The GDPR (EU Regulation 2016/679) requires a site that processes personal data of people in the European Union to meet technical and organizational requirements, regardless of where the server is located. This article covers the parts of the regulation that directly concern a site and hosting administrator: roles, the processing agreement, breach notification deadlines, and user rights. This article does not replace legal advice — conclusions about a specific site should be checked with a qualified lawyer.
Roles: controller and processor
The regulation distinguishes between a controller — the one who determines the purposes and means of processing personal data — and a processor, who processes data on the controller's behalf. A site owner who collects visitor data through a form or an online store is usually the controller; the hosting provider whose servers store that data is usually the processor.
This split of roles is not a mere formality: the regulation directly places on the controller a duty to choose processors that offer sufficient guarantees of data protection and to sign a processing agreement with them rather than simply trust the infrastructure.
Data processing agreement
Article 28 of the regulation requires the relationship between a controller and a processor to be set out in a Data Processing Agreement (DPA): it describes what data is processed, for what purpose, and for how long. The regulation does not treat an oral agreement or general terms of service without a separate DPA as sufficient grounds.
If a site uses third-party services — analytics, a payment provider, email marketing — each of them is also a processor (or sub-processor) with respect to visitor data, and a processing agreement is needed with them too, not only with the hosting provider.
Technical and organizational measures
Article 32 of the regulation requires the controller and processor to apply technical and organizational measures appropriate to the risk of processing: data encryption, access control, event logging, and the ability to restore access to data after an incident. The regulation does not fix a specific set of measures — they must match the nature and scope of the data being processed.
In practice this means protecting the web application from common attacks, for example through Content Security Policy, and logging access and changes on the server, described in the article "Linux security auditing with auditd": both tools help prevent an incident and record what happened.
Data breach notification
Article 33 of the regulation requires the controller to notify the supervisory authority of a personal data breach no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If notification is given later than 72 hours, the regulation requires an explanation for the delay to be attached.
Article 34 additionally requires notifying the data subjects themselves without undue delay if the breach poses a high risk to their rights and freedoms — for example, passwords are compromised without encryption. If the processor (the hosting provider) discovers the breach first, it must notify the controller without undue delay, while notifying the supervisory authority further on is the controller's duty.
Data subject rights and backups
The regulation gives a user several rights regarding their personal data: the right of access, the right to rectification, the right to erasure ("the right to be forgotten"), the right to restriction of processing, the right to data portability, and the right to object to processing. The controller must respond to such requests within a reasonable time, set by the regulation as a general rule of one month, with a possible extension for complex requests.
The right to erasure creates practical tension with backups: data removed from the live database usually keeps existing in backups until their retention period ends. The regulation does not require sifting through already-made backups for every erasure request, but it does require that the backup retention policy, described for example in the article "How to create a website backup", be documented and match the stated data retention periods.
- A data processing agreement is signed with every processor, including hosting
- The backup retention policy matches the retention periods for personal data
- There is a procedure for notifying the supervisory authority within 72 hours
- The site's form asks only for data that is actually needed
- There is a procedure for handling user requests about access and erasure
| Requirement | Article of the regulation | Deadline/requirement |
|---|---|---|
| Notifying the supervisory authority of a breach | Article 33 | no later than 72 hours |
| Notifying data subjects of a breach | Article 34 | without undue delay, where risk is high |
| Responding to a data subject request | Article 12 | usually 1 month, extendable |
| Data processing agreement | Article 28 | mandatory between controller and processor |
# Minimal set of fields for an internal incident log (Article 33)
date_detected: YYYY-MM-DD HH:MM
data_categories: <which data categories are affected>
affected_records_estimate: <estimated number of records>
notified_authority_at: <date and time of notification>
notified_within_72h: yes/noFrequently asked questions
What if a site works only in Ukrainian or Russian and is not physically aimed at the European Union?
Whether the regulation applies does not depend on the interface language or the server's location, but on whether the site processes personal data of people in the European Union — for example, by selling goods or services that EU residents can order, or by tracking the behavior of EU visitors. An accurate assessment for a specific site should be made with a lawyer who examines the actual audience and processing method, not from a general description.
What fine applies for violating the GDPR?
The regulation sets two tiers of administrative fines in Article 83: up to EUR 10 million or 2% of annual turnover for less severe violations, and up to EUR 20 million or 4% of turnover for more severe ones, with the higher figure applying. This is the upper limit stated in the regulation, not a forecast for a specific case: the actual fine is set by the supervisory authority, and assessing it is a job for a lawyer, not a knowledge base article.
Does a hosting provider need separate user consent to process data?
No, the basis for the hosting provider processing data as a processor is the data processing agreement with the controller (the site owner), not separate consent from the end visitor. Visitor consent, where required by law for a specific operation — for example, for non-essential cookies — is obtained and handled by the controller, not directly by the hosting provider.