# GDPR hosting checklist: what to get from your provider in 2026

Last updated: 2026-11-10

When your host stores or runs personal data for you, you're the controller and the host is your processor. The GDPR then expects six things from it: a written processing agreement, control over its subprocessors, a clear answer on where data goes, security measures that include logs and backups, prompt breach notice, and deletion or return of data when you leave. If one is missing, your compliance has a gap that your own code can't close.

This guide isn't legal advice. It points you to the text of the law and to the European Data Protection Board, the EDPB, so you can check each answer yourself.

## The checklist at a glance

| What to get | Where the GDPR asks for it | What to look for |
|---|---|---|
| A data processing agreement | Article 28(3) and 28(9) | Written terms naming the subject, duration, data types and both parties' duties |
| A subprocessor list with change notice | Article 28(2) and 28(4) | A public list, advance notice of changes, a way to object |
| Data location and transfer safeguards | Chapter V, Articles 44 to 49 | Every country data reaches, and the legal basis for each one outside the EEA |
| Security, logs and backups | Article 32 | Concrete measures, retention periods, restore ability |
| Breach notice | Article 33(2) | Notice to you without undue delay, a contact point, what the notice contains |
| Deletion or return at the end | Article 28(3)(g) | Your choice of delete or return, including copies |

## A data processing agreement

Article 28(3) says processing by a processor must be governed by a contract that is binding on it and sets out the subject matter and duration, the nature and purpose, the type of personal data and the categories of data subjects. It must also commit the processor to act only on your documented instructions, bind its staff to confidentiality, take the Article 32 security measures, help you answer data subject requests and allow audits. Article 28(9) requires that contract in writing, which includes electronic form.

The EDPB adds a useful test in its Guidelines 07/2020: the agreement shouldn't merely restate the GDPR. It should say concretely how each requirement will be met. A one-page clause that copies Article 28 word for word is a weak sign.

**Eurobase:** the [DPA](/legal/dpa) forms the Article 28 agreement once it's part of accepted customer terms. You're the controller for your workload data, and Eurobase is the processor. It lists the data involved, including the visitor IP addresses, request paths and user agents in project access logs. Audit requests go to privacy@eurobase.dev and must be reasonable and protect other tenants.

## Subprocessors you can see and object to

A host rarely runs everything itself. Article 28(2) lets it bring in another processor only with your prior written authorisation. With a general authorisation, it must tell you about added or replaced subprocessors so you can object. Article 28(4) says the same obligations must pass down to each subprocessor, and the first processor stays fully liable for them.

The EDPB suggests the contract set a reasonable timeframe for objections and say what happens if you object.

**Eurobase:** the [subprocessor list](/legal/subprocessors) names five providers. Scaleway SAS, a French provider, runs hosting, runtime, database, storage and email delivery. GitHub, Inc. and GitLab Inc. are in the United States and are only active when you connect a repository from them. Codeberg e.V. is in Germany. Stripe handles billing. Eurobase gives advance notice of a new or replaced subprocessor, and you have 30 days after notice to object.

## Where the data goes, and how transfers are covered

Chapter V of the GDPR sets the rules for sending personal data outside the EU. Article 44 says any transfer to a third country must meet the conditions of that chapter, including onward transfers. The two common routes are an adequacy decision under Article 45, or appropriate safeguards under Article 46, such as the standard contractual clauses the European Commission adopted on 4 June 2021.

The Commission's adequacy list covers, among others, Switzerland, the United Kingdom, Japan and US companies that take part in the EU-US Data Privacy Framework. Check the current list on the Commission's page rather than relying on a summary.

Two EDPB points from Guidelines 05/2021 matter for hosting:

- **Remote access counts.** Support or admin staff viewing data from a third country, even on screen, can be a transfer.
- **An EU company can still carry risk.** If your processor is in the EU but subject to a third country's law with extraterritorial effect, it isn't a transfer by itself. The EDPB says you should still assess that before you choose the processor, because Article 28(1) asks for sufficient guarantees.

**Eurobase:** your apps run on European infrastructure operated by Scaleway, a French provider, and the business is registered in Warsaw, Poland. The US subprocessors are GitHub and GitLab Inc., used only if you connect them, and their transfers rely on their own contractual safeguards. If you'd rather keep your code in Europe too, you can connect Codeberg instead. Read [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act) for the ownership side of this question.

## Security, logs and backups

Article 32 asks both the controller and the processor for measures appropriate to the risk. It names pseudonymisation and encryption, the ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore data in a timely manner after an incident, and regular testing of those measures.

Logs and backups are where hosting deals often go quiet. Ask how long access logs keep IP addresses, and how long backup copies live after you delete something. Article 5(1)(e) expects personal data to be kept no longer than needed, and that applies to logs as much as to your database.

A certification can help show sufficient guarantees under Article 28(5), but it doesn't replace reading the terms.

**Eurobase:** the DPA lists access control, least privilege, tenant isolation, secret handling, logging, backups, incident handling and production change control. The [retention table](/legal/privacy#retention) says project access logs can be deleted 30 days after they're recorded, sometimes later. Backups are kept on their own schedule, and no fixed backup expiry is confirmed yet. ISO 27001 and SOC 2 are in progress and not yet held.

## Breach notice

Article 33(1) gives you, the controller, 72 hours where feasible to notify your supervisory authority after becoming aware of a breach. You can only meet that if your host tells you quickly. Article 33(2) says the processor must notify the controller without undue delay after becoming aware of a breach.

The EDPB suggests the contract may set a specific number of hours, a contact point and the minimum content of the notice. The legal duty to notify the authority stays with you.

**Eurobase:** the DPA commits Eurobase to help with breach handling under Articles 33 and 34. It doesn't set a fixed number of hours. If your own risk assessment needs one, ask at privacy@eurobase.dev before you sign.

## Deletion or return when you leave

Article 28(3)(g) says the processor must, at your choice, delete or return all personal data after the service ends, and delete existing copies unless EU or national law requires storage. The EDPB adds that deletion should be secure and confirmed to you within an agreed timescale.

**Eurobase:** the DPA gives you that choice and takes instructions at privacy@eurobase.dev. It also states that no end-of-service deletion deadline is confirmed yet, and that remaining copies are handled with each request.

## How to use this checklist

1. Map what personal data your app handles, including what lands in request logs.
2. Read the host's DPA and subprocessor list against the table above.
3. Write down every country your data can reach, including through support access and code hosting.
4. Ask in writing for any answer that's missing, such as a breach notice window or a backup expiry.
5. Record the answers in your records of processing, since Article 5(2) makes you responsible for showing compliance.

## Frequently asked questions

### Do I need a DPA with my hosting provider?

Yes, if the host processes personal data on your behalf, which includes storing your database or access logs. Article 28(3) requires a binding contract, and Article 28(9) says it must be in writing, which includes electronic form.

### Is hosting in an EU data centre enough for GDPR?

Not on its own. Location helps with Chapter V, but you still need a processor agreement, security measures, breach notice and deletion terms. The EDPB also notes that remote access from outside the EU can count as a transfer.

### Can I use a US hosting provider under GDPR?

The GDPR doesn't ban it. Transfers to US companies in the EU-US Data Privacy Framework are covered by an adequacy decision, and standard contractual clauses are another route. You still need every other point on this list.

### What should a subprocessor list include?

Each provider's legal entity, its country, what it does and what data it sees. The terms around the list should explain how you'll hear about changes and how you can object.

### How fast must a host tell me about a data breach?

The GDPR says without undue delay, with no fixed hour count for processors. Your own deadline to the authority is 72 hours where feasible, so agree a concrete window in the contract.

## Sources

- [GDPR, Regulation (EU) 2016/679, on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679): Articles 5, 28, 32, 33, 44, 45 and 46
- [EDPB Guidelines 07/2020 on the concepts of controller and processor](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en)
- [EDPB Guidelines 05/2021 on the interplay between Article 3 and Chapter V](https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052021-interplay-between-application-article-3_en)
- [European Commission: standard contractual clauses](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en)
- [European Commission: adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en)
- [Eurobase DPA](/legal/dpa), [Eurobase subprocessors](/legal/subprocessors) and [Eurobase privacy and retention](/legal/privacy#retention)