Data protection and hosting: a GDPR guide

There is hardly a website that does not process personal data. A contact form, a newsletter subscription, an online shop order – even IP addresses recorded in server log files are considered personal data. For this reason, the GDPR – the European Union’s General Data Protection Regulation – applies to virtually every website owner, including small businesses and websites run by private individuals.

In this guide, we’ll look at the relationship between data protection and hosting: who is responsible for what – the website owner or the hosting provider – what technical safeguards the hosting provider must provide, what should be included in the privacy policy and cookie policy, what to do following a data breach, and what changes are coming in 2026. You’ll also find a checklist at the end.

This article is for general information purposes only and does not constitute legal advice. To assess a specific data processing operation, please consult a data protection specialist.

What personal data is stored on your hosting account?

Personal data is any information that can be linked to a living person. On an average website hosting service, the following types of data are encountered:

Server logs: for every request, the web server records the visitor’s IP address, the page requested, the time and the browser details. According to the case law of the Court of Justice of the European Union, an IP address may constitute personal data.
Forms: contact us, request a quote, registration: name, email address, telephone number, message.
Database: WordPress user and commenter data, as well as an online shop’s customer details, orders and delivery addresses.
Email: messages stored in mailboxes and the address book.
Cookies and tracking codes: analytics and marketing cookies store identifiers and often transmit data to third parties (such as Google or Meta).
Backups: backups contain copies of all of the above and must be protected in the same way.

Data controller and data processor: who is responsible for what?

The GDPR distinguishes between two roles, and responsibility is divided accordingly.

You are the website owner or the data controller. You decide what data you collect, for what purpose, on what legal basis and for how long. It is your responsibility to inform visitors, comply with their requests (access, rectification, erasure), and ensure that your website’s software (WordPress, plugins and themes) is up to date and secure.

The web hosting provider is the data processor. It stores and processes data on behalf of the data controller and in accordance with the controller’s instructions: it operates the server, protects the network and the operating system, and creates backups. It may not use the data for its own purposes.

The relationship between the two parties must be set out in a data processing agreement in accordance with Article 28 of the GDPR. This sets out what data the service provider processes, for what purposes, what security measures it applies, who it may involve (subcontractors), and how it assists the data controller in the event of an incident or a request from a data subject. At aWh, in accordance with our General Terms and Conditions, we enter into a data processing agreement if you entrust us with the processing of personal data; please contact us if you require one.

Responsibility is therefore shared, but not blurred. If a breach occurs via the server’s operating system, it is the provider’s fault. If it occurs via an outdated WordPress plugin or a leaked password, it is the data controller’s fault. With a VPS, the line is drawn elsewhere: there, updating the operating system and protecting the server are your responsibility.

What should you expect from your hosting provider?

Article 32 of the GDPR stipulates technical and organisational measures that are ‘proportionate to the risk’, without specifying any particular technology. In practice, it is reasonable to expect a hosting provider to implement these measures.

Data location

If the server is located in the European Union (or, more precisely, the European Economic Area), no specific legal basis for data transfer is required for data storage. With a provider outside the EU, such as a US cloud service provider, a specific guarantee is required for data transfer: for US companies, this typically involves certification under the EU–US Data Privacy Framework adopted in 2023, or the European Commission’s Standard Contractual Clauses. The legality of the framework was confirmed by the General Court of the European Union in 2025, but the legal dispute surrounding it has not yet been resolved; therefore, storage within the EU is the more predictable solution. Ask the service provider where its servers and backups are located.

Encryption

HTTPS across the entire site: data entered into forms, login details and cookies should only be transmitted via an encrypted connection. The free Let’s Encrypt certificate is sufficient for this and can be set up automatically on all aWh hosting plans; a paid SSL certificate is required if you also wish to have your company’s details verified.
Encrypted email: IMAPS, POP3S and SMTPS (TLS) between the email client and the server; webmail via HTTPS.
Encrypted file transfer: use SFTP or FTPS instead of FTP, as standard FTP sends passwords in plain text.

Access protection

Most hacks begin with a stolen or guessed password. Enable two-factor authentication (2FA) in your hosting control panel (here’s how to do it in cPanel), in your customer account and in the WordPress admin panel. Everyone working on the website should have their own account and only the permissions necessary for their work; revoke access for staff who have left or external developers.

Server-side protection

With shared hosting, the provider is responsible for server security: system updates, the firewall, DDoS filtering and malware scanning. On aWh’s cPanel servers, ImunifyAV+ scans for malware, whilst CloudLinux CageFS isolates accounts from one another, meaning that a compromised neighbouring account cannot access your files.

Backup and recovery

Article 32 of the GDPR explicitly requires that, following an incident, data must be restored in a timely manner. This requires regular backups stored separately from the server. Automatic backups are created for aWh’s paid hosting plans (daily for cPanel and WordPress hosting), which we store at a geographically separate location. Bear in mind that deleted data remains in the backups for a certain period; it is advisable to mention this in your privacy policy.

Log retention

Server logs are needed for troubleshooting and investigating attacks, but they do not need to be kept indefinitely. Ask your provider how long they retain the logs for the web server and mail server, and include this information in the information sheet.

Your tasks on the website

Privacy Policy

Every website needs an easily accessible, clear privacy policy. This should include:

the name and contact details of the data controller (you or your company),
what data you process, for what purpose and on what legal basis (consent, performance of a contract, legal obligation, legitimate interest),
How long do you retain the data,
List of data processors: the web hosting provider, the newsletter service provider, the invoicing software, the courier service, the analytics provider, the payment service provider,
If applicable, data transfers outside the EU and the associated safeguards,
the rights of data subjects and where they can lodge a complaint (in Hungary, with the National Authority for Data Protection and Freedom of Information, the NAIH).

Do not simply copy a template without making any changes: the privacy notice must describe your actual data processing practices. If you introduce a new tool (a new email marketing platform, new analytics tool or chatbot), update the notice, and review it once a year even if nothing has changed.

Forms and data minimisation

Only ask for as much data as is strictly necessary for the purpose: a name and email address are sufficient for making contact; a telephone number should be optional. Where you request consent (for example, for a newsletter), the tick box should not be pre-ticked, and consent should not be a condition of the service. Do not retain emails and database entries received via forms for longer than is necessary.

Cookies and tracking codes

Under the Hungarian Electronic Communications Act (and, underpinning it, the EU ePrivacy Directive), cookies that are not strictly necessary for the operation of the website – such as analytics and marketing cookies – require the visitor’s prior consent. In practice, this means:

Do not load any tracking code (Google Analytics, Meta Pixel and similar) before the cookie banner has been accepted.
The ‘Decline’ option should be just as easy to access as the ‘Accept’ option.
Consent should be revocable at any time, for example via a link in the footer.
From 2024, Google will also require the Consent Mode v2 setting to be enabled in the EEA for the use of Google Analytics and Google Ads.

There are also smaller, often overlooked instances of data transfer: if your website loads fonts from Google’s servers (Google Fonts) or uses embedded YouTube videos or maps, the visitor’s IP address is sent to Google as soon as the page is opened. Download the fonts and serve them from your own hosting, and load videos and maps only on click.

At the end of 2025, the European Commission put forward a proposal known as the ‘Digital Omnibus’ to simplify cookie regulations, including consent indicators that can be configured in the browser. This is currently only a proposal and not yet a regulation in force, so the above requirements remain applicable.

Under Hungary’s Commercial Advertising Act, you may only send emails containing advertising to those who have given their prior, explicit consent. Double opt-in – where the subscriber confirms their email address by clicking on a link received in an email – is not mandatory in all cases, but it is the simplest way to prove that the consent genuinely comes from the owner of the email address. Every email should include a simple option to unsubscribe. Do not send newsletters from your hosting provider’s mail server; instead, use a dedicated newsletter service that manages both subscriptions and unsubscriptions.

Requests from data subjects

Your visitors may ask you to tell them what data you hold about them, to provide a copy of it, or to correct or delete it. You must respond to these requests within one month (this may be renewed for a further two months where justified). It’s worth knowing in advance where the data is located: in the WordPress database, the email inbox, the newsletter sender or the invoicing software. WordPress’s built-in tools (Tools › Export or Delete Personal Data) provide assistance with data stored in the WordPress database.

Data breach: what should you do?

A data breach is any security incident in which personal data is destroyed, lost, altered or accessed by unauthorised parties: a hacked website, a stolen laptop, or a customer list sent to the wrong recipient.

Stop the problem: change your passwords everywhere, block the attacker and, if necessary, take the site offline.
Assess the damage: what data is affected, how many people are affected, and how long they have been affected. Your hosting provider can help with this using server logs and backups; if you are an aWh customer, please open a ticket.
Report it: if the incident poses a risk to data subjects, you must report it to the NAIH within 72 hours. If the risk is high (for example, if passwords, credit card details or health data have been leaked), you must also notify the data subjects.
Fix it: restore the site from a clean backup, update the software, and fix the vulnerability that allowed the attacker to gain access.
Document everything: you must keep a record of all incidents, including those that did not need to be reported.

Under the GDPR, the fine may amount to up to €20 million or 4 per cent of the company’s global turnover in the previous year in serious cases, and up to €10 million or 2 per cent in less serious cases. When determining the amount of the fine, the NAIH takes into account the severity of the infringement, the size of the company and the measures taken by the data controller to mitigate the damage. A well-documented incident reported in a timely manner is far better than one that has been concealed.

What has changed by 2026?

NIS2 and the Cybersecurity Act: the Hungarian regulations transposing the EU’s NIS2 Directive have, since 2024, imposed cybersecurity obligations on medium-sized and large enterprises in a number of sectors (energy, transport, healthcare, digital services, food processing, manufacturing and others). This does not directly affect the website of an average small business, but if your company falls within its scope, your website and email communications are also part of your risk management.
AI Act: the rules of the EU’s Artificial Intelligence Regulation are gradually coming into force. If your website runs an AI-based chatbot, users must be informed that they are conversing with a machine, and your privacy policy must also specify what data the chatbot provider receives.
Data Act: Applicable from September 2025, it primarily concerns data from connected devices and switching between cloud services; it facilitates switching providers and data portability.
Shorter SSL validity periods: since March 2026, public SSL certificates have been valid for a maximum of 200 days, and this period will be further reduced in the coming years. An expired certificate is not a data breach, but it does mean a loss of encryption, so it is worth automating the certificate renewal process.

Summary

GDPR compliance is not a one-off document, but an ongoing process on which the website owner and the hosting provider work together. The provider is responsible for server security, backups and the obligations set out in the data processing agreement; whilst you are responsible for the purpose of data processing, providing information, managing cookies and ensuring the security of your website’s software.

On aWh’s hosting plans, HTTPS, two-factor authentication, off-site backups, DDoS filtering and malware scanning on our cPanel servers provide technical support. If you have any questions regarding data processing, please contact us.

Take a look at our hosting plans

Frequently Asked Questions

Yes, if the website processes personal data – and almost all of them do: all it takes is a contact form, an analytics cookie or an IP address recorded in the server logs. The only exception is a website used purely for private, family purposes, but a public website is rarely of this nature.

Do I need to appoint a Data Protection Officer (DPO)?

Not for most small businesses. It is mandatory for public authorities, and if your main activity involves the large-scale, regular monitoring of people or the processing of large volumes of sensitive data (such as health data). For an average company website or online shop, it is sufficient to appoint an internal data protection officer.

Can I use a US-based service, such as Google Analytics?

Yes, but this requires the visitor’s prior consent; the privacy notice must specify the service provider and any data transfers outside the EU, and the service provider’s privacy settings must be configured (for example, IP address truncation and Consent Mode). If you wish to avoid this, there are also cookie-free analytics tools available that offer hosting within the EU or can be run on your own server.

Is a free SSL certificate enough?

As for encryption, yes: the free Let’s Encrypt certificate provides the same level of encryption as a paid one. Paid certificates differ in terms of the verification of the company’s details and the associated services; from a data protection perspective, they are not mandatory.

Who is liable if my website is hacked?

It depends on where the breach occurred. If the attacker gained access via the server’s operating system or the provider’s infrastructure, then the provider is responsible. If it was via an out-of-date plugin, a weak password or a poorly configured form, then you, as the data controller, are responsible. The obligation to report the breach rests with the data controller in both cases; the provider will assist with this.

WordPress includes data protection tools (a privacy policy page template, and the ability to export and delete personal data), but a plugin is usually required for the cookie banner and to manage consent. A plugin alone does not make a website compliant: the settings must reflect actual data processing practices, and it must be verified that tracking codes are only loaded after consent has been given.

How long can I keep the data?

For as long as necessary to achieve the purpose, or for as long as required by law. For example, invoices and accounting documents must be retained for 8 years, whereas there is typically no justification for storing a contact enquiry for very long once the query has been answered. Include the retention periods in the privacy notice.

How much of a fine can I expect?

The GDPR allows for fines of up to €20 million or 4 per cent of a company’s annual global turnover, but the NAIH adjusts the amount according to the severity of the infringement and the size of the company. For small businesses, fines are typically several orders of magnitude lower; the authority often issues a warning first, calling for the infringement to be rectified. The best defence is documented, well-considered data processing.

data protection
legislation
web hosting
website security
guides

Data Protection and Hosting (GDPR): A Complete Guide for Website Owners