Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
If a web hosting service like GoDaddy or Wordpress.com is subject to GDPR, does it require they impose GDPR requirements on their clients?
Does it matter whether the client is subject to the GDPR or not?
Two related questions, not quite duplicates, that don't answer this specific question:
There are no such requirements. The “data controller” of a processing activity is responsible for GDPR compliance. A hosting service is a processor but not a controller with respect to the hosted websites. A processor becomes GDPR-compliant by only processing personal data as instructed by the controller.
More specifically:
Controller is whoever participates in determining the purposes and means of processing. There can be more than one data controller for an activity.
Controllers can outsource processing activities to a “data processor”. Per Art 28 GDPR, there must be a contract that requires the processor to only use the data as instructed by the controller, never for the processors' own purposes. The processor's duty is primarily to the controller, not to the data subjects.
The data processor cannot make decisions about the lawfulness of processing, and cannot respond to data subject requests unless instructed to do so by the controller.
Within the scope of such outsourcing, the data processor can determine some non-essential means of processing without becoming a controller as well.
The processor can also prepare a standardized service where a lot of decisions are made up front by the processor. But the client would still be the controller because the client made the decision to use that standardized service with all the features it entails. In this context, a standardized service could e.g. be a hosting contract that was not negotiated individually. This concept of a standardized service does not originate from the GDPR, but was used by the EDPB to explain responsibilities in a cloud computing context.
A hosting provider would still be controller with respect to its own website and activities like billing, but will typically act only as a data processor with respect to the client's websites.
Recommended further reading: EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR (PDF)
A lot of services advertise that they are “GDPR compliant”. But data processors have drastically simplified compliance responsibilities. Thus, using a GDPR-compliant service does not imply that the use of this service would be GDPR-compliant as well.
If it helps to think about this, consider that the GDPR was not created to torpedo the EU IT industry. If a processor were to only accept GDPR-compliant clients, this would have prevented EU companies from serving many non-EU clients. This would not have been in the EU's interest. Instead, the GDPR attempts to simplify compliance for both EU and non-EU companies – the goal is simplified data flows. This was necessary because before the GDPR, every EU member state had its own set of data protection laws.
The GDPR does not currently impose any such obligation on he host. The host might choose, as a matter of its own policies, not to host non-compliant sites, but is not obliged to do so. Some other law might impose such an obligation on a host, but I am not aware of any that does.
