Sovereignty · Updated 10 November 2026 · 8 min read

What a data processing agreement with a hosting provider should include in 2026

A clause-by-clause reading guide for a host's DPA: what Article 28 requires, what strong wording looks like, and how Hetzner, Sliplane, Scalingo and Eurobase word it.

View as Markdown

A data processing agreement with a hosting provider should cover eight things Article 28(3) of the GDPR lists by name: processing only on your instructions, staff confidentiality, security measures, rules for subprocessors, help with data subject requests, help with security, breaches and impact assessments, deletion or return at the end, and audit rights. On top of the law, a usable DPA also describes your actual data in an annex, says how fast you'll hear about a breach, and explains how you can object to a new subprocessor and what that objection achieves. Hetzner, Sliplane, Scalingo and Eurobase each offer a standard DPA rather than one drafted per customer, so the work is reading it, not negotiating it.

This page is a reading guide, not legal advice. For the wider list of what to ask a host beyond the contract, see the GDPR hosting checklist.

Clauses at a glance

Clause	Required by	Strong wording	Warning sign
Subject, duration, data types, data subjects	Article 28(3)	An annex you fill in or that lists real data, such as visitor IPs in access logs	"Any data the customer uploads" and nothing more
Documented instructions	Article 28(3)(a)	Instructions defined, including transfers, plus a duty to warn you if an instruction breaks the law	No mention of transfers
Confidentiality	Article 28(3)(b)	Staff and contractors bound by a confidentiality duty	Silent on contractors
Security measures	Article 28(3)(c) and Article 32	A specific annex of measures and how they're reviewed	One sentence saying "appropriate measures"
Subprocessors	Article 28(2) and 28(4)	A named list, advance notice, an objection window and a stated outcome	Changes "at any time" with notice only afterwards
Assistance	Article 28(3)(e) and (f)	Help with requests, Article 32 to 36 duties and breaches, with any fee stated up front	Every form of help billed by quote
Deletion or return	Article 28(3)(g)	Your choice, copies covered, a timeline	Deletion "according to our policy"
Audits and information	Article 28(3)(h)	Audit reports you can get, on-site audits with clear limits	No audit right at all

The clauses, one by one

Instructions and transfers

Article 28(3)(a) says the processor acts only on your documented instructions, including on transfers to a third country, and must tell you first if EU or national law forces it to do something else. The same article says the processor must tell you at once if it thinks one of your instructions breaks data protection law. Look for both sentences. In hosting, your instructions are mostly the contract plus what you configure, such as the region.

Security annex

Article 32 asks for measures that fit the risk, such as encryption, restore ability and regular testing. A strong DPA lists them and says how they're checked. Hetzner, for example, says an annual TÜV Rheinland review checks its technical and organisational measures, and customers with a DPA get that audit report in their account.

Subprocessors

Article 28(2) lets the host use a general authorisation, as long as it tells you about added or replaced subprocessors and gives you a chance to object. Article 28(4) passes the same duties down the chain and keeps the host liable. Three details decide whether that right is real:

How long you have to object. Windows vary a lot between providers.
Which reasons count. Some DPAs accept only listed grounds.
What happens next. Termination, a change of plan, or nothing.

Also read the location column: some subprocessors only apply if you pick a region outside Europe.

Breach notice

The processor must tell you about a breach "without undue delay" under Article 33(2). That phrase has no hour count attached, yet you as controller must report to the supervisory authority within 72 hours of becoming aware, where feasible. If your incident plan needs a figure, ask for one before signing.

End of the contract

Article 28(3)(g) gives you the choice between deletion and return, and requires existing copies to be deleted unless the law says to keep them. Backups are the copies most often left vague. Check whether you can export your data yourself, how long you have after termination, and whether backups have an expiry date.

Audits

Article 28(3)(h) requires the host to give you the information needed to show compliance and to allow audits, including inspections. Shared platforms narrow this, as the comparison below shows: one audit a year, a written plan weeks ahead, your costs, nothing that exposes other tenants. Limits like these are reasonable. A DPA with no audit right and no report on offer isn't.

How four hosts word it

Point	Hetzner	Sliplane	Scalingo	Eurobase
How you conclude it	Checkbox in your customer account, no handwritten signature	Accepted in the dashboard, executed copy downloadable	Part of the main agreement, takes effect with it	Part of accepted customer terms, checkout terms or an order form
Your data described	You pick data types and data subjects, recorded in Appendix 1	Listed categories in Section 1	Table of processing operations	Listed in the DPA, including visitor IPs, paths and user agents in access logs
New subprocessor	Not documented	Advance notice; if you object, you may terminate on 30 days' notice	8 calendar days to contest in writing, only on listed grounds	Advance notice, 30 days to object; Eurobase resolves it, avoids the processing or lets you end the affected service
Breach notice	Not documented	Prompt reporting, no hours stated	As soon as possible, no hours stated	Help under Articles 33 and 34, no hours stated
End of contract	Not documented	Delete or return at your choice, copies deleted	Self-service export any time, deletion under the general terms	Delete or return at your choice; no fixed deadline or backup expiry confirmed
Audits	Annual external review of measures, report in your account	Sample checks announced in advance, a reasonable fee possible	One audit a year, a plan 4 weeks ahead, your cost including staff time	Reasonable, scoped to your data, protective of other tenants

Each row is taken from the provider's own DPA or data protection page, read on 10 November 2026.

Hetzner also lets you keep up to six DPAs at once when your data changes, and Sliplane's DPA ties any processing outside the EU/EEA to the region you choose.

Where Eurobase fits

Eurobase, a business registered in Warsaw, Poland, hosts your apps on European infrastructure run by Scaleway, a French provider. Its DPA makes you the controller for workload data and Eurobase the processor, and it names access logs with visitor IP addresses as data it processes. The subprocessor list names GitHub and GitLab Inc. as US entities; they come into play only if you link a repository hosted there, and Codeberg, based in Germany, is the EU alternative.

The DPA gives no hour count for breach help, and it says openly that no end-of-service deletion deadline or backup expiry is confirmed yet. If either point matters for your contract, put the question to privacy@eurobase.dev before launch. Neither ISO 27001 nor SOC 2 is held yet; both are in progress. Log cleanup periods are in the retention table; how long you can keep logs covers the rules.

A short review routine

Save the accepted version with its date.
Check the annex against what your app stores, request logs included.
Mark every subprocessor outside the EEA and when it applies.
Write down the objection window, breach wording, deletion timeline and any fees.
Ask open questions in writing and file the answers with your records of processing.

Frequently asked questions

Do I have to sign a DPA with my hosting company?

Yes, if it processes personal data for you, such as a database or access logs. Article 28(9) accepts electronic form, so accepting the host's DPA in its dashboard counts as long as you can show it was accepted.

Can I use the European Commission's standard clauses instead of the host's DPA?

Article 28(7) lets the Commission set standard contractual clauses for processor contracts, and it adopted a set for controllers and processors in the EU/EEA on 4 June 2021. Using them is a choice, not a duty, and a host with a standard DPA may not agree to swap its own terms.

Is a DPA the same as standard contractual clauses for transfers?

No. A DPA sets the duties between you and your processor. Transfer clauses are one of the safeguards Article 46 allows for sending data outside the EEA. If a host or one of its subprocessors moves data to a country without an adequacy decision, you need the DPA plus a transfer safeguard such as those clauses.

What if the host changes a subprocessor and I disagree?

Object within the DPA's window. Depending on the wording, the host may resolve it, avoid the processing or let you leave.