, and you have fewer transfers to explain in your privacy policy. For a site with forms, customer accounts or orders, it's what we recommend.

Two questions to ask the provider either way:

1. Where are the backups kept? Sometimes the server is in the EU and the backups are somewhere else.
2. Where does the technical support team that can access the server work from?

Check the other parts (email, analytics, fonts) separately. An EU-hosted site that loads fonts and scripts from five outside providers still sends IP addresses to five places. Where possible, serve fonts and scripts from the same server as the site.

Checklist

1. Write down your providers: hosting, backups, email, analytics, chat, maps, fonts, payments.
2. Note each provider's country and where the backups are stored.
3. Download the data processing agreement from each one.
4. For providers outside the EU, check the basis for the transfer: an adequacy decision (for the US, participation in the framework) or standard contractual clauses.
5. Update your privacy policy with the providers and transfers.
6. Once a year, try restoring from a backup so you know it works.

We covered the basics of domains and hosting in our article on domains, hosting and HTTPS, and analytics and consent in our piece on cookie banners. If you'd like to go through the list for your site together, see our Web Design services page.