If your website collects data about people in the EU or UK, GDPR applies to your web hosting choices too. Contact forms, orders, newsletter sign-ups, analytics and even server logs contain personal data. This guide explains the roles, contracts and technical measures involved. It is general information, not legal advice.
Before you start
- A list of the personal data your site collects and why.
- A list of every service that stores or processes it: hosting, email, analytics, payment, CRM.
Controller, processor and sub-processor
| Role | Who | Responsibility |
|---|---|---|
| Controller | The website owner or business | Decides why and how data is used; needs a lawful basis and a privacy notice |
| Processor | The hosting provider, email provider, reseller hosting a client's site | Processes data only on the controller's instructions and keeps it secure |
| Sub-processor | A provider used by the processor, such as the reseller's upstream host | Same obligations, passed down by contract |
A reseller is usually a processor for its clients' websites and a controller for its own billing and customer records.
Data processing agreements (DPA)
Article 28 GDPR requires a written contract between controller and processor covering the subject, duration, type of data, security measures, sub-processors, assistance with data subject requests and deletion at the end of the service. Ask your host for its DPA, and as a reseller offer one to your own clients.
Server location and international transfers
GDPR does not require servers inside the EU, but transfers outside the EEA need a legal mechanism: an adequacy decision (for example the EU-US Data Privacy Framework for certified US companies), Standard Contractual Clauses, or another safeguard. Hosting EU visitors' data in an EU data centre, such as MdmHost's Germany location, keeps the setup simpler. Remember that CDNs, email services and analytics tools may still transfer data elsewhere.
Logs, backups and retention
- Access logs contain IP addresses, which are personal data. Keep them only as long as needed for security and troubleshooting, and state this in your privacy notice.
- Backups are allowed and expected under the security principle. When someone asks for erasure, deleting them from live systems is normally accepted, as long as backups expire on a fixed schedule and restored data is cleaned again.
- Retention: define how long orders, form submissions and inactive accounts are kept.
Security measures expected by GDPR
- HTTPS on every page and form.
- Strong passwords and two-factor authentication on hosting, CMS and email accounts.
- Updated software, malware scanning and a web application firewall.
- Regular, tested backups and the ability to restore quickly.
- Least-privilege access: only the people who need access get it.
Personal data breaches
A breach is any security incident leading to loss, change or unauthorised access to personal data, such as a hacked site leaking a customer table. The controller must notify the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to put people at risk, and inform affected people when the risk is high. Processors must tell the controller without undue delay. Keep an internal record of every breach.
GDPR checklist for website owners
- Map the data you collect and its lawful basis.
- Publish a clear privacy notice naming your processors.
- Sign DPAs with your host and other processors.
- Use consent for non-essential cookies and tracking, with a real reject option.
- Collect only the form fields you need.
- Set retention periods and delete old data.
- Have a procedure for access, correction and deletion requests.
Tip: If you run WHMCS as a reseller, its built-in GDPR tools help you export and delete client data on request.
Frequently asked questions
Does GDPR apply to businesses outside the EU?
Yes, if you offer goods or services to people in the EU or monitor their behaviour, for example with analytics.
Is a contact form subject to GDPR?
Yes. It collects names and email addresses, so you need a lawful basis, a privacy notice and secure handling.
Does my host have to be GDPR compliant?
Your host must act as a compliant processor and provide a DPA, but you remain responsible as controller for how your site uses data.