A frequent statement with respect to making German websites GDPR-compliant is that barely anything has changed in Germany with DSGVO (the German version of GDPR) and the previously applicable national law (BDSG).

At the same time, while many aspects of GDPR are still considered unclear or disputed, there seems to be pretty much a consensus in Germany that any website owner1 whose site is hosted on the server of a 3rd party will have to sign a contract for processing on behalf with the webhoster.2 This appears the case even if the webhoster merely handles visitors' IP addresses such as for security logging purposes.

While I concede companies and people as a whole used to be sloppy about former privacy laws and very late at starting to prepare for GDPR, the requirement for those specific contracts with webhosters are generally implied to be something new. Webhosting companies have started to offer the respective contract templates only recently as a part of their GDPR preparation, and articles point out these contracts as something to take care of to make one's site GDPR-ready, especially including non-commercial fan sites, blogs, and similar.

Was there3 a requirement to have such a contract with one's webhoster for non-commercial/hobbyist websites before GDPR? (If so, was it simply widely ignored, especially on sites hosted abroad, where hosters wouldn't know about (and be unwilling to sign?) such contracts?

EDIT: The only thorough essay on the topic I have found so far is a blogpost on CR-online (in German). It specifically addresses the situation of non-commerical and/or small services (coming to the conclusion that from the point of view of these services, the claim that "not much has changed" is a "myth") and points out that the obligations for internal documentation have been considerably extended. However, it does not concretely discuss any particular setups such as "running a website".

1: Except for websites maintained as a part of a "purely personal or household activity", but it seems disputed whether any publicly accessible website can meet these criteria at all.

2: My understanding is that the website owner ensures towards visitors the visitors' personal data will not be used for anything beyond what is stated in the site's privacy note, and the contract for processing on behalf is the website owner's legal handle to also ensure the webhoster does not exceed the boundaries of the privacy policy (or informs the website owner in time so they can update their privacy note).

3: Either from BDSG itselt, or based upon some EU-wide regulation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.