GDPR-Compliant VPS Hosting for Self-Hosters (2026)
Moving Nextcloud off Dropbox or Matomo off Google Analytics changes your legal position more than most guides admit. The moment your VPS stores someone else’s name, email, IP address or photo, you are the controller under GDPR, and your hosting provider is your processor. “It’s just my homelab” stops being true as soon as family members, club members or clients have accounts.
There is no such thing as a “GDPR-compliant VPS” you can buy. Compliance is a property of your setup, not of the provider. What a provider can do is give you the paperwork and the data residency that make compliance possible.
The one document you actually need
Article 28(3) GDPR requires a written contract between you and any processor handling personal data on your behalf. In German it is the Auftragsverarbeitungsvertrag (AVV); in English, a Data Processing Agreement (DPA). Without it, your hosting arrangement is non-compliant no matter how well you have configured the server.
All three major EU budget providers issue one from the control panel, at no extra cost:
| Provider | Where to get the DPA | Notes |
|---|---|---|
| Hetzner | Concluded directly in your customer account | Covers Art. 28 controller/processor duties; TOMs reviewed annually by TÜV Rheinland (i-sec GmbH) |
| Netcup | CCP → Master Data → Order Processing | Contract generator, no additional fees |
| Contabo | Control panel → Data Processing Agreement → “Create new” | Covers VPS, VDS, dedicated, Object Storage, colocation |
Contabo will additionally offer EU Standard Contractual Clauses if the server location you picked sits outside the EU — worth knowing, because Contabo sells US and Asian regions at the same price as its German ones.
Where the data physically sits
Region choice is the part people get wrong, because providers mix EU and non-EU locations behind one login.
Hetzner draws an explicit distinction here. Falkenstein, Nuremberg and Helsinki keep both your customer master data and your server data inside the EU. Ashburn (Virginia), Hillsboro (Oregon) and Singapore are also on the menu — for those, server data leaves the EU while customer master data stays in the EU. Picking a US region on a German provider does not keep your users’ files in Europe.
Netcup runs Nuremberg and Vienna. Contabo’s cheapest tier defaults to Germany but sells US, UK, Singapore and Australia regions from the same dropdown.
The practical rule: pick the region deliberately at provisioning time, then verify it afterwards rather than trusting the default.
The US-provider question is not settled
DigitalOcean, Vultr and Akamai/Linode all operate EU datacentres, and all three are US-headquartered. That matters because the CLOUD Act reaches US companies regardless of where the hardware sits, which is a separate question from whether the datacentre is in Frankfurt.
The legal ground here is genuinely unstable, so treat any guide that speaks with certainty as out of date:
- The European Commission’s July 2023 adequacy decision for the EU-US Data Privacy Framework is valid law today.
- On 3 September 2025 the EU General Court dismissed Philippe Latombe’s challenge to it, finding the Data Protection Review Court sufficiently independent.
- Latombe appealed on 31 October 2025. The appeal is before the Court of Justice as Case C-703/25 P and remains pending, with no hearing date announced as of May 2026.
- Two supporting pillars are shaky: the PCLOB, which oversees the framework’s intelligence safeguards, is in legal limbo, and FISA Section 702 is running on a short-term extension.
If the CJEU rules against the framework on the merits, it would be the third transatlantic transfer mechanism struck down after Safe Harbour and Privacy Shield. For a self-hoster the pragmatic reading is simple: an EU-owned provider in an EU region sidesteps the entire question, and costs no more.
What GDPR asks of the server itself
Article 32 requires security “appropriate to the risk” rather than a fixed checklist, which is why generic advice is useless. Concretely, for a single-VPS setup:
- Encrypt backups, not just the disk. Provider snapshots usually sit unencrypted in the same account.
resticorborgwith a passphrase, pushed to separate storage, is the meaningful control. - Know where backups land. A Hetzner server in Falkenstein backing up to a US S3 bucket is a transfer you have to document.
- Cut log retention. Nginx and Traefik log full IP addresses by default, and an IP is personal data. Either anonymise the last octet or rotate aggressively — 7 to 14 days covers debugging without accumulating a liability.
- Keep an Art. 30 record. For most self-hosters this is one page: what you process, why, where it lives, who else touches it, how long you keep it.
- List your subprocessors. Your VPS host, your backup target, your mail relay and your CDN each count.
App-level notes
Nextcloud stores filenames, share links and login IPs — full scope, and its server logs need the same retention discipline as the reverse proxy.
Matomo and Plausible are the usual reason people migrate at all: both can run without cookies and without consent banners when configured to anonymise IPs, which is precisely what Google Analytics cannot offer. See how to self-host Plausible.
Vaultwarden holds an encrypted vault the server cannot read, but the account email and login timestamps are still personal data.
FAQs
Does a German provider make me GDPR-compliant?
No. It removes the international-transfer problem and gives you an easy DPA, but the obligations that fail audits — the Art. 30 record, retention limits, breach notification within 72 hours, responding to access requests — sit with you as controller.
Do I need a DPA for a purely personal server?
If you are the only person whose data is on it, the household exemption generally applies and no DPA is needed. Hetzner notes this exception for private use. Add one external user with an account and the exemption stops applying.
Is Hetzner or Netcup better for GDPR?
Neither has a legal edge; both are German companies offering an AVV from the panel. Decide on specs and price instead — see our Hetzner vs Netcup comparison and the full VPS comparison.
This is a practitioner’s summary, not legal advice. If you process health data, children’s data or anything at scale, talk to a data protection lawyer.