# What a data processing agreement with a hosting provider should include in 2026

Last updated: 2026-11-10

A data processing agreement with a hosting provider should cover eight things Article 28(3) of the GDPR lists by name: processing only on your instructions, staff confidentiality, security measures, rules for subprocessors, help with data subject requests, help with security, breaches and impact assessments, deletion or return at the end, and audit rights. On top of the law, a usable DPA also describes your actual data in an annex, says how fast you'll hear about a breach, and explains how you can object to a new subprocessor and what that objection achieves. Hetzner, Sliplane, Scalingo and Eurobase each offer a standard DPA rather than one drafted per customer, so the work is reading it, not negotiating it.

This page is a reading guide, not legal advice. For the wider list of what to ask a host beyond the contract, see the [GDPR hosting checklist](/i/gdpr-hosting-checklist).

## Clauses at a glance

| Clause | Required by | Strong wording | Warning sign |
|---|---|---|---|
| Subject, duration, data types, data subjects | Article 28(3) | An annex you fill in or that lists real data, such as visitor IPs in access logs | "Any data the customer uploads" and nothing more |
| Documented instructions | Article 28(3)(a) | Instructions defined, including transfers, plus a duty to warn you if an instruction breaks the law | No mention of transfers |
| Confidentiality | Article 28(3)(b) | Staff and contractors bound by a confidentiality duty | Silent on contractors |
| Security measures | Article 28(3)(c) and Article 32 | A specific annex of measures and how they're reviewed | One sentence saying "appropriate measures" |
| Subprocessors | Article 28(2) and 28(4) | A named list, advance notice, an objection window and a stated outcome | Changes "at any time" with notice only afterwards |
| Assistance | Article 28(3)(e) and (f) | Help with requests, Article 32 to 36 duties and breaches, with any fee stated up front | Every form of help billed by quote |
| Deletion or return | Article 28(3)(g) | Your choice, copies covered, a timeline | Deletion "according to our policy" |
| Audits and information | Article 28(3)(h) | Audit reports you can get, on-site audits with clear limits | No audit right at all |

## The clauses, one by one

### Instructions and transfers

Article 28(3)(a) says the processor acts only on your documented instructions, including on transfers to a third country, and must tell you first if EU or national law forces it to do something else. The same article says the processor must tell you at once if it thinks one of your instructions breaks data protection law. Look for both sentences. In hosting, your instructions are mostly the contract plus what you configure, such as the region.

### Security annex

Article 32 asks for measures that fit the risk, such as encryption, restore ability and regular testing. A strong DPA lists them and says how they're checked. Hetzner, for example, says an annual TÜV Rheinland review checks its technical and organisational measures, and customers with a DPA get that audit report in their account.

### Subprocessors

Article 28(2) lets the host use a general authorisation, as long as it tells you about added or replaced subprocessors and gives you a chance to object. Article 28(4) passes the same duties down the chain and keeps the host liable. Three details decide whether that right is real:

- **How long you have to object.** Windows vary a lot between providers.
- **Which reasons count.** Some DPAs accept only listed grounds.
- **What happens next.** Termination, a change of plan, or nothing.

Also read the location column: some subprocessors only apply if you pick a region outside Europe.

### Breach notice

The processor must tell you about a breach "without undue delay" under Article 33(2). That phrase has no hour count attached, yet you as controller must report to the supervisory authority within 72 hours of becoming aware, where feasible. If your incident plan needs a figure, ask for one before signing.

### End of the contract

Article 28(3)(g) gives you the choice between deletion and return, and requires existing copies to be deleted unless the law says to keep them. Backups are the copies most often left vague. Check whether you can export your data yourself, how long you have after termination, and whether backups have an expiry date.

### Audits

Article 28(3)(h) requires the host to give you the information needed to show compliance and to allow audits, including inspections. Shared platforms narrow this, as the comparison below shows: one audit a year, a written plan weeks ahead, your costs, nothing that exposes other tenants. Limits like these are reasonable. A DPA with no audit right and no report on offer isn't.

## How four hosts word it

| Point | Hetzner | Sliplane | Scalingo | Eurobase |
|---|---|---|---|---|
| How you conclude it | Checkbox in your customer account, no handwritten signature | Accepted in the dashboard, executed copy downloadable | Part of the main agreement, takes effect with it | Part of accepted customer terms, checkout terms or an order form |
| Your data described | You pick data types and data subjects, recorded in Appendix 1 | Listed categories in Section 1 | Table of processing operations | Listed in the DPA, including visitor IPs, paths and user agents in access logs |
| New subprocessor | Not documented | Advance notice; if you object, you may terminate on 30 days' notice | 8 calendar days to contest in writing, only on listed grounds | Advance notice, 30 days to object; Eurobase resolves it, avoids the processing or lets you end the affected service |
| Breach notice | Not documented | Prompt reporting, no hours stated | As soon as possible, no hours stated | Help under Articles 33 and 34, no hours stated |
| End of contract | Not documented | Delete or return at your choice, copies deleted | Self-service export any time, deletion under the general terms | Delete or return at your choice; no fixed deadline or backup expiry confirmed |
| Audits | Annual external review of measures, report in your account | Sample checks announced in advance, a reasonable fee possible | One audit a year, a plan 4 weeks ahead, your cost including staff time | Reasonable, scoped to your data, protective of other tenants |

Each row is taken from the provider's own DPA or data protection page, read on 10 November 2026.

Hetzner also lets you keep up to six DPAs at once when your data changes, and Sliplane's DPA ties any processing outside the EU/EEA to the region you choose.

## Where Eurobase fits

Eurobase, a business registered in Warsaw, Poland, hosts your apps on European infrastructure run by Scaleway, a French provider. Its [DPA](/legal/dpa) makes you the controller for workload data and Eurobase the processor, and it names access logs with visitor IP addresses as data it processes. The [subprocessor list](/legal/subprocessors) names GitHub and GitLab Inc. as US entities; they come into play only if you link a repository hosted there, and Codeberg, based in Germany, is the EU alternative.

The DPA gives no hour count for breach help, and it says openly that no end-of-service deletion deadline or backup expiry is confirmed yet. If either point matters for your contract, put the question to privacy@eurobase.dev before launch. Neither ISO 27001 nor SOC 2 is held yet; both are in progress. Log cleanup periods are in the [retention table](/legal/privacy#retention); [how long you can keep logs](/i/log-retention-gdpr) covers the rules.

## A short review routine

1. Save the accepted version with its date.
2. Check the annex against what your app stores, request logs included.
3. Mark every subprocessor outside the EEA and when it applies.
4. Write down the objection window, breach wording, deletion timeline and any fees.
5. Ask open questions in writing and file the answers with your records of processing.

## Frequently asked questions

### Do I have to sign a DPA with my hosting company?

Yes, if it processes personal data for you, such as a database or access logs. Article 28(9) accepts electronic form, so accepting the host's DPA in its dashboard counts as long as you can show it was accepted.

### Can I use the European Commission's standard clauses instead of the host's DPA?

Article 28(7) lets the Commission set standard contractual clauses for processor contracts, and it adopted a set for controllers and processors in the EU/EEA on 4 June 2021. Using them is a choice, not a duty, and a host with a standard DPA may not agree to swap its own terms.

### Is a DPA the same as standard contractual clauses for transfers?

No. A DPA sets the duties between you and your processor. Transfer clauses are one of the safeguards Article 46 allows for sending data outside the EEA. If a host or one of its subprocessors moves data to a country without an adequacy decision, you need the DPA plus a transfer safeguard such as those clauses.

### What if the host changes a subprocessor and I disagree?

Object within the DPA's window. Depending on the wording, the host may resolve it, avoid the processing or let you leave.

## Sources

- [GDPR Article 28 text on gdpr-info.eu](https://gdpr-info.eu/art-28-gdpr/)
- [European Commission: standard contractual clauses for controllers and processors in the EU/EEA](https://commission.europa.eu/publications/standard-contractual-clauses-controllers-and-processors-eueea_en)
- [EDPB Guidelines 07/2020 on the concepts of controller and processor](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en)
- [Hetzner: data protection and DPA questions](https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/)
- [Sliplane Data Processing Agreement](https://sliplane.io/legal/dpa)
- [Scalingo Data Processing Agreement](https://scalingo.com/data-processing-agreement)
- [Eurobase DPA](/legal/dpa), [Eurobase subprocessors](/legal/subprocessors) and [Eurobase privacy and retention](/legal/privacy#retention)