Accounts 
GDPR and choosing a host
The EU General Data Protection Regulation (GDPR) does not require data to be kept in the EU, but it does require a data processing agreement with the host and a lawful mechanism for any transfer of data out of the EU. According to the accsly.io catalog as of November 2026, 61% of VPS hosts have servers in the EU, but almost half of them are registered outside the European Economic Area. Here is why that matters and what to check in the terms.
The GDPR is Regulation (EU) 2016/679, which applies in all countries of the European Union and the European Economic Area. For choosing a server, three topics in it matter: who is responsible for what, what agreement you need with the host and where data may be transferred. Below is how these rules apply to renting a VPS or a dedicated server. This article explains general rules and is not a substitute for advice from a lawyer.
When the GDPR applies to your project
Under Article 3, the regulation applies to a company with an establishment in the EU, and to a company from any other country if it offers goods or services to people in the EU or monitors their behaviour, for example through analytics and advertising tags. So a shop outside the EU that delivers to Germany, or a service with a Spanish interface and prices in euros, can also fall under the regulation. In that case, a company without an establishment in the EU usually has to appoint a representative in the Union under Article 27.
Personal data is understood broadly in the GDPR: a name, an email address, a postal address, an order number, an IP address, a device identifier. If your server holds any of this about people in the EU, the rules below apply to you.
Controller and processor
The regulation divides the parties into two roles (Article 4).
- The controller decides why and how data is processed. For a website or service, that is its owner.
- The processor processes data on behalf of the controller. A host whose servers hold your customers' data is a typical processor: this is also how cloud and hosting services are described in the European Data Protection Board Guidelines 07/2020.
The same company can have different roles: for the data on your server the host is a processor, while for your own data, such as your name, payment details and correspondence with support, it is a controller. The role determines the duties. You are responsible for the lawfulness of processing and for security inside the server, and the host for what is written in the agreement and for the security of its infrastructure.
The data processing agreement (DPA)
Article 28 requires the relationship between controller and processor to be set out in a contract or another legal act. Hosts call it a Data Processing Agreement or Data Processing Addendum (DPA), and it is usually part of the terms or signed on request. Under the regulation, it must state that the processor:
- processes data only on the customer's documented instructions, including with regard to transfers outside the EU;
- commits its staff to confidentiality and takes security measures under Article 32;
- engages sub-processors only with the customer's authorisation and gives notice of changes so that the customer can object;
- helps the customer respond to requests from individuals and report breaches;
- deletes or returns the data when the services end;
- makes available the information needed to demonstrate compliance and allows audits.
If a host does not offer a DPA and is not prepared to sign one, that is a serious drawback for a project with data of people in the EU, even if the server is in Frankfurt.
Data inside and outside the EU
The regulation allows data to be transferred outside the EEA, but only on the terms of Chapter V. There are two main mechanisms.
- An adequacy decision (Article 45). The European Commission has recognised the level of protection in a number of countries as adequate, and transfers there require no additional documents. According to the Commission's list as of November 2026, these include the UK, Switzerland, Japan, the Republic of Korea, Canada for commercial organisations and, since January 2026, Brazil. For the US, the decision covers only companies participating in the EU-US Data Privacy Framework. Russia is not on the list.
- Standard contractual clauses (Article 46). If a country is not recognised as adequate, the parties sign the model clauses adopted by Commission Decision 2021/914 and assess whether the law of the recipient's country allows them to be complied with. Where necessary, they add technical measures, above all encryption with keys that remain in the EU.
A transfer is not only moving the database. According to EDPB Recommendations 01/2020, remote access to data from a third country is also a transfer, for example when the host's support team works from outside the EU. Backup copies on a server in another country and foreign mailing and analytics services also need to be taken into account.
If your users include Russian citizens, Russian law adds its own requirement to store their data in Russia; how the two sets of rules are combined is described in the article 152-FZ and hosting.
An EU data centre vs an EU company
A server in the European Union does not yet mean that the data is subject only to European law. If the host or its parent company is registered in another country, they are subject to its laws too. The most discussed example is the US CLOUD Act, under which a US company hands over data to US authorities wherever the server stands. Its relationship with the GDPR was analysed by the EDPB and the European Data Protection Supervisor.
According to the accsly.io catalog as of November 2026, 1,184 of the 1,934 VPS hosts with a known location, or 61%, have servers in the EU. Most often these are in Germany (597 hosts), the Netherlands (536), France (273), Poland (184) and Finland (164). Among those whose country of registration is known, 470 of 874, or 54%, are registered in the EEA, and the other 404 outside it, most often in the US (79), the UK (69) and Russia (53). The reverse is also true: of the 551 hosts registered in the EU, 131 also rent out servers outside the EEA, so with a European company it is still worth checking the country of the specific plan. More on the difference between the company's country and the server's country is in the article Hosting provider jurisdiction.
Plans with servers in the European Union are collected in the selection VPS in Europe and on the country pages: Germany, the Netherlands, Finland.
What to check in the host's terms
- whether there is a DPA and whether it meets Article 28: customer instructions, confidentiality, security measures, sub-processors, data deletion, audits;
- the list of sub-processors and how new ones are announced;
- the country and city of the data centre for the plan, and where the host keeps its own backups;
- where support works from and whether it has access to the contents of servers;
- the transfer mechanism if data or access leaves the EEA: an adequacy decision or standard contractual clauses;
- how quickly the host notifies the customer of a data incident;
- the data centre's security certifications, such as ISO/IEC 27001, if your customers need them.
Your duties on a VPS
On an unmanaged server, security measures inside the system, such as updates, key-based access, a firewall and encryption of disks and backups, are up to you: where to start is described in the article First 10 steps after buying a VPS: security, and backups in the article VPS backups. Under Article 33, the controller reports a serious breach to the supervisory authority within 72 hours, and the processor must notify the controller without undue delay. Fines for infringing the regulation can reach 20 million euros or 4% of the company's worldwide annual turnover, whichever is higher.