The verdict in three sentences
For a mid-sized business application holding HR and customer data, hosting with OVHcloud or Scaleway costs in the order of 80 to 600 EUR excl. tax per month, against 20 to 40% more on AWS Frankfurt or Azure EU regions for the same scope. France's SecNumCloud qualification is not required for ordinary HR data at a private Dutch company, but it is a useful benchmark if you work for public bodies or a client that demands EU-sovereign hosting in its contract. In every case, set aside 15 to 25% of the budget for backups and a disaster recovery plan.
What the GDPR actually requires for HR data
HR data (contracts, salaries, sick leave, appraisals) is personal data, and some of it is special category data under Article 9 of the GDPR, such as health information. The GDPR does not require a Dutch or European host, but it requires safeguards: controlled location and transfers, encryption, access logging and an Article 28 processing agreement. The friction point with US hyperscalers remains exposure to the CLOUD Act, even when servers sit in Frankfurt or Amsterdam.
| Requirement | What to check with the host |
|---|---|
| Data location | EU region, backups included |
| Transfers outside the EU | Support and administration from the EU, list of sub-processors |
| Encryption | At rest and in transit, key management (KMS) |
| Logging | Access logs kept 6 to 12 months |
| Article 28 agreement | Signed DPA, audit clauses, breach notification so you can meet the 72 h deadline to the Autoriteit Persoonsgegevens |
| Reversibility | Export of data and backups in standard formats |
2026 cost comparison for a mid-sized application
Assumption: a web application with 2 app servers, a managed high-availability PostgreSQL database, 500 GB of object storage and about 300 internal users. Amounts are 2026 market estimates, excluding managed services.
| Criterion | OVHcloud | Scaleway | AWS Frankfurt or Azure (EU region) | SecNumCloud-qualified offer |
|---|---|---|---|---|
| Indicative monthly cost | 250-450 EUR | 250-450 EUR | 320-630 EUR | 500-1,200 EUR |
| Gap vs OVH or Scaleway | Baseline | Baseline | +20 to +40% | x1.5 to x2.5 |
| Outbound data (egress) | Largely included | Lightly charged | Charged per GB above a threshold | Per contract |
| Legal sovereignty | European law | European law | CLOUD Act exposure | Immunity from extraterritorial laws required |
| English-language support | Yes, paid by tier | Yes | Yes, paid plans from a few % of the bill | Yes, often dedicated |
| Reversibility | Good, open standards | Good, open standards | Good if you avoid proprietary services | Good, contractual |
| Managed services catalogue | Medium | Medium to broad | Very broad | Narrow |
SecNumCloud-qualified offers in 2026 include ranges from OVHcloud, Outscale and Cloud Temple. Always check the current list published by ANSSI, the French cybersecurity agency: qualification covers a specific service, not a provider's whole catalogue.
Backups and disaster recovery: the line you must not cut
An unavailable HR application blocks payroll and onboarding. For a 120-employee company, a realistic target is a maximum data loss of 24 hours (RPO) and recovery in under 8 hours (RTO). That means encrypted daily backups in a second region, 30-day retention and a restore test at least twice a year. Under the Dutch Cyberbeveiligingswet implementing NIS2, firms in scope must also be able to document this. Allow 15 to 25% of hosting cost, or 50 to 150 EUR a month in our scenario.
Mini case study
Pieter, IT director of a 120-employee industrial company in Amsterdam, compares two options for his business application, which centralises contracts, schedules and customer records.
- Scaleway: 420 EUR a month of infrastructure, plus 20% for backups and DR, or 504 EUR a month and 18,144 EUR over 3 years.
- AWS Frankfurt, 30% more for the same scope: 546 EUR plus 20%, or 655 EUR a month and 23,580 EUR over 3 years.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
The gap is about 5,440 EUR over 3 years. Pieter picks the European host, documents the DPA and processing register, and keeps a containerised architecture so he can move to a SecNumCloud-type offer if a public-sector client ever requires it.
FAQ
Is EU hosting enough to comply with the GDPR?
No, location is only part of compliance. You also need an Article 28 agreement, encryption at rest, access logs kept 6 to 12 months and an access rights policy reviewed at least once a year.
Is SecNumCloud mandatory for HR data?
No, not for a private company in 2026, and it is a French scheme. It becomes relevant for some public-sector work or when a client demands it; expect a cost 1.5 to 2.5 times higher.
Do we need a health-data certified host?
Only if the application stores health data produced in the course of medical care. Sick-leave certificates in an HR file fall under the GDPR and strict access control, not specific health-hosting certification in most cases.
How much does a migration from AWS to OVH or Scaleway cost?
For a containerised application without proprietary services, allow 5 to 15 days of work. If the application relies on services such as Lambda, DynamoDB or Cognito, the migration can exceed 30 days.
Who runs hosting after go-live?
You can keep it in-house or hand it to your provider. At Kolonell, application maintenance follows the Basic, Standard and Premium plans at 35,000, 75,000 and 120,000 FCFA a month, about 50, 110 and 180 EUR, excluding infrastructure cost.
Let's scope your project. Describe your application, user volume and compliance constraints: we will propose a hosting architecture, an indicative monthly budget and a disaster recovery plan. Detailed quote within 48 h via our quote form. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
