According to Rec.81; Art.28(1)-(3) of the GDPR regulation,
"The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller"
A controller that wishes to appoint a processor must only use processors that guarantee compliance with the GDPR. The controller must appoint the processor in the form of a binding written agreement, which states that the processor must:
- only act on the controller's documented instructions;
- impose confidentiality obligations on all personnel who process the relevant data;
- must ensure the security of the personal data that it processes;
- abide by the rules regarding appointment of sub-processors;
- implement measures to assist the controller in complying with the rights of data subjects;
- assist the controller in obtaining approval from DPAs where required;
- at the controller's election, either return or destroy the personal data at the end of the relationship (except as required by EU or Member State law);
- and provide the controller with all information necessary to demonstrate compliance with the GDPR.
I've checked every major host provider there is and none offers such guarantees.
So question is, how do I as a controller comply with GDPR if there's no host provider (aka processor) who'll sign a contract addressing all 8 points required by the GDPR?
The regulation clearly states that controller is responsible for this.