Procurement teams often ask for "GDPR compliant hosting". It is a reasonable request with an awkward answer: the GDPR regulates organisations and how they process personal data, not servers. What hosting can do is make some of your obligations easier to meet and easier to document. This guide goes through the parts of the regulation that touch your infrastructure.
Article 28: your hosting provider is a processor
If your servers hold personal data, whoever runs the data centre is normally a processor acting for you. Article 28 requires a written contract with each processor covering, among other things, what they may do with the data, confidentiality, security, the use of sub-processors and what happens at the end of the service. Ask for these terms before you order, and keep them with your records.
On a dedicated server the provider's role is narrower than with managed cloud services. They supply power, network and hardware; they do not run your operating system or applications. That makes the processing they do, and the contract describing it, simpler.
Article 30: records of processing
Your record of processing activities should say where personal data is stored. With a dedicated server you can write down a specific city and country, rather than "a cloud region" that may be backed by several facilities.
Article 32: security of processing
Article 32 asks for security appropriate to the risk, and names encryption, confidentiality, availability and the ability to restore data. On a dedicated server most of this is in your hands:
- Full-disk encryption, with keys kept off the server.
- Firewalling and SSH or RDP access limited to known addresses.
- Patching on a schedule you control.
- Backups to a second location, tested by restoring them.
- Logs of who logged in and when.
Single-tenant hardware removes one category of risk entirely: nothing else runs on your CPU, memory or disks.
Chapter V: transfers outside the EU
The GDPR does not require personal data to stay in the EU. It requires that transfers to countries outside the European Economic Area have a legal basis, such as an adequacy decision or standard contractual clauses, and since the Schrems II judgment in 2020, an assessment of whether the destination country's laws undermine those protections.
Hosting in an EU member state avoids most of that work for the hosting itself. It does not settle everything. If a provider is part of a group based outside the EU, non-EU laws may still reach it, and a careful transfer impact assessment says so. Encryption with keys you hold is the safeguard regulators most often point to.
What location does not solve
Choosing an EU server does not give you a lawful basis for processing, does not answer access requests, and does not replace a data protection impact assessment where one is needed. It is one part of the picture: an important one, and the part your hosting choice controls.
A short checklist
- Pick a server in an EU member state, and a backup location in another one.
- Get the provider's data processing terms before ordering.
- Record the city and country in your records of processing.
- Encrypt the disks and keep the keys yourself.
- Write down who has administrator access and how it is logged.
This guide is general information, not legal advice. For your own situation, speak to your data protection officer or a lawyer.