EU-hosted company website for GDPR: real hosting costs for a Berlin firm (2026)

The verdict in three sentences

For a German SME, hosting its website with a European provider (Hetzner, Scaleway, OVHcloud, IONOS) costs between EUR 5 and 660 a month depending on service level, plus a one-off migration of EUR 800 to 2,500. The brochure site itself rarely weighs much in a GDPR analysis, but its forms, connected CRM and analytics tools process personal data your DPO must be able to map. Moving hosting to the EU reduces exposure to extraterritorial laws such as the US CLOUD Act and simplifies the records of processing, often at no extra cost compared with a US provider.

What GDPR really says about hosting in 2026

GDPR does not require hosting in Germany. It requires safeguards for transfers outside the European Union. Since 2023, the EU-US Data Privacy Framework allows transfers to certified US companies, but the framework remains contested and a host subject to US law can be compelled to hand over data. That legal uncertainty, more than illegality, is why DPOs recommend a European host not subject to US law.

The maximum GDPR fine is EUR 20 million or 4% of worldwide turnover. German data protection authorities more often fine SMEs EUR 10,000 to 500,000, but a public order alone is enough to dent a reputation.

What EU hosting costs in 2026

The figures below are 2026 ballpark prices excluding VAT, taken from public price lists and our project quotes.

Hetzner is usually the cheapest for raw compute (a capable VPS from EUR 5 to 15), Scaleway and OVHcloud offer broader managed services.

Steps for a zero-downtime migration

A clean migration takes 2 to 4 weeks. Start with the inventory: site, database, email, subdomains, certificates, third-party scripts. Then prepare the new environment, copy the data and test internally on a temporary address. The DNS switch is done with TTL lowered to 300 seconds the day before, limiting downtime to a few minutes. Finally, update the records of processing and the processing agreement, and review side tools: replace Google Analytics with a European option (Matomo, Plausible) and check where form submissions are stored.

Mini case study

Katrin Hoffmann, CFO of a Berlin medical equipment distributor (60 employees, EUR 14 million turnover), receives a memo from her DPO: the website and client extranet run on a US provider. She chooses a Hetzner dedicated vCPU server at EUR 45 a month, managed services at EUR 250 a month and a EUR 1,900 migration. First-year cost: EUR 5,440, versus EUR 3,300 before (hosting and provider included), so about EUR 2,100 extra. Against that, theoretical exposure at 4% of turnover is EUR 560,000, and the transfer impact assessment the DPO would otherwise have commissioned was quoted at EUR 3,000. The project pays for itself in year one.

FAQ

Is a US provider with Frankfurt servers compliant? It can be, under the Data Privacy Framework and contractual safeguards. CLOUD Act exposure remains, which drives 60 to 70% of the repatriation requests we receive.

Hetzner, Scaleway or OVHcloud? All three are solid. Hetzner wins on price, OVHcloud on breadth and certified offerings, Scaleway on developer experience, with VPS prices from EUR 5 to 60.

Should we change analytics tools too? It is recommended: self-hosted Matomo is free, Plausible costs EUR 9 to 19 a month. Several EU authorities have challenged Google Analytics use.

Does the migration hurt SEO? Not if URLs and content stay identical. A few minutes of downtime has no measurable effect.

What if the host has an outage? With backups on a second site (EUR 2 to 20 a month), restoration takes 1 to 4 hours. The 2021 OVHcloud data centre fire showed why a separate backup is essential.

Let's scope your project. List your sites, extranets and tools and we will cost the move to an EU host (EUR 800 to 2,500, cutover in 2 to 4 weeks) plus the right managed service level. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.