GDPR hosting on dedicated servers inside the EU

What hosting can and cannot do for GDPR

No server is "GDPR compliant" on its own. Compliance depends on how your organisation collects, uses and protects personal data. What hosting decides is where that data physically sits and who can reach the hardware. A dedicated server in an EU member state answers the first question simply, and as single-tenant hardware it narrows the second.

Being precise about the provider

These servers are in EU data centres and are operated by an infrastructure provider headquartered in Canada. The European Commission recognises Canada as giving adequate protection to personal data handled by commercial organisations, which makes it a simpler partner than a provider in a country without that status. The provider also runs data centres outside Europe, so if your transfer impact assessment has to consider non-EU law that could reach a provider or its group, include that. Encrypting data at rest with keys you hold yourself is the usual safeguard, and on a dedicated server you control the disks and the keys.

We would rather you know this before ordering than after. Ask sales for the data centre operator's details and data processing terms.

Checklist for your records

• Record the server's country and city in your record of processing activities.
• Get the data processing terms that cover the hosting provider.
• Turn on full-disk encryption and keep the keys off the server.
• Document who has root access, and how access is logged.
• Choose a backup location in the EU too. A backup in another region defeats the purpose.