GDPR for Ecommerce Hosting: What to Check in Italy

GDPR-compliant hosting means that your provider acts as your data processor under a written agreement, offers security measures suited to the risk, and is transparent about where your customers’ data is stored and who else can access it. The hosting alone does not make your store compliant. You remain the data controller, and you stay answerable for what happens to your customers’ data on the provider’s servers.

This guide is for owners and managers of online stores in Italy. It explains who is responsible for what, what the agreement with your host must contain, whether data must stay in Italy or the EU, which security safeguards to verify, and which obligations stay with you whatever hosting you choose.

TL;DR

• You are the data controller. Your host should be appointed as data processor, and you remain liable for the provider’s wrongdoing.
• A data processing agreement (DPA) is required. It must cover the subject, duration, purpose, data types and the processor’s duties.
• GDPR does not say “host in Italy”, but you must know where data is stored, who the sub-processors are and which legal tool covers any transfer outside the EEA.
• Verify encryption, backups, access control, testing and breach procedures with the host.
• Hosting is only one layer: privacy notice, consent, retention and customer rights are still your job.

Table of Contents

• Who is responsible for customer data when you use a host
• What “sufficient guarantees” means when you choose a host
• The data processing agreement: what it must include
• Does the data have to be hosted in Italy or the EU?
• Security safeguards to verify with your host
• Why compliant hosting does not make the store compliant
• A practical checklist before you sign or renew
• Our perspective on hosting and GDPR
• How Linkware can help
• FAQ

Who is responsible for customer data when you use a host

When your store runs on a hosting provider, the roles are defined by law, not by the sales page. The Italian data protection authority (Garante) explains in its cloud computing guidance that a company acting as data controller that moves processing to the cloud should appoint the provider as data processor, and remains liable for any wrongdoing by the provider. The same guidance expects the controller to check how personal data are used and stored, to assess the security measures and to know where the data sit.

The European Data Protection Board (EDPB) adds a useful nuance in its guide for small businesses: overall responsibility generally lies with the controller, but processors also have their own responsibilities. The processor helps you comply by carrying out processing with appropriate technical and organisational measures, following your instructions.

In practice, for an online store this means:

• You decide why and how customer data (names, addresses, emails, order history, payment references) are collected.
• Your host stores and processes it on your behalf, with no right to use it for its own purposes.
• Other suppliers around the store (payment gateways, email tools, analytics, the ERP connected to the shop) each need their own role and contract.

What “sufficient guarantees” means when you choose a host

The regulation sets a clear standard for the choice itself. Under Article 28, as reflected in Recital 81 of Regulation (EU) 2016/679, a controller must use only processors that provide sufficient guarantees in terms of expert knowledge, reliability and resources to implement technical and organisational measures meeting the Regulation’s requirements, including security of processing.

So choosing a host on price or storage space alone is not enough. You need to be able to show that you looked at the provider’s competence, its security measures and its contractual commitments. A short written record of that evaluation is good practice if you are ever asked how you selected the supplier.

The data processing agreement: what it must include

The agreement with your host is the core document. According to Recital 81 of the GDPR, the contract must set out the subject matter and duration of the processing, its nature and purposes, the type of personal data and the categories of data subjects.

The EDPB’s guide for small businesses lists what the processor must also commit to. Use it as a checklist when reading the host’s DPA:

The source for the table is the EDPB’s data controller or data processor guidance together with Recital 81. A well-drafted DPA also describes the security measures in place, the breach notification procedure, how sub-processors are used, and retention and deletion rules.

Two practical details are worth reading closely. First, the sub-processor clause: it should say who the sub-processors are (for example a data center operator or a backup service) and how you are told about changes. Second, the exit clause: what happens to your customer database and backups when you migrate to another platform or close the contract.

Does the data have to be hosted in Italy or the EU?

The regulation does not impose a general rule that an online store’s data must physically stay in Italy. What it requires is control: you must know where data are, and any transfer outside the EEA must be lawful.

The Garante’s guidance advises users to know the physical location of their data, including whether they will be moved to and processed by servers in Italy, in the EU or in a non-EU country, and to check that transfers to non-EU countries respect the safeguards of Italian and EU law. The same document notes that, in principle, transferring personal data, even transiently, to a country without an adequate level of protection is forbidden.

Hosting in Italy or in the EEA simplifies the picture, because it removes most transfer questions. Some cloud codes of conduct reflect this. The CISPE code, for example, requires that a provider lets customers choose to store and process their data entirely within the EEA. It also says that transfers outside the EEA must be agreed with the customer and comply with Chapter V of the GDPR.

If data leave the EEA

A transfer is possible when it rests on a valid tool. The EDPB lists the main options under Article 46: standard contractual clauses, binding corporate rules, codes of conduct, certification mechanisms and ad hoc contractual clauses. The same page stresses that the transfer conditions apply in addition to the rest of the GDPR, such as a proper legal basis, security measures and data minimization.

For the United States, the European Commission adopted an adequacy decision on 10 July 2023: transfers to organizations certified under the EU-US Data Privacy Framework may take place without further authorization. If a sub-processor of your host relies on it, ask for confirmation of that certification and check that the DPA names the transfer tool.

Also remember that a transfer is not only about where the server is. Remote support from a non-EEA team or a sub-processor with access to the data can count as well, so ask for the full picture.

Security safeguards to verify with your host

Article 32 requires controller and processor to implement technical and organizational measures appropriate to the risk. It names, among others, pseudonymization and encryption, ongoing confidentiality, integrity, availability and resilience of systems, the ability to restore access after a physical or technical incident, and a process for regularly testing and evaluating the measures.

The European Union’s Your Europe portal turns this into concrete website practices. According to its guide to securing a website with privacy in mind, you should:

• protect confidentiality with proper authentication such as multi-factor authentication and encrypted HTTPS connections;
• protect integrity with daily checks for altered files, security testing and an intrusion prevention system;
• ensure availability with emergency backup power and rigorous hardware maintenance.

Turn that into questions for your provider:

1. Is access to the control panel, SFTP and the database protected by multi-factor authentication?
2. Is HTTPS enforced on the whole store, including checkout and the admin area?
3. How often are backups made, where are they stored and for how long?
4. Are files monitored for unauthorized changes, and who reacts when something is found?
5. How are security updates handled for the server, the CMS and the plugins?
6. What is the procedure if a breach occurs, and how quickly will you be informed?

If you want a broader view of why these controls matter commercially, this article on why cybersecurity matters for ecommerce success covers the main risks for online stores.

For l'integrazione con WooCommerce shops, the host is only part of the security picture, because plugins and themes are a frequent weak point. Our guide on WooCommerce security: what to really check goes through the store-level checks.

Why compliant hosting does not make the store compliant

Even with a flawless host, several duties remain with you. The Your Europe portal lists what a website’s privacy notice must contain: your identity and contact details, the purposes and legal grounds of processing, your legitimate interests, all recipients of the data, any transfer outside the EU, the retention period and users’ rights. It also covers your appointed representative and the Data Protection Officer where applicable.

In an online store, this translates into a short list of things the host cannot do for you:

• Privacy notice and cookie banner that match what the store really does, including third-party scripts for analytics and advertising.
• Legal basis per purpose: order fulfillment, invoicing, newsletters and profiling do not share the same basis.
• Retention rules: how long you keep accounts, orders and abandoned carts, and who deletes them.
• Customer rights: a process to answer access, rectification and deletion requests, including data held in other systems.
• Contracts with every other supplier that touches customer data.

That last point matters for stores connected to a management system. Order, customer and invoice data usually flow between the shop and the ERP, so the same questions apply to both. We explain them in our guide to GDPR compliance for ERP systems. If you are choosing where the management system itself should run, see also ERP cloud vs on-premise for Italian SMEs.

A practical checklist before you sign or renew

Use this order. It keeps the review short and leaves a paper trail.

1. Map the data. List what the store collects and which systems receive it: shop, ERP, payment, shipping, email, analytics.
2. Confirm roles. You as controller, the host and each supplier as processor, in writing.
3. Read the DPA against the table above, paying attention to sub-processors and exit terms.
4. Confirm the location of production data and backups, and the transfer tool if anything leaves the EEA.
5. Check the security measures with the six questions in the previous section.
6. Align the store: privacy notice, cookie consent, retention schedule, rights procedure.
7. Record and review. Keep the documents together and revisit them when you change plugin, supplier or country of sale.

If you also manage returns and customer documents, returns management for ecommerce and document preservation rules are related areas where retention periods and data handling intersect.

Our perspective on hosting and GDPR

In our work with small and medium businesses, we see the same pattern: the store is built, the host is chosen on price, and only later does someone ask who is responsible for the customer data. By then, the contract, the ERP connection and the plugins are already in place.

We think hosting, store and management system should be reviewed together. Customer data travel from the shop to the ERP, to invoicing and to logistics, so a compliant host with a disconnected back office solves only part of the problem.

That is why each client works with a dedicated consultant who studies their processes and supports them directly, with no call center in between. Our team handles development and user assistance internally, so the people configuring your store and your ERP are the same people who answer your questions about where data are and who can access them.

Our managed hosting and services run in the cloud or on dedicated servers in Italy, which makes the location question simple to answer. We still recommend that every client keeps its own written record of roles, contracts and measures.

Claudio

How Linkware can help

We manage hosting, server maintenance and technical upkeep for online stores, with services active in the cloud or on dedicated servers in Italy. We can also review the privacy side of your site together with the hosting, so that the contract, the technical measures and the website notices describe the same reality.

Start from the managed hosting for sites and ecommerce page, or look at our GDPR and privacy consultancy for websites. If your shop is connected to a management system, our ERP and ecommerce integration services cover both sides under one consultant.

Request a consultation to review your hosting, store and ERP data flows with a dedicated Linkware consultant.

FAQ

Is GDPR-compliant hosting mandatory for an online store?

The GDPR does not use the label “compliant hosting”, but it requires you to use a processor that offers sufficient guarantees, under a contract that meets the Regulation. In practice, that means a host with a proper DPA and appropriate security measures. You remain responsible as controller.

Does my ecommerce server have to be in Italy?

No general rule requires Italian servers. You must know where data are stored and processed, and any transfer outside the EEA needs a valid tool such as standard contractual clauses or an adequacy decision. Hosting in Italy or the EEA keeps this simpler.

What should I ask my hosting provider for?

Ask for the DPA, the list of sub-processors, the location of production data and backups, and a description of security measures: encryption, multi-factor authentication, backups, testing and breach procedure. Also ask what happens to your data when the contract ends.

If my host is compliant, is my store compliant too?

Not automatically. You still need a privacy notice, valid legal bases, cookie consent, retention rules and a way to handle customer rights. Contracts with other suppliers, such as payment and email providers, also remain your responsibility.

Who is liable if the host has a data breach?

As controller, you remain liable for the provider’s wrongdoing, according to the Italian Garante’s cloud guidance. The processor also has its own obligations, and the DPA should set out how it supports you when an incident occurs.

Recommended

• Woocommerce Security: What to Really Check
• WooCommerce Speed Optimization: A Practical Guide for Italian Stores