Compliance & Data Privacy
GDPR and Web Hosting: What You Must Know About Data Compliance
Plain-English guidance on what GDPR requires from your website, your host, and you — and how to actually get compliant
📋 What’s in this guide
GDPR has a reputation for being impossibly complex — hundreds of pages of regulation, vague legal language, and fine amounts large enough to sink a company. For website owners who just want to run a blog or small business online, it can feel like legislation written for enterprises, not individuals.
But most of what GDPR requires from a typical website is actually straightforward. The core principles make common sense: be transparent about what data you collect, have a legitimate reason for collecting it, protect it properly, and give people control over their own information. The paperwork can be daunting, but the underlying obligations are reasonable.
This guide cuts through the noise. It explains what GDPR actually requires of your website and your hosting setup, what your hosting provider’s responsibilities are, and what you need to put in place to operate legally. It covers the hosting-specific angles — server location, data processing agreements, international transfers — that most GDPR guides skip entirely.
This guide provides general educational information about GDPR and web hosting. It is not legal advice and does not create a solicitor-client relationship. For your specific situation — particularly if you handle sensitive data, process data at scale, or operate in a regulated industry — consult a qualified data protection lawyer or DPO.
1. What GDPR Actually Is
The General Data Protection Regulation is a European Union law that came into force on 25 May 2018. It governs how organizations collect, store, process, and use the personal data of people in the EU and EEA (European Economic Area). It replaced a patchwork of national data protection laws across EU member states with a single unified regulation.
Personal data under GDPR is defined broadly: any information that can identify a living individual, directly or indirectly. This includes obvious things like names, email addresses, and phone numbers, but also IP addresses, cookie identifiers, location data, and device fingerprints. If your website collects an email address through a contact form, places a cookie on a visitor’s browser, or logs IP addresses in your server access logs — you are processing personal data under GDPR.
Key Definitions You Need to Know
| Term | What It Means in Practice |
|---|---|
| Data Subject | The individual whose data is being processed — your website visitors, customers, subscribers |
| Data Controller | The entity that decides why and how personal data is processed — almost certainly you, the website owner |
| Data Processor | An entity that processes data on behalf of the controller — your hosting provider, email marketing platform, analytics tool |
| Personal Data | Any information that identifies or can identify a living individual — names, emails, IPs, cookies, device IDs |
| Processing | Almost anything done with data: collecting, storing, reading, sharing, deleting — all count as processing |
| Lawful Basis | The legal justification you must have before processing personal data — consent, contract, legitimate interest, etc. |
| DPA | Data Processing Agreement — a contract required between controllers and processors (you and your host) |
| DPO | Data Protection Officer — a role required for certain organizations processing large amounts of sensitive data |
The Six Lawful Bases for Processing
Under GDPR, you must have at least one lawful basis for every type of personal data you process. The six bases are:
- Consent — the individual has given clear, specific, freely given consent. This is what most websites rely on for marketing emails and non-essential cookies.
- Contract — processing is necessary to fulfill a contract with the individual, or to take steps at their request before entering one. Collecting a shipping address to fulfill an order uses this basis.
- Legal obligation — you must process the data to comply with a law. Keeping financial records for tax purposes is a common example.
- Vital interests — necessary to protect someone’s life. Rarely applicable to most websites.
- Public task — processing in the exercise of official authority. Primarily for public bodies.
- Legitimate interests — your organization has a genuine, legitimate reason to process the data that isn’t overridden by the individual’s interests or rights. Often used for fraud prevention, IT security, and some forms of analytics.
2. Does GDPR Apply to Your Website?
This is the question everyone asks first. The answer is almost certainly yes if your website is accessible to people in the EU — even if you and your business are based outside Europe.
GDPR has extraterritorial reach: it applies to any organization anywhere in the world if it:
- Offers goods or services to people in the EU (even for free)
- Monitors the behavior of people in the EU (including via cookies or analytics)
If your website is publicly accessible and you use Google Analytics, place cookies, have a contact form, or collect email addresses — and EU residents can visit your site — GDPR applies to you. A US-based blog with a newsletter counts. An Australian e-commerce store selling to European customers counts. There is no “small business” exemption from GDPR, though the compliance burden is proportionate to the volume and sensitivity of data you process.
🌍 Does GDPR Apply to Your Website?
After Brexit, the UK retained its own version of GDPR (UK GDPR), which is nearly identical to the EU version. If you have UK visitors, UK GDPR applies. For most practical purposes, complying with EU GDPR means you’re also compliant with UK GDPR — but if the UK is a significant market for you, confirm with a UK-based legal advisor.
3. The 8 Rights of Data Subjects
GDPR grants eight specific rights to individuals whose data you process. Understanding these is essential because your website and processes need to be capable of honoring them when someone invokes them.
People must know you’re collecting their data, why, and how. Fulfilled primarily through your Privacy Policy.
Anyone can request a copy of all personal data you hold about them. You have 30 days to respond. This is called a Subject Access Request (SAR).
If data you hold is inaccurate or incomplete, the individual can ask you to correct it. Must be done within 30 days.
The “right to be forgotten.” Individuals can request deletion of their data. Not absolute — some data must be kept for legal reasons.
In certain circumstances, individuals can ask you to pause processing of their data while a dispute is resolved.
Individuals can request their data in a machine-readable format (e.g. CSV or JSON) to transfer to another service.
Individuals can object to processing based on legitimate interests or for direct marketing. Marketing objections must always be honored.
Protection against decisions made solely by automated means, including profiling, that significantly affect them.
For most small websites, the rights you’ll encounter most often are access requests, erasure requests (especially from email unsubscribers), and objections to marketing. You need a process — even a simple one — for handling each of these. A dedicated email address like [email protected] that you check regularly is a reasonable starting point.
4. Your Host’s Role Under GDPR
When you sign up for web hosting, your hosting provider stores and processes data on your behalf — your website files, databases, server logs, and any personal data your visitors submit through your site. Under GDPR, this makes your host a Data Processor and you the Data Controller.
This distinction matters enormously. As the controller, you are primarily responsible for ensuring GDPR compliance. Your host — as a processor — must follow your instructions and can only process personal data for the purposes you’ve specified. They cannot use your visitors’ data for their own marketing or share it with third parties without your authorization.
What a GDPR-Compliant Host Must Provide
- A Data Processing Agreement (DPA) — a contractual document that formalizes the controller-processor relationship. GDPR Article 28 requires this to be in place. Most reputable hosts offer a DPA or have standard terms that fulfill this requirement. More on this in Section 5.
- Technical and organizational security measures — the host must implement appropriate security for the data they process on your behalf: encryption at rest and in transit, access controls, physical security of data centers, and so on.
- Breach notification — if the host experiences a breach that affects your data, they must notify you without undue delay so you can fulfill your own 72-hour breach notification obligation to your supervisory authority.
- Subprocessor transparency — if the host uses third-party subprocessors (CDN providers, backup services, monitoring tools), they must disclose this and ensure those subprocessors are also GDPR-compliant.
- Data deletion on termination — when you end the hosting relationship, the host should delete or return your data and confirm they’ve done so.
Look for these signals on your host’s website: a dedicated GDPR or Privacy page, an available DPA (sometimes signed automatically on account creation, sometimes requiring a request), ISO 27001 or SOC 2 certification, and EU/EEA data center options. If you can’t find a DPA or any mention of GDPR in their documentation, that’s a red flag worth following up with their support team directly.
5. Data Processing Agreements (DPAs)
A Data Processing Agreement is not optional — GDPR Article 28 explicitly requires a binding contract between every data controller and every data processor they use. This includes your hosting provider, email marketing platform, analytics provider, CRM, payment processor, and any other third-party service that handles personal data on your behalf.
What a DPA Must Include
Under GDPR Article 28(3), a DPA must specify:
- The subject matter, duration, nature, and purpose of the processing
- The type of personal data and categories of data subjects involved
- The obligations and rights of the controller
- That the processor only processes data on documented instructions from the controller
- Confidentiality obligations on persons authorized to process the data
- Security measures implemented by the processor
- Conditions for engaging subprocessors
- Assistance with data subject rights requests
- Deletion or return of data at the end of the contract
- The right to audit the processor’s compliance
How to Get a DPA from Your Host
Most major hosting providers have standardized this process. Here’s what to look for:
| Host Type | How DPA Is Usually Provided |
|---|---|
| Enterprise / Managed hosts WP Engine, Kinsta, Cloudways | DPA available in account dashboard or as a downloadable PDF to sign and return. Often explicitly labeled. |
| Large shared hosting providers SiteGround, Bluehost, Hostinger | DPA incorporated into Terms of Service or available on request via legal/compliance team. Check their GDPR documentation page first. |
| Cloud infrastructure providers AWS, Google Cloud, DigitalOcean | DPA available as a self-service document in the account settings or as a standard addendum accepted during sign-up. |
| Small or budget hosts | May not have a formal DPA. Email their support and ask explicitly. If they can’t provide one, consider that a compliance risk. |
Your hosting provider is just one processor. You also need DPAs with every other service that touches personal data from your site: Google Analytics, your email marketing platform (Mailchimp, ConvertKit, etc.), your CRM, your payment processor, your live chat tool, your helpdesk software. Most major SaaS platforms have DPAs available — look for “Data Processing Agreement” or “Data Processing Addendum” in their legal or privacy documentation.
6. Server Location and International Data
Under GDPR, transferring personal data outside the EU/EEA to a country without an “adequate” level of data protection is restricted. This has direct implications for your hosting setup — specifically, where your servers are physically located.
What Counts as a Restricted Transfer
Any time personal data collected from EU residents is sent to, processed on, or stored by servers in a non-adequate country, that’s a restricted transfer requiring a legal mechanism to legitimize it. The EU maintains an official list of countries it considers to have adequate protection — these currently include the UK (under the adequacy decision), Switzerland, Canada (partially), Japan, and a handful of others. The United States has a conditional adequacy mechanism through the EU-US Data Privacy Framework (DPF), adopted in 2023.
If Your Server Is in the EU or EEA
The simplest solution to international transfer concerns is hosting your data in the EU. Most major hosting providers offer EU data center options — typically in Germany, Ireland, the Netherlands, or Finland. If your primary audience is European and data residency matters to you, explicitly select an EU region when setting up your hosting. This doesn’t eliminate all compliance obligations, but it significantly reduces international transfer complexity.
If Your Server Is in the US or Another Non-Adequate Country
You need a legal mechanism to legitimize the transfer. The main options available are:
- Standard Contractual Clauses (SCCs) — pre-approved contract templates issued by the European Commission that create legally binding data protection obligations between the exporter and importer. Most major US-based hosting providers include SCCs as part of their DPA. This is the most commonly used mechanism.
- EU-US Data Privacy Framework (DPF) — US companies certified under the DPF are deemed adequate. AWS, Google Cloud, Microsoft Azure, and many others are DPF-certified. Check the official DPF list at dataprivacyframework.gov to verify your provider.
- Binding Corporate Rules — used for intra-group transfers within large multinationals. Not relevant to most website owners.
If you use a major cloud host (AWS, Google Cloud, Azure, DigitalOcean, Cloudflare), check whether they’re DPF-certified or whether their DPA includes SCCs — most do. If you use a large shared hosting provider, check their GDPR documentation for the same. For most websites, the transfer mechanism question is already handled by your host’s standard DPA. The key is to actually obtain and review the DPA rather than assuming it’s covered.
7. What Your Website Must Have
Beyond the hosting infrastructure, there are things that need to be on your actual website to meet GDPR requirements. Here’s what’s required and what each one needs to contain.
Privacy Policy
A Privacy Policy is mandatory under GDPR if you process any personal data. It must be written in plain language (not legalese), be easily accessible from every page of your site (typically in the footer), and cover all of the following:
- Who you are and how to contact you (and your DPO if you have one)
- What personal data you collect and why
- The lawful basis for each type of processing
- How long you retain data
- Who you share data with (including your hosting provider, analytics, email platform)
- Whether data is transferred outside the EU and what safeguards apply
- The eight data subject rights and how to exercise them
- How to lodge a complaint with a supervisory authority
- Cookie information (or a reference to your Cookie Policy)
Cookie Policy / Cookie Notice
If your site places any non-essential cookies — analytics cookies (Google Analytics), advertising cookies, social media pixels, or preference cookies — you need explicit consent before placing them. This requires a cookie consent banner that appears on the first visit and allows users to accept or decline non-essential cookies. More on this in Section 8.
Contact Forms
Any form that collects personal data (name, email, message) needs a brief notice explaining what you’ll do with the data, your lawful basis for collecting it, a link to your Privacy Policy, and — if you’re relying on consent as the lawful basis — an unchecked checkbox. Don’t pre-tick consent boxes. A clear statement like “By submitting this form, you agree to our Privacy Policy” next to an unticked checkbox is sufficient for most contact forms.
Email Newsletter Sign-ups
Consent for marketing emails must be freely given, specific, informed, and unambiguous. This means an opt-in checkbox — unchecked by default — with clear language explaining what the person is signing up for. You must record when and how consent was given. Pre-checked boxes, bundled consent (agreeing to terms automatically signs them up for a newsletter), and implied consent (visiting the site doesn’t count as consent) are all non-compliant.
Record of Processing Activities (RoPA)
Organizations with more than 250 employees are required to maintain a formal RoPA. For smaller operations it’s technically optional, but it’s strongly recommended regardless of size. A RoPA is simply a documented record of what personal data you process, why, how long you keep it, and who has access to it. A spreadsheet works fine. It demonstrates accountability and makes compliance audits (or supervisory authority inquiries) far easier to respond to.
8. Cookies and Consent
Cookies are one of the most visible GDPR compliance issues for most websites, and also one of the most frequently mishandled. The key principle is simple: non-essential cookies require prior, informed consent.
Cookie Categories
| Category | Examples | Consent Required? |
|---|---|---|
| Strictly Necessary | Session cookies, login cookies, shopping cart, CSRF tokens | No — essential for the site to function |
| Functional / Preference | Language preference, remembering a user’s settings | Yes — optional feature |
| Analytics / Performance | Google Analytics, Hotjar, Matomo (standard mode) | Yes — unless using cookieless/anonymized analytics |
| Marketing / Advertising | Google Ads, Meta Pixel, retargeting cookies | Yes — always requires explicit consent |
What a Valid Cookie Consent Banner Looks Like
A compliant cookie banner must: appear before any non-essential cookies are placed, give users a genuine choice (accept and reject must be equally prominent), allow granular choices by category, not use dark patterns (pre-ticked boxes, confusing language, buried reject options), and record consent so you can prove it was given. Consent must be as easy to withdraw as it was to give — a persistent “Cookie Settings” link in the footer achieves this.
Google Analytics places cookies and sends IP address data to Google’s servers. This requires consent under GDPR unless you configure it to operate without cookies and anonymize IPs. If you want analytics without a consent requirement, consider a cookieless alternative like Fathom Analytics, Plausible, or self-hosted Matomo configured in cookieless mode.
Recommended Cookie Consent Tools
- Cookiebot / Usercentrics — enterprise-grade, automatically scans and categorizes cookies, generates compliant banners. Paid plans from around $10/month.
- CookieYes — popular mid-range option with a free tier for small sites. Good balance of functionality and ease of use.
- Complianz — WordPress plugin, excellent for WordPress sites, generates cookie policy automatically based on a questionnaire. Free and premium versions.
- Osano — free tier available, solid compliance features, good documentation.
9. GDPR for WordPress Sites
WordPress powers over 40% of all websites, so it’s worth covering WordPress-specific GDPR considerations separately. WordPress itself has built-in GDPR tools since version 4.9.6, but plugins and themes often introduce their own data collection that requires separate attention.
WordPress Built-in Privacy Tools
- Privacy Policy page generator (Settings → Privacy) — creates a starting template you can customize. Use it as a starting point, not a finished document — it won’t cover your specific plugins and third-party services.
- Data export tool (Tools → Export Personal Data) — lets you fulfill Subject Access Requests by generating a file of all data WordPress holds about a specific user or email address.
- Data erasure tool (Tools → Erase Personal Data) — lets you fulfill right-to-erasure requests directly from the admin dashboard.
- Comment consent checkbox — WordPress 4.9.6+ includes an optional consent checkbox on comment forms. Enable it under Settings → Discussion → “Show comments cookies opt-in checkbox.”
Plugin and Theme Audit
Every plugin you install is a potential new data processor. Before installing a plugin, check: does it collect any user data? Does it send data to external servers? Does it set cookies? Common culprits include contact form plugins, analytics integrations, social sharing buttons, live chat tools, and marketing automation plugins. For each one, check whether the plugin developer has a DPA available and whether they’re listed in your Privacy Policy.
Recommended WordPress GDPR Plugins
- Complianz Privacy Suite — comprehensive cookie consent, privacy policy generator, and DPA management in one plugin
- WP GDPR Compliance — adds consent checkboxes to comment forms, contact forms, and registration forms
- GDPR Cookie Consent (by WebToffee) — specifically for cookie banner management on WordPress
- WooCommerce — if you run a WooCommerce store, WooCommerce has built-in GDPR features including data export and erasure for customer order data. Ensure your checkout includes a Privacy Policy link and that you have a lawful basis for processing order data (contract).
Contact Form 7, WPForms, Gravity Forms, and Ninja Forms all store form submission data in your WordPress database by default. This means names and email addresses submitted through your contact form are personal data you’re retaining. Review your form plugin’s settings, set a reasonable retention period (e.g. delete entries after 30–90 days), and mention this processing in your Privacy Policy.
10. Fines and Enforcement
GDPR’s enforcement teeth are real, and they’ve been used. Understanding the penalty structure helps calibrate how seriously to take compliance — and dispels the myth that only large corporations are at risk.
Notable GDPR Fines (Examples)
| Organization | Fine | Reason |
|---|---|---|
| Meta (Facebook) | €1.2 billion | Unlawful EU-US data transfers for Facebook user data |
| Amazon | €746 million | Advertising tracking without valid consent |
| Google (France) | €150 million | Cookie consent mechanism difficult to refuse |
| H&M | €35.3 million | Extensive employee surveillance and data retention |
| A small Portuguese hospital | €400,000 | Unauthorized staff access to patient records |
| A Romanian operator | €2,000 | Failure to implement adequate security measures |
The last two rows in that table are the important ones for most website owners. GDPR fines are not exclusively levied against tech giants — supervisory authorities across Europe have issued fines to hospitals, small businesses, and individual operators. Fines are meant to be proportionate to the scale of the violation and the organization’s ability to pay, but “proportionate” still means real consequences.
Beyond fines, supervisory authorities can issue reprimands, bans on processing, and orders to comply — any of which can have significant operational impact. And individuals can bring civil claims for compensation for material and non-material damages caused by GDPR violations.
The vast majority of GDPR enforcement begins with a complaint from an individual — not a proactive audit by a regulator. If someone submits a Subject Access Request you ignore, invokes their right to erasure and you refuse without justification, or objects to a cookie banner that has no real “reject” option, they can complain to their national supervisory authority. For a website owner, making a genuine, good-faith effort at compliance — and responding promptly to any individual requests — significantly reduces real-world risk.
11. Your GDPR Compliance Checklist
Use this as a working checklist. Not every item will apply to every site — adapt it to your situation.
Foundation
- Identify every type of personal data your site collects (form submissions, email list, analytics, server logs, comments, order data)
- Document the lawful basis for each type of processing
- Create or update a Record of Processing Activities (RoPA) — even a simple spreadsheet
- Confirm GDPR applies to your site (it almost certainly does if EU visitors can access it)
Hosting and Third Parties
- Obtain a Data Processing Agreement from your hosting provider
- Confirm your host’s server location — if outside the EU, verify SCCs or DPF certification
- List all third-party services that process personal data (analytics, email, CRM, payments)
- Obtain DPAs from each significant third-party processor
- Confirm your host has adequate breach notification procedures
Your Website
- Write a clear, plain-language Privacy Policy covering all required elements
- Make the Privacy Policy accessible from every page (typically footer)
- Implement a cookie consent banner that allows genuine accept/reject per category
- Ensure non-essential cookies are NOT placed before consent is given
- Add a privacy notice and unchecked consent checkbox to all forms collecting personal data
- Add an opt-in checkbox (unchecked by default) to any email newsletter sign-up
- Set up a privacy contact channel (e.g. [email protected])
Operations
- Create a simple process for handling Subject Access Requests within 30 days
- Create a simple process for handling erasure requests
- Know how to honor marketing objections (unsubscribe links, opt-out process)
- Set data retention policies — decide how long you keep form submissions, logs, and other data
- Document your breach response process — who gets notified, in what timeframe
- Review compliance annually or when you add new tools or data practices
Compliance Is a Practice,
Not a Destination
GDPR compliance isn’t a box you check once and forget. It’s an ongoing practice — reviewing your data flows when you add new tools, responding to data subject requests when they come in, updating your Privacy Policy when your practices change, and keeping your DPAs current as you change hosting providers or third-party services.
The good news: for a typical small-to-medium website, genuine compliance is achievable without a legal team or an enterprise budget. Get your hosting DPA in place, build a real cookie consent flow, write an honest Privacy Policy, and establish a way for people to contact you with privacy requests. That foundation covers the majority of what GDPR requires of most websites.
Start with the checklist in Section 11, work through it methodically, and consult a data protection professional for anything specific to your situation — particularly if you handle sensitive data, run an e-commerce operation, or process data at significant scale.
Know your data. Protect it properly.
Respect the people it belongs to.