EU Web Hosting and GDPR: What to Check

November 2026 • Compliance

This page is general information, not legal advice. It rests on the text of the GDPR, EDPB documents, court and legal commentary, and the website of the Lithuanian State Data Protection Inspectorate, all fetched in November 2026. Law and case status can change quickly. The status of EU-US transfers is described as of the latest sources we could fetch, dated 17 September 2026. Statements about our service come from our product page.

EU web hosting means that your website and its data sit on servers in the European Union. That is useful, but it is not the same as GDPR compliant hosting. The GDPR does not certify servers or countries of hosting. It sets duties for you as controller and for the hosting provider as processor, and those duties depend on contracts, security measures and who can access the data.

This page explains what the GDPR requires of a hosting provider that offers GDPR compliant hosting, why ownership and sub-processors matter as much as location, and what the current legal position is for transfers to the United States. It ends with a checklist you can use with any provider, including us, and states plainly where our own product page is silent.

What the GDPR requires of a hosting provider

If you run a website with visitor, customer or user data, you are normally the controller. A hosting provider that stores or handles that data on your behalf is a processor. Three parts of the GDPR matter most when you choose GDPR compliant hosting.

Article 28: the processor contract

Article 28 says a processor may act only under a written contract, which can be electronic. The contract must set out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects. Among other points, it must require the processor to:

process personal data only on your documented instructions, including for transfers to third countries,
bind the staff who handle the data to confidentiality,
take the security measures required by Article 32,
follow the conditions for engaging sub-processors,
help you answer requests from data subjects,
delete or return all data at your choice when the service ends,
provide the information needed to show compliance and allow audits.

This is usually called a data processing agreement (DPA). On sub-processors, Article 28 requires your prior written authorisation, specific or general. With a general authorisation the processor must tell you about planned additions or replacements so that you can object. A sub-processor must be bound by the same obligations, and the first processor stays fully liable to you if the sub-processor fails.

Article 32: security of processing

Article 32(1) lists example measures that controllers and processors may use: pseudonymisation and encryption, keeping systems confidential, accurate, available and resilient, the ability to restore access to data quickly after an incident, and regular testing of how well the measures work. The article does not name a certification or a data centre class. A data centre rating does not by itself show that the GDPR is met.

Chapter V: transfers outside the EU (Articles 44 to 49)

Article	Title	What it means for hosting
44	General principle for transfers	Data may go to a third country only if Chapter V conditions are met. This also covers onward transfers.
45	Adequacy decisions	Transfers are allowed to countries or frameworks that the Commission has found adequate.
46	Appropriate safeguards	Without adequacy, safeguards such as standard contractual clauses or binding corporate rules can be used, with enforceable rights and effective remedies for data subjects.
47	Binding corporate rules	Internal rules binding a corporate group can support transfers within the group.
48	Transfers not authorised by Union law	A court or authority order from a third country is enforceable only if it rests on an international agreement in force with the EU or a Member State. The other transfer grounds are not affected.
49	Derogations	Limited exceptions for specific situations when the other tools are not available.

The EDPB defines a transfer by three criteria: the exporter is subject to the GDPR for the processing, the exporter discloses or makes the data available to an importer, and the importer is in a third country. Whether a particular access arrangement is a transfer is a legal question for each case.

EU location is not the same as GDPR compliance

EU data residency hosting, meaning a server in the EU, removes the simplest transfer problem: your data is not copied to a non-EU country by default. It does not answer other questions that the GDPR asks:

Is there an Article 28 contract that covers your use?
Does the provider apply Article 32 security measures, and can it show them?
Which sub-processors take part, and where are they located?
Can anyone outside the EU, such as a parent company, support staff or a sub-processor, access the data? If yes, on what transfer basis?
What happens to your data when you leave?

Ownership, parent companies and sub-processors

In Opinion 22/2024, adopted in October 2024, the EDPB says controllers should keep the identity details of all processors and sub-processors readily available at all times. It says the duty to verify that processors and sub-processors give sufficient guarantees applies whatever the risk, although the depth of checking can vary with risk. The initial processor should propose sub-processors that give sufficient guarantees, but the controller keeps the final decision and the responsibility. When a sub-processor transfers data outside the EEA, the processor prepares the transfer documentation and the controller should review it and be able to show it to the competent authority.

For you, this means asking who the provider is, who owns it, and which companies take part in running the service. A provider with servers in the EU but support or sub-processors in a third country may still be involved in a transfer.

The US CLOUD Act

Some customers ask whether a US-owned provider with EU servers can be required to hand over data. We make no claim about that here. The EDPB and the European Data Protection Supervisor adopted a joint reply to a European Parliament committee on the implications of the US CLOUD Act in July 2019, and it is the official document to read. Article 48 of the GDPR, summarised above, states the EU rule for foreign court orders.

EU-US transfers: Schrems II and the Data Privacy Framework

On 16 July 2020, in the case known as Schrems II (C-311/18), the Court of Justice declared the EU-US Privacy Shield invalid. It held that standard contractual clauses remain valid, but that the exporter must check, with the importer, whether the third country gives equivalent protection and must suspend the transfer if it does not.

The Privacy Shield was replaced by the EU-US Data Privacy Framework (DPF), which rests on a Commission adequacy decision of 2023. The DPF has been under legal and political pressure since. The table shows the position as of the sources we could fetch.

Date	Event	Source type
3 September 2025	The EU General Court dismissed the challenge by Philippe Latombe (case T-553/23) and upheld the adequacy decision.	Legal commentary
31 October 2025	Latombe appealed to the Court of Justice (case C-703/25 P). The appeal is limited to points of law.	Legal commentary
29 June 2026	The US Supreme Court decided Trump v. Slaughter. noyb said the ruling removes the independence of the FTC, which it says the DPF relies on.	noyb (NGO) statement
29 June 2026 (noyb's own date; some law-firm reports say 30 June)	noyb wrote to the Commission asking for an orderly withdrawal of the adequacy decision, and said it would file its own annulment action.	Legal commentary
31 July 2026	The EDPB asked the Commission to assess whether the ruling affects the DPF. It did not ask for suspension or declare the DPF invalid.	Trade press
17 September 2026	A law firm summary reports that the DPF remains valid, the appeal is still pending, the Commission is analysing the ruling, and no noyb action had been confirmed as filed.	Law firm article

In the sources we fetched, the DPF is still in force as of 17 September 2026 and no ruling on the appeal had been issued. We did not find a later ruling or a Commission withdrawal, but we could not read the court's own file. Check the Commission and the Court of Justice before you rely on the DPF.

The same law firm summary lists practical steps. They are useful for any hosting setup: identify which transfers rely on the DPF, directly or through vendors; have a fallback such as standard contractual clauses; ask vendors about contingency plans and documented transfer assessments; and consider supplementary measures such as encryption and keeping data in the EU. It also notes that the Danish authority has told controllers to revisit their transfer impact assessments.

The supervisory authority for a data centre in Vilnius

The State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI) describes itself as the independent supervisory authority for personal data protection in Lithuania, overseeing the application of the GDPR. It is the Lithuanian authority that handles complaints, issues orders and fines, and acts as lead authority in cross-border cases.

Do not assume that the data centre location decides which authority is competent for you. For cross-border processing, Article 56 bases the lead authority on the main establishment of the controller or processor in the EU. Your own establishment matters for your duties as controller.

Checklist: what to ask any hosting provider

Use these questions with every provider of EU web hosting, including us. The last column states where our product page stands. "Not stated" means that our product page does not say it. It does not mean that the answer is no.

Question	Why it matters	Where we stand
In which country are the servers?	Defines the starting point for Chapter V.	Tier III data centre in Vilnius, Lithuania. Data stays in the EU and the GDPR applies.
Is there a written data processing agreement under Article 28?	Required by law before the provider handles personal data for you.	Not stated on our product page.
Which sub-processors are used, and where are they?	You must authorise them and they carry the same duties.	Not stated on our product page.
Who owns the provider, and can non-EU entities access the data?	May create a transfer that needs a legal basis.	Not stated on our product page.
Are support staff or tools located outside the EU?	Remote access by a third-country entity can be a transfer.	Not stated on our product page.
Which security measures are in place (Article 32)?	You need to be able to show them.	Documented: firewall and ModSecurity WAF with OWASP rules, brute-force protection, ClamAV scanning, two-factor and passkey login, OS security patches, nightly backups on a separate storage array.
Are backups encrypted?	Backups hold the same personal data.	GPG AES-256 is available in the panel. It is off by default.
Does the provider hold security certifications?	A certificate can support, but not replace, your own assessment.	Not stated on our product page. We make no certification claim here.
What happens to the data when the contract ends?	Article 28 requires deletion or return at your choice.	Not stated on our product page.
How are personal data breaches reported to you?	You have your own duties after a breach.	Not stated on our product page.

If an answer is missing, ask us at info@cloudacropolis.com before you decide. We would rather you hear a gap from us than find it later.

Where PFHW fits, and where it does not

Our Managed Web Server fits you if you want EU web hosting with a dedicated virtual server in a Tier III data centre in Vilnius, managed by our engineers, with data kept in the EU and with the security features listed above. For many agencies and small businesses, a clear EU location and a managed security baseline reduce the number of open questions.

It is a hosting platform, not a compliance certificate. Using it does not make your website GDPR compliant. Your privacy notice, legal basis, cookie handling and application code remain your responsibility.
Gaps on our product page. The product page does not state our data processing terms, sub-processor list, ownership details, certifications or breach-notification process. If you need these, ask us in writing and compare the answers with the checklist above.
Email is separate. Mail runs on a separate Mailcow server in Vilnius and is an add-on, so check its terms on their own.
Backups. The GPG AES-256 option is off by default. Switch it on if backups leave your control.

Frequently asked questions

Is EU web hosting automatically GDPR compliant hosting?

No. EU data residency hosting avoids a default transfer outside the EU, but the GDPR also needs a processor contract under Article 28, security measures under Article 32, control of sub-processors and a lawful basis for any access from outside the EU.

Do I need a data processing agreement with my hosting provider?

If the provider handles personal data for you, Article 28 requires a written contract with set contents. It can be in electronic form. Ask the provider for its terms before you migrate.

Is the EU-US Data Privacy Framework still valid?

In the sources we fetched, yes, as of 17 September 2026. An appeal at the Court of Justice (C-703/25 P) was pending, and the EDPB had asked the Commission to assess a US Supreme Court ruling. Check current status before relying on it.

Does a Tier III data centre make hosting GDPR compliant?

No. A data centre rating is not a GDPR test. The GDPR looks at contracts, security measures, transfers and accountability.

Which authority supervises hosting in Lithuania?

The State Data Protection Inspectorate (VDAI) describes itself as the independent supervisory authority for personal data protection in Lithuania. The competent authority for your own business depends on where you are established.

What should I do first?

Write down which personal data your sites hold, which providers and sub-processors touch it, and where they are located. Then ask each provider the questions in the checklist.

EU web hosting and GDPR: what an EU location does and does not guarantee