This article is general information, not legal advice.
In short: Hosting doesn't become GDPR-compliant just because the server is in Germany. What matters is a data processing agreement (DPA) under Art. 28 GDPR, appropriate technical and organisational measures, transparent sub-processors and a legal basis for every transfer outside the EU. A German server location makes many things easier, but it doesn't replace these points.
Does my hosting have to be in Germany?
No. The GDPR applies across the EU and the European Economic Area. A server in France, the Netherlands or Finland is no worse in data-protection terms than one in Germany. It gets more complicated with providers or service partners outside the EU, for example in the US: every transfer then needs its own legal basis, such as an adequacy decision or standard contractual clauses.
A German location still has practical advantages: German contract law, German-speaking contacts and an easier explanation for your own customers.
1. The data processing agreement (DPA, in German "AVV")
As soon as personal data sits on your hosting (contact forms, customer accounts, orders, emails), the host processes that data on your behalf. Art. 28 GDPR requires a contract for this. Among other things it covers:
- subject matter, duration, nature and purpose of the processing
- that the host acts only on your instructions
- which security measures apply
- which sub-processors are used
- what happens to the data when the contract ends
Reputable hosts provide the DPA at no extra cost, often as a click in the customer portal. GB Hosting's DPA is here: Data processing agreement.
2. Technical and organisational measures (TOMs)
Art. 32 GDPR requires a level of security appropriate to the risk. Ask your host about:
- Datacenter: certifications such as ISO 27001, access control, fire protection, redundant power
- Customer separation: how is another customer prevented from accessing your data?
- Encryption: TLS for all connections, encrypted backups
- Updates: who applies security patches, and how quickly?
- Access rights: who at the host can access your data, and is it logged?
3. Sub-processors
Hardly any host does everything in-house. Datacenter operators, DNS and CDN services, backup storage and payment providers are often sub-processors. You have a right to know who they are and where they process data. Pay particular attention to service providers based outside the EU.
4. Backups and deletion
Backups contain the same personal data as your website. Clarify:
- Where are the backups stored?
- How long are they kept?
- Are they deleted after the contract ends, and when?
5. Your own obligations
The host is only one part. You remain responsible for your website's GDPR compliance, for example:
- privacy policy and legal notice (in Germany: Impressum)
- consent for cookies and tracking where required
- embedded services such as fonts, maps, videos or analytics that send data to third parties
- your record of processing activities
Checklist: is my hosting GDPR-compliant?
- [ ] DPA under Art. 28 GDPR concluded
- [ ] Host's TOMs available
- [ ] List of sub-processors available, third-country transfers covered
- [ ] Server and backup location in the EU/EEA known
- [ ] Backup retention and deletion clarified
- [ ] Privacy policy names the host
- [ ] Embedded third-party services checked
How GB Hosting meets these points
- Server location: Tier III datacenter in Falkenstein (Saxony, Germany), backups in Nuremberg
- Datacenter: ISO 27001-certified information security management system of the datacenter operator
- Separation: every website in its own container, Windows Servers as separate virtual machines
- DPA: for every plan at no extra cost, details on the DPA