privacy european-union data-storage gdpr
Does any host provider currently comply with GDPR?
<p>According to <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=EN" rel="nofollow noreferrer">Rec.81; Art.28(1)-(3) of the GDPR regulation</a>,</p>

<p>"The carrying-out of processing by a processor should be governed by a contract or other legal act under Union or Member State law, binding the processor to the controller"</p>

<p>A controller that wishes to appoint a processor must only use processors that guarantee compliance with the GDPR. The controller must appoint the processor in the form of a binding written agreement, which states that the processor must: </p>

<ul>
<li>only act on the controller's documented instructions; </li>
<li>impose    confidentiality obligations on all personnel who process
the relevant    data;</li>
<li>must ensure the security of the personal data that it processes;</li>
<li>abide by the rules regarding appointment of sub-processors;</li>
<li>implement measures to assist the controller in complying with the
rights of data subjects;</li>
<li>assist the controller in obtaining approval from DPAs where required;</li>
<li>at the controller's election, either return or destroy the personal
data at the end of the relationship (except as required by EU or
Member State law);</li>
<li>and provide the controller with all information necessary to
demonstrate compliance with the GDPR.</li>
</ul>

<p>I've checked every major host provider there is and none offers such guarantees.</p>

<p>So question is, how do I as a controller comply with GDPR if there's no host provider (aka processor) who'll sign a contract addressing all 8 points required by the GDPR?</p>

<p>The regulation clearly states that controller is responsible for this.</p>

<p>Well actually... I think you'll just need to wait a little more. I monitor the situation quite closely and I can tell you that it's just a matter of time.</p>

<p>Microsoft was one of the first (if not the first) to communicate openly about the GDPR and the changes that follow. From the <a href="https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation/#sm.0001nxuz9wao1d2avz62ra3qlwqgi" rel="noreferrer">blog post</a>:</p>

<p><em>If your organization collects, hosts or analyzes personal data of EU residents, GDPR provisions require you to use third-party data processors who guarantee their ability to implement the technical and organizational requirements of the GDPR. To further earn your trust, we are making contractual commitments available to you that provide key GDPR-related assurances about our services. Our contractual commitments guarantee that you can:</em></p>

<ul>
<li><em>Respond to requests to correct, amend or delete personal data.</em></li>
<li><em>Detect and report personal data breaches.</em></li>
<li><em>Demonstrate your compliance with the GDPR.</em></li>
</ul>

<p><em>Microsoft is the first global cloud services provider to publicly offer you these contractual commitments. We believe privacy is a fundamental right. The GDPR is an important step forward to further clarify and enable individual privacy rights and look forward to sharing additional updates how we can help you comply with this new regulation and, in the process, advance personal privacy protections.</em></p>

<p>Microsoft has set up an <a href="https://www.microsoft.com/en-us/trustcenter/Privacy/GDPR" rel="noreferrer">informational site on GDPR here</a>. </p>

<p>If your eyes are on any other provider, I think the only way to learn more is getting in touch and inquiring about their progress and process. Hope this helps.</p>

<p>Here's <a href="https://www.blog.google/topics/google-cloud/google-cloud-our-commitment-general-data-protection-regulation-gdpr/" rel="nofollow noreferrer">the Google equivalent</a> of that Microsoft blog post:</p>

<blockquote>
  <p>Our users can count on the fact that Google is committed to GDPR
  compliance across G Suite and Google Cloud Platform (GCP) services
  when the GDPR takes effect on May 25, 2018.</p>
</blockquote>

<p>It's all still couched in future terms ("<em>We'll</em> make important updates to contractual commitments") so you still have the "not ready NOW" problem.</p>

<p>Here's the <a href="https://aws.amazon.com/blogs/security/aws-and-the-general-data-protection-regulation/" rel="nofollow noreferrer">Amazon version</a>.  Same deal.  Looks like everyone's still working on it.</p>
