Every server you rent to hold personal data comes with a document you probably clicked through: the hosting data processing agreement. Under GDPR it is not optional paperwork. If you decide what goes on the server, you are the controller, the host is your processor, and Article 28 says you may only use processors that give sufficient guarantees, under a contract with specific contents. When your DPO or an auditor asks for the hosting DPA, they want those contents and evidence that somebody checked them.
This post is a working checklist for that review: who is controller and who is processor, the eight commitments Article 28(3) requires, the clauses that separate a useful hosting DPA from a box-ticking one, how our own DPA answers each item, the red flags, and what no DPA can do for you. This is not legal advice; for your own processing, ask your DPO or counsel.
Processor vs controller: who is who when you rent a server
The controller determines the purposes and means of processing; the processor processes personal data on the controller's behalf (Article 4(7) and 4(8)). For hosting the split is usually clean:
- You are the controller for what you put on the server: your customer database, application logs, users' uploads.
- The host is your processor for that content. It holds the disks and runs the hypervisor; it does not decide why your data exists.
- The host is a controller in its own right for your account. Your name, billing details and support tickets serve its own purposes, so they fall under its privacy policy, not the DPA.
Article 28(1) is why this is your problem: you must use only processors "providing sufficient guarantees". The DPA is the evidence you chose deliberately. The line can also move: a processor that starts deciding purposes and means is treated as a controller for that processing (Article 28(10)). For less clear-cut arrangements, the EDPB's Guidelines 07/2020 on controller and processor work through the grey areas.
What GDPR Article 28 requires from a hosting provider
Article 28(3) of the GDPR says the contract must set out the subject-matter, duration, nature and purpose of the processing, the types of personal data, the categories of data subjects, and your rights and obligations. The processor then commits to eight things:
- (a) Instructions. It processes only on your documented instructions, including on transfers to third countries, unless law requires otherwise (and then tells you first, unless that law forbids it).
- (b) Confidentiality. Everyone authorised to process the data is bound by it.
- (c) Security. It takes the measures Article 32 requires.
- (d) Sub-processors. It follows the conditions in 28(2) and 28(4).
- (e) Data subject rights. It helps you answer requests, as far as the service allows.
- (f) Your other duties. It assists with security, breach notification, impact assessments and prior consultation (Articles 32 to 36).
- (g) End of service. At your choice it deletes or returns the data, and deletes copies unless EU or member-state law requires storage.
- (h) Audits. It provides the information needed to demonstrate compliance and allows for and contributes to audits, including inspections.
It must also tell you immediately if it thinks an instruction of yours infringes data protection law. Three more paragraphs complete the minimum:
- Article 28(2): no sub-processor without your prior specific or general written authorisation. Under general authorisation, the norm in hosting, the host must inform you of intended changes so you can object.
- Article 28(4): the same obligations flow down to each sub-processor by contract, and the host remains fully liable to you for them.
- Article 28(9): the contract must be in writing, including in electronic form. A DPA accepted with the terms of service meets that; no wet signature is required.
Beyond the minimum: what a good hosting DPA adds
Most DPAs restate Article 28. The useful differences sit in what the regulation leaves open:
- A sub-processor notice period and an exit. The text sets no deadline for informing you. Look for a fixed period, notice by email, and what happens if your objection goes nowhere: can you leave without penalty, with prepaid fees refunded?
- Location and admin access. "Stored in the region you choose" is half the answer. The other half is who can administer the machine, and from where. Data in an EU data centre managed by a support desk on another continent is not data that stays in the EU.
- Transfers named, each with its safeguard. The Commission's adequacy decision for the EU–US Data Privacy Framework (10 July 2023) is in force at the time of writing, but both of its predecessors were invalidated by the Court of Justice, in 2015 and 2020. Check which safeguard each non-EEA sub-processor relies on, and whether Standard Contractual Clauses stand behind it.
- An hour figure on breach notice. Article 33(2) only says the processor tells you "without undue delay". Your own duty is sharper: notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people (Article 33(1)). A number on the host's side gives your incident process something to plan around.
- The rest in writing. What happens to disks and copies at the end, audit terms that are limited but real, a closed list of reasons staff may log in to your server, and notice before the DPA itself changes.
The hosting DPA checklist, with our answers
The third column is how our own data processing agreement (updated 1 October 2026) answers each item, so you can see what a filled-in row looks like, and hold us to it.
| Checklist item | What to look for | How Noded's DPA answers it |
|---|---|---|
| Roles | Controller and processor named; account data addressed | You are controller for your server content, X ZONE IT SRL is processor; for account and billing data we are controller, under the Privacy Policy |
| Instructions | Documented; panel and API actions count | The Terms, the DPA and your panel or API actions; we tell you if an instruction would infringe GDPR |
| Access to your server | A closed list of reasons | Only on your ticket request, to stop an ongoing security incident or abuse, or when law requires it |
| Security | Named measures | Staff under confidentiality; KVM isolation with own virtual disks; single-tenant dedicated servers; admin access limited to authorised staff; brute-force protection on nodes; HTTPS panel, hashed passwords, activity log |
| Sub-processors | Public list; obligations flow down | General authorisation; list on our sub-processors page; equivalent written obligations; we remain fully liable |
| Sub-processor changes | Notice, objection, exit | At least 30 days ahead, on that page and by email; you may object; if unresolved, terminate affected services without penalty, with prepaid fees refunded for the remaining period |
| Location and admin access | Data stays put; no admin access from outside the EEA | Data stays in the location you select and is not moved without your instruction; EU/EEA locations are administered only by staff in the EU, and no one outside the EEA has administrative access |
| Transfers outside the EEA | Each named, with its safeguard | For EU locations, one: Cloudflare, Inc., in the control panel and console path, under the EU–US Data Privacy Framework plus Standard Contractual Clauses. Ashburn stores data in the US on your instruction |
| Breach notice | An hour figure and Article 33(3) details | Without undue delay and, where feasible, within 48 hours, with the Article 33(3) information |
| Assistance | Data subject requests, Articles 32–36 | Assistance with both |
| Deletion | Disks and copies | Copy your data off any time; on termination the storage is destroyed and no copy is kept unless law requires it |
| Audits | Information first, then a real audit right | Information on request; if insufficient, an audit by you or an independent auditor, at least 30 days' notice, business hours, at most once per 12 months (except after a breach or regulator request), at your cost |
| Form, law, changes | Electronic form is fine; notice of changes | Part of the Terms, concluded electronically when you accept them; Romanian law; 30 days' notice of material changes, never reducing protection without your agreement |
A row you cannot fill from a host's published documents is a question to ask before you order. When you file the result, the host goes into your record of processing as a recipient (Article 30(1)(d)) and its non-EEA sub-processors under transfers (point (e)); keep a dated copy of both documents next to the record.
Red flags in a hosting DPA
- No published sub-processor list, or one without locations.
- "We may change sub-processors at any time", with no notice and no way to object.
- Unlimited access to your server "for any purpose we consider necessary".
- Vague locations, such as "the EU or other regions where our partners operate".
- Breach notice "as soon as reasonably practicable" with no backstop figure.
- No deletion commitment, or copies kept indefinitely.
- A DPA you cannot find. If only sales can send it, you will not notice when it changes.
None of these automatically makes a provider non-compliant. Each is a gap you will have to close or document yourself.
What a hosting DPA does not cover
A DPA covers the host's processing, not yours:
- Security inside the server is yours. Our DPA says so directly. Patching, firewalls, SSH keys and application security on the machine are your job; our server hardening checklist is a starting point.
- Backups are yours. Client snapshots are not available on our VPS, so a second copy in another location is something you build and test.
- Encryption is yours. Article 32(1)(a) names it; on a rented server you apply it, with keys you hold.
- Your records, DPIA and privacy notice are yours. A processor assists with an impact assessment; it does not write it.
- Location is your choice. Ashburn is in the United States; the EU-only administration commitment covers our EU/EEA locations. For EU-resident personal data, choose an EU location.
How Noded Can Help
Ours is public: read the data processing agreement and the sub-processor list, check them against the table above, and file a dated copy. It is concluded electronically when you accept our Terms, so there is nothing to sign. Then pick an EU location such as Bucharest, Sofia, Warsaw or Vienna on the VPS hosting page; a VPS I in Bucharest is €4 a month. Our GDPR-compliant hosting page and the EU-only hosting note cover data residency in more depth. If your DPO has a question the documents do not answer, open a ticket before you order.
FAQ
Is a hosting provider a data processor under GDPR?
For the personal data you store on your server, yes. For your account and billing data, the host is a controller in its own right.
Do I need to sign a DPA with my hosting provider?
You need one in writing, but Article 28(9) accepts electronic form, so a DPA accepted with the provider's terms counts. Ours works that way.
What should a hosting DPA say about sub-processors?
It should require your written authorisation, notify you of changes with a chance to object, and pass the same obligations down (Article 28(2) and 28(4)). Good ones add a published list, a fixed notice period and an exit.
How fast must a hosting provider report a data breach?
GDPR only says without undue delay; any hour figure comes from the DPA. Ours says where feasible within 48 hours. Your own deadline to the authority is 72 hours after becoming aware, where feasible.
Can I keep EU personal data in Ashburn?
Ashburn is in the United States. For EU-resident personal data, choose one of our EU locations, where servers are administered only by staff in the EU.